BCI Business Continuity Management & Strategy 3 — Questions and Answers
Question 1: An organization discovers that its BCM strategy relies on a single third-party recovery vendor that also serves many of its industry competitors. What risk does this represent?
- Concentration risk (Correct answer)
- Residual risk
- Inherent risk
- Transfer risk
Correct answer: Concentration risk
Concentration risk occurs when multiple organizations depend on the same resource or vendor, potentially overwhelming that resource during a widespread industry incident.
Question 2: Which element is MOST critical to include in a Business Continuity Plan to ensure it can be activated quickly under stress?
- Detailed background on the company's history and products
- Clear activation criteria and escalation contacts with current telephone numbers (Correct answer)
- A full list of all IT assets and their serial numbers
- Annual budget allocations for the BCM program
Correct answer: Clear activation criteria and escalation contacts with current telephone numbers
Plans must include unambiguous activation criteria and up-to-date contact information so responders can act quickly without confusion during a high-stress incident.
Question 3: The BCI Good Practice Guidelines describe 'Incident Management' as distinct from 'Business Continuity Management.' What is the KEY difference?
- Incident management focuses on preventing future events; BCM focuses on recovery
- Incident management handles the immediate tactical response; BCM focuses on sustaining operations during disruption (Correct answer)
- Incident management is IT-specific; BCM covers all business functions
- Incident management is mandatory; BCM is voluntary
Correct answer: Incident management handles the immediate tactical response; BCM focuses on sustaining operations during disruption
Incident management addresses the immediate tactical response to an event, while BCM focuses on maintaining or recovering critical business operations during and after the disruption.
Question 4: A BCM practitioner is reviewing supply chain continuity. Which approach BEST reduces single-source supplier dependency?
- Requiring suppliers to hold 90 days of safety stock
- Qualifying and contracting with alternative suppliers in advance (Correct answer)
- Increasing the organization's own inventory levels
- Purchasing business interruption insurance
Correct answer: Qualifying and contracting with alternative suppliers in advance
Pre-qualifying and contracting with alternative suppliers ensures the organization can switch sourcing quickly if a primary supplier fails, rather than relying on reactive measures.
Question 5: Under ISO 22301, what term describes the point in time to which data must be restored following a disruption?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Period of Disruption (MTPD)
- Minimum Business Continuity Objective (MBCO)
Correct answer: Recovery Point Objective (RPO)
RPO (Recovery Point Objective) defines how far back in time data recovery must reach, representing the maximum acceptable amount of data loss measured in time.
Question 6: Which BCM governance structure places overall accountability for the BCM program with the organization's board or senior leadership?
- Departmental ownership model
- Top-down governance model (Correct answer)
- Peer review committee model
- IT-led governance model
Correct answer: Top-down governance model
A top-down governance model ensures senior leadership sets the tone, allocates resources, and is ultimately accountable for the effectiveness of the BCM program.
Question 7: A tabletop exercise reveals that two critical teams have conflicting recovery priorities for the same IT system. What should the BCM practitioner do FIRST?
- Escalate the conflict to legal counsel
- Document the finding and facilitate a prioritization meeting with stakeholders and senior management (Correct answer)
- Remove one team's dependency on the system from the plan
- Purchase additional IT infrastructure to resolve the conflict
Correct answer: Document the finding and facilitate a prioritization meeting with stakeholders and senior management
Conflicting recovery priorities must be resolved through structured stakeholder facilitation and senior management arbitration so that plans reflect agreed organizational priorities.
BCI Business Continuity Management & Strategy 3
An organization discovers that its BCM strategy relies on a single third-party recovery vendor that also serves many of its industry competitors.
What risk does this represent?