Risk and Business Impact Analysis Flashcards
7 cards from real BCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk and Business Impact Analysis flashcards as text
Which stakeholder group is considered the PRIMARY source of information during BIA data collection interviews?
Answer: Business process owners and department managers
Business process owners and department managers have direct knowledge of operational dependencies, impact thresholds, and recovery requirements for their functions.
An organization discovers that a critical supplier provides a component used in 90% of its products, with no alternative supplier available. This situation represents a:
Answer: Single point of failure
A single point of failure is any element whose loss would cause a critical process to fail, and a sole-source supplier with no backup qualifies as one.
The BCM team documents that regulatory reporting must resume within 4 hours of any disruption to avoid legal penalties. This 4-hour requirement directly informs which BIA output?
Answer: Recovery Time Objective (RTO)
The RTO for the regulatory reporting function must be set at or below 4 hours to satisfy the compliance requirement without incurring penalties.
Risk appetite differs from risk tolerance in BCM primarily because:
Answer: Risk appetite is the overall level of risk an organization is willing to accept strategically; risk tolerance is the acceptable variation around specific objectives
Risk appetite is a broad strategic statement, while risk tolerance defines acceptable deviation boundaries around specific goals or processes.
A manufacturing company's BIA shows that production line A generates $2M/day and production line B generates $200K/day. During limited recovery resources, which line should receive recovery priority?
Answer: Line A, because it has the highest financial impact
Financial impact data from the BIA directly drives recovery prioritization, ensuring the highest-value processes are restored first.
When a BCM risk register is reviewed and a threat is found to have been mitigated to an acceptable level, the remaining risk is called:
Answer: Residual risk
Residual risk is the risk that remains after controls and mitigation measures have been applied, which must then be accepted, further reduced, or transferred.
A BIA questionnaire asks: 'What is the minimum staffing level required to sustain your function at 50% capacity during a disruption?' This question is designed to identify the:
Answer: Minimum Business Continuity Objective (MBCO)
The Minimum Business Continuity Objective (MBCO) defines the minimum level of service or output a function must deliver during a disruption to satisfy stakeholder requirements.