The most effective way to improve disaster recovery (DR) capabilities, especially after a demonstrated failure like poor recovery times, is through a cycle of testing and refinement. Continuous testing validates the disaster recovery plan (DRP) against real-world conditions, identifies specific points of failure or bottlenecks, and measures performance. The critical second step, implementing "lessons learned," ensures that weaknesses discovered during testing (or a real event) are systematically addressed. This iterative process transforms the DRP from a static document into a dynamic and proven capability, directly targeting the root causes of the poor performance.

B. Increased training and monitoring for disaster recovery personnel who perform below expectations This is too narrow. It assumes the failure was solely due to human error, ignoring potential flaws in the plan, technology, or resource allocation.
C. Annual review and updates to the disaster recovery plan (DRP) An annual review is a necessary but insufficient activity. It is often a theoretical exercise and lacks the practical validation needed to uncover the specific issues that caused poor recovery times in an actual event.
D. Increased outsourcing of disaster recovery capabilities to ensure reliability Outsourcing shifts responsibility but does not inherently guarantee improvement. The enterprise remains accountable, and the outsourced solution would still require rigorous testing and management to be proven effective.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 4: IT Resource Optimization. The manual emphasizes that business continuity and disaster recovery plans must be regularly tested to ensure they are effective and that the enterprise can recover within the defined recovery time objectives (RTOs). The process of reviewing test results and post-incident reports to identify and implement improvements ("lessons learned") is a fundamental principle of a mature governance program. (Specifically, see concepts within Task 4.6: Ensure that IT-enabled business continuity plans are integrated with the enterprise business continuity plan).

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The management objective DSS04 Managed Continuity directly supports the correct answer. Practice DSS04.05 Plan and test managed continuity states the need to "Test the continuity plans on a regular basis to exercise the plans and identify deficiencies... Update the plans based on the results of the tests, reviews and changes in the business and IT environment." This highlights the essential link between testing and implementing corrective actions.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives. Practice DSS04.08 Conduct post-resumption review further reinforces the concept of learning from events. It advises to "Assess the effectiveness of the response to an incident or disaster after the enterprise has returned to a business-as-usual state. Identify lessons learned and required improvements to the business continuity plan..." This directly aligns with the scenario of improving capabilities after a catastrophic event.