Risk Assessment & Business Impact Analysis Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Business Impact Analysis flashcards as text
Which stakeholder group should VALIDATE BIA findings before they are submitted to senior leadership?
Answer: Process owners and department managers for each function assessed
Process owners have the operational knowledge to confirm or correct impact ratings, RTOs, and dependencies identified during the BIA.
A risk assessment reveals a high-likelihood, low-impact risk and a low-likelihood, high-impact risk. Which risk typically receives priority attention in resilience planning?
Answer: Low-likelihood, high-impact because it could be catastrophic and is harder to recover from
Resilience programs prioritize catastrophic, hard-to-recover scenarios even when probability is low, because the consequences of inaction are severe.
Which standard provides internationally recognized guidance specifically for Business Continuity Management Systems (BCMS) including BIA requirements?
Answer: ISO 22301
ISO 22301 is the international standard for BCMS and explicitly requires organizations to conduct a BIA as part of the planning process.
During a BIA, the concept of 'cascading failure' refers to:
Answer: A disruption in one function that triggers failures in dependent downstream functions
Cascading failure occurs when a primary disruption propagates through dependencies, causing secondary failures in interconnected processes.
What is the key output of the risk identification phase in a formal risk assessment process?
Answer: A comprehensive inventory of potential threats, vulnerabilities, and affected assets
Risk identification produces an initial risk inventory before any analysis, rating, or treatment decisions are made.
An organization wants to reduce the likelihood of a flood impacting its data center. Installing flood barriers and improving drainage is an example of which risk treatment?
Answer: Risk reduction (mitigation)
Physical controls that reduce the probability or severity of a threat occurring are risk reduction (mitigation) strategies.
Which BIA interview question BEST helps quantify the financial impact of a process outage?
Answer: What revenue or cost exposure does your function generate per hour of downtime?
Quantifying hourly financial exposure directly links downtime duration to measurable loss, enabling defensible RTO prioritization.