CRA BCP & Crisis Scenario Planning 3 — Questions and Answers
Question 1: A financial firm's BCP identifies that its trading platform must recover within 2 hours. After testing, actual recovery takes 5 hours. What is the appropriate next step?
- Accept the gap and update the RTO
- Revise the recovery strategy to close the gap (Correct answer)
- Reclassify the trading platform as non-critical
- Outsource the recovery to a third party immediately
Correct answer: Revise the recovery strategy to close the gap
When actual recovery time exceeds the RTO, the organization must improve its recovery strategy — not simply adjust the objective to match poor performance.
Question 2: Which element of a crisis management plan addresses how the organization will maintain brand reputation during and after a disruptive event?
- Technical recovery procedures
- Communication and public relations strategy (Correct answer)
- Supply chain diversification
- Employee relocation protocols
Correct answer: Communication and public relations strategy
The communication and public relations strategy within a crisis plan governs messaging to protect and restore organizational reputation.
Question 3: During scenario planning, which technique involves assigning probabilities to multiple plausible future states to prepare for uncertainty?
- Root cause analysis
- Monte Carlo simulation
- Probabilistic scenario analysis (Correct answer)
- Gap analysis
Correct answer: Probabilistic scenario analysis
Probabilistic scenario analysis assigns likelihood estimates to different future scenarios, enabling risk-adjusted planning and resource allocation.
Question 4: A business impact analysis (BIA) prioritizes recovery based primarily on:
- Employee headcount
- Criticality of business functions and financial impact of disruption (Correct answer)
- Geographic location of offices
- Age of the organization's infrastructure
Correct answer: Criticality of business functions and financial impact of disruption
A BIA ranks business functions by their criticality and the financial or operational impact their disruption would cause, driving recovery prioritization.
Question 5: Which crisis scenario category involves a gradual, long-term threat that builds slowly and may be overlooked until it becomes a crisis?
- Sudden crisis
- Smoldering crisis (Correct answer)
- Bizarre crisis
- Confrontation crisis
Correct answer: Smoldering crisis
A smoldering crisis develops slowly over time and is often ignored until it erupts publicly, such as a product defect or compliance failure.
Question 6: Under the FFIEC guidelines for US financial institutions, BCP programs must address which of the following as a primary component?
- Marketing continuity
- Business impact analysis and testing (Correct answer)
- Executive compensation plans
- Customer loyalty programs
Correct answer: Business impact analysis and testing
FFIEC guidelines require financial institutions to conduct rigorous business impact analyses and regularly test their continuity plans to ensure operational resilience.
Question 7: Which term describes the practice of maintaining critical business data in two or more geographically separate locations simultaneously?
- Data mirroring
- Geo-redundancy (Correct answer)
- Load balancing
- Failback
Correct answer: Geo-redundancy
Geo-redundancy ensures that data and systems are replicated across geographically dispersed sites to protect against location-specific disasters.
CRA BCP & Crisis Scenario Planning 3
A financial firm's BCP identifies that its trading platform must recover within 2 hours.
After testing, actual recovery takes 5 hours.
What is the appropriate next step?