BCM Risk and Business Impact Analysis 2 — Questions and Answers
Question 1: Which BIA metric measures the maximum amount of data loss an organization can tolerate after a disruption?
- Maximum Tolerable Downtime (MTD)
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Work Recovery Time (WRT)
Correct answer: Recovery Point Objective (RPO)
RPO defines the point in time to which data must be recovered, representing the maximum acceptable data loss.
Question 2: During a BIA, a process owner states that their function can tolerate no more than 4 hours of downtime before significant financial losses occur. This threshold is best described as the:
- Recovery Point Objective
- Maximum Tolerable Downtime (Correct answer)
- Recovery Time Objective
- Minimum Business Continuity Objective
Correct answer: Maximum Tolerable Downtime
Maximum Tolerable Downtime (MTD) is the longest period a business function can be unavailable before the disruption causes unacceptable consequences.
Question 3: Which risk assessment technique assigns probability and impact values on a numerical scale to calculate a composite risk score?
- Delphi technique
- Quantitative risk analysis (Correct answer)
- Qualitative risk analysis
- SWOT analysis
Correct answer: Quantitative risk analysis
Quantitative risk analysis uses numerical values for probability and impact to calculate measurable risk scores such as Annual Loss Expectancy (ALE).
Question 4: A BIA reveals that a payroll processing system has an MTD of 72 hours. The BCM team should set the RTO:
- Equal to the MTD at 72 hours
- Greater than the MTD to allow buffer time
- Less than the MTD to ensure recovery before critical impact (Correct answer)
- Independent of MTD based solely on IT capacity
Correct answer: Less than the MTD to ensure recovery before critical impact
The RTO must be set less than the MTD so that recovery occurs before the organization reaches unacceptable impact levels.
Question 5: What is the primary purpose of a threat and vulnerability assessment in the context of BCM risk analysis?
- To calculate financial loss estimates for insurance purposes
- To identify potential sources of disruption and organizational weaknesses (Correct answer)
- To document recovery time objectives for each business unit
- To rank business processes by revenue contribution
Correct answer: To identify potential sources of disruption and organizational weaknesses
A threat and vulnerability assessment identifies what could cause disruption (threats) and where the organization is exposed (vulnerabilities) to prioritize risk treatment.
Question 6: Which formula correctly expresses Annual Loss Expectancy (ALE) in quantitative risk analysis?
- ALE = Asset Value × Annualized Rate of Occurrence
- ALE = Single Loss Expectancy × Annualized Rate of Occurrence (Correct answer)
- ALE = Single Loss Expectancy + Exposure Factor
- ALE = Annualized Rate of Occurrence ÷ Exposure Factor
Correct answer: ALE = Single Loss Expectancy × Annualized Rate of Occurrence
ALE = SLE × ARO, where SLE is the loss from a single incident and ARO is how often the event is expected per year.
Question 7: In a BIA interview, a department head says their function has a 'low' impact if unavailable for one day but 'critical' impact after three days. This escalating impact profile is called:
- Cascading failure analysis
- Temporal impact escalation
- Time-sensitive impact scaling (Correct answer)
- Impact threshold progression
Correct answer: Time-sensitive impact scaling
Time-sensitive impact scaling describes how the severity of disruption consequences increases over time, informing MTD and recovery prioritization.
BCM Risk and Business Impact Analysis 2
Which BIA metric measures the maximum amount of data loss an organization can tolerate after a disruption?