Usually have procedures, but most don't? Say again
The disaster plan says there is a process, but it has never been used and is probably outdated. Chances are the social media strategy requires posting on the Facebook and updating key Circles on Google+
Yes, they say we have backup procedures, but have they ever tested that the backups work? They write procedures to please auditors:)