Risk Assessment & Impact Analysis Flashcards

Which technique uses a structured 'what-if' approach to systematically identify potential failure modes in a business continuity context?

Answer: HAZOP (Hazard and Operability Study)

HAZOP systematically examines processes using guide words to identify deviations that could cause disruptions.

In a Business Impact Analysis, what does the term 'single point of failure' refer to?

Answer: A component whose failure causes the entire system or process to stop functioning

A single point of failure is any non-redundant element whose failure would halt the entire dependent system or process.

The BCI Good Practice Guidelines recommend that BIA data should be validated by:

Answer: Senior management and process owners, not just IT

BIA outputs must be validated by process owners and senior management to ensure accuracy and business relevance.

Which risk treatment option involves accepting the potential consequences of a risk without taking mitigating action?

Answer: Risk retention

Risk retention (or acceptance) means the organization consciously decides to absorb the impact if the risk materializes.

When conducting a BIA, 'interdependency mapping' is used to:

Answer: Identify upstream and downstream dependencies that could amplify disruption impact

Interdependency mapping reveals how a disruption to one process can cascade to affect other connected processes.

What is the primary purpose of a Maximum Tolerable Period of Disruption (MTPD)?

Answer: To define the absolute time limit beyond which business viability is threatened

MTPD is the outer boundary of acceptable disruption, after which the organization may not be able to survive as a going concern.

In risk assessment, 'inherent risk' differs from 'residual risk' in that inherent risk is:

Answer: The risk level before any controls are applied

Inherent risk is the raw, uncontrolled risk level; residual risk is what remains after controls are implemented.