BCM Risk and Business Impact Analysis 3 — Questions and Answers
Question 1: Which of the following is NOT typically identified during a Business Impact Analysis?
- Critical business functions
- Recovery strategies and solutions (Correct answer)
- Interdependencies between processes
- Financial impact of downtime
Correct answer: Recovery strategies and solutions
Recovery strategies are developed after the BIA findings; the BIA itself identifies impacts, dependencies, and requirements — not the solutions.
Question 2: A company identifies that its customer service platform depends on both the CRM database and the telephony system. This relationship is best documented as a:
- Single point of failure
- Process interdependency (Correct answer)
- Cascading risk scenario
- Residual risk item
Correct answer: Process interdependency
Process interdependencies map how one function relies on others, which is critical for sequencing recovery efforts in a BIA.
Question 3: Which risk treatment option involves transferring the financial consequences of a risk to a third party?
- Risk avoidance
- Risk mitigation
- Risk acceptance
- Risk transfer (Correct answer)
Correct answer: Risk transfer
Risk transfer, typically through insurance or contracts, shifts the financial burden of a risk to another party without eliminating the risk itself.
Question 4: An organization's BIA identifies that manual workarounds can sustain a billing function for up to 48 hours. This capability is best described as:
- Residual risk tolerance
- Business continuity strategy
- Interim continuity measure (Correct answer)
- Recovery workaround capacity
Correct answer: Interim continuity measure
Interim continuity measures (or workarounds) allow a function to continue operating at reduced capacity during a disruption until full recovery is achieved.
Question 5: During risk identification, the BCM team uses historical data, industry reports, and expert judgment. Combining these diverse inputs best reflects which principle?
- Single-source validation
- Multi-source risk intelligence (Correct answer)
- Quantitative dominance
- Regulatory compliance alignment
Correct answer: Multi-source risk intelligence
Using multiple sources for risk identification reduces blind spots and increases the comprehensiveness of the risk register.
Question 6: Which BCM standard provides internationally recognized guidance on Business Impact Analysis methodology?
- ISO 27001
- ISO 22301 (Correct answer)
- NIST SP 800-53
- PCI DSS
Correct answer: ISO 22301
ISO 22301 is the international standard for Business Continuity Management Systems and includes requirements and guidance for conducting a BIA.
Question 7: A risk matrix plots threats on axes of likelihood and impact. A risk with HIGH likelihood but LOW impact would typically receive which priority?
- Highest priority requiring immediate mitigation
- Moderate priority with routine monitoring (Correct answer)
- Lowest priority — accept and document
- Transfer immediately to insurance
Correct answer: Moderate priority with routine monitoring
High-likelihood, low-impact risks are generally monitored and managed through routine controls rather than requiring emergency mitigation resources.
BCM Risk and Business Impact Analysis 3
Which of the following is NOT typically identified during a Business Impact Analysis?