BCI Case Analysis & Practical Application 3 — Questions and Answers
Question 1: A university's BC plan was written by IT staff and focuses entirely on technology recovery. Which stakeholder gap most likely caused this?
- Insufficient IT budget
- Lack of cross-departmental involvement in the BIA and plan development (Correct answer)
- Poor communication from senior management
- Overly complex recovery objectives
Correct answer: Lack of cross-departmental involvement in the BIA and plan development
BC plans that focus solely on IT result from excluding operational, academic, and support department stakeholders from the development process.
Question 2: Following a severe winter storm, a call center cannot open. The BC plan routes calls to a vendor in another region, but the vendor's contract does not include provisions for surge capacity. What type of risk was overlooked?
- Force majeure risk
- Supply chain dependency and third-party capacity risk (Correct answer)
- Reputational risk
- Regulatory compliance risk
Correct answer: Supply chain dependency and third-party capacity risk
Failing to contractually secure surge capacity from the vendor is a third-party dependency risk that undermines the recovery strategy.
Question 3: An airline's BC plan specifies a Recovery Point Objective of 1 hour for reservation data. After a system failure, data is restored but is 6 hours old. What failed?
- The incident command structure
- The backup frequency or replication mechanism did not meet the RPO requirement (Correct answer)
- Staff were not notified in time
- The RTO was set too low
Correct answer: The backup frequency or replication mechanism did not meet the RPO requirement
An RPO of 1 hour requires backups or replication at least every hour; 6-hour-old data indicates the technical solution did not match the objective.
Question 4: A government agency conducts a full-scale exercise and discovers that its alternate work site lacks sufficient network bandwidth for critical operations. At what stage should this have been identified?
- During the post-exercise debrief
- During the design and validation of the recovery strategy (Correct answer)
- When invoking the plan in a real event
- During annual plan review
Correct answer: During the design and validation of the recovery strategy
Recovery strategy design must include validating that alternate sites have the infrastructure required to support critical activities.
Question 5: A scenario analysis reveals that the loss of a single key supplier would halt production for 3 weeks, exceeding the company's MTPoD. Which response best addresses this finding?
- Increase the MTPoD to 4 weeks
- Develop a supplier diversification strategy and pre-qualify alternate suppliers (Correct answer)
- Reduce reliance on the BIA findings
- Transfer the risk to an insurance policy only
Correct answer: Develop a supplier diversification strategy and pre-qualify alternate suppliers
Pre-qualifying alternate suppliers reduces dependency on a single source and provides viable options when the primary supplier fails.
Question 6: An organization's incident management team invokes the BC plan but lacks authority to approve emergency spending. Production recovery stalls waiting for financial approvals. What should the plan have defined?
- A separate IT recovery plan
- Pre-authorized financial limits and spending authority for incident managers (Correct answer)
- A longer recovery time objective
- A post-incident financial review process
Correct answer: Pre-authorized financial limits and spending authority for incident managers
BC plans must include pre-delegated financial authority so incident managers can act without delays during a crisis.
Question 7: A pharmaceutical company's BC plan is tested and works well for a single-site outage. However, a pandemic scenario reveals the plan cannot handle simultaneous disruption across all sites. What does this demonstrate?
- The company's BC maturity is at the highest level
- Scenario scope limitations — the plan was designed for localized, not widespread disruption (Correct answer)
- The pandemic was an unforeseeable event that no plan could address
- Tabletop exercises are insufficient for pandemic planning
Correct answer: Scenario scope limitations — the plan was designed for localized, not widespread disruption
Plans designed for localized disruptions may not scale to wide-area events, requiring separate scenario-specific strategies.
BCI Case Analysis & Practical Application 3
A university's BC plan was written by IT staff and focuses entirely on technology recovery.
Which stakeholder gap most likely caused this?