Risk Assessment & Business Impact Analysis Flashcards

In a Business Impact Analysis (BIA), what does 'Maximum Tolerable Downtime (MTD)' represent?

Answer: The total duration the organization can survive without a critical function before it reaches an unacceptable outcome

Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before the organization suffers irreversible consequences—financial, operational, legal, or reputational—from which it cannot recover.

A qualitative risk assessment approach rates risks using categories such as 'High, Medium, Low' rather than numerical values. What is a primary LIMITATION of this approach?

Answer: Ratings can be inconsistent across different assessors without clear definitions

Qualitative risk assessments rely on subjective judgment, meaning two different assessors may rate the same risk differently without standardized definitions for each rating level, reducing consistency and comparability.

What is the difference between a 'threat' and a 'vulnerability' in risk assessment?

Answer: A threat is a potential cause of harm; a vulnerability is a weakness that could be exploited by a threat

A threat is something external that could cause harm (hurricane, cyberattack, supply chain failure), while a vulnerability is an internal weakness or condition that makes the organization susceptible to harm from a threat.

When conducting a BIA, what is the MOST important output for determining recovery strategy investment levels?

Answer: Prioritized business functions with their RTOs, RPOs, and MTDs

Prioritized business functions with their RTOs, RPOs, and MTDs are the critical BIA output—they directly drive decisions about how much to invest in recovery capabilities for each function and what recovery strategies are appropriate.

In risk assessment, 'risk tolerance' differs from 'risk appetite' in that:

Answer: Risk appetite is the level of risk an organization is willing to accept to achieve objectives; risk tolerance is the acceptable deviation around that appetite

Risk appetite is the broad amount and type of risk an organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable variation around the risk appetite—the boundaries within which specific risks can fluctuate before triggering escalation.

Which element of a Business Impact Analysis determines which business functions are 'mission critical'?

Answer: The assessment of impact over time if the function is unavailable

Mission criticality is determined by assessing the magnitude and timing of impacts if a function becomes unavailable—functions whose unavailability quickly produces severe financial, operational, legal, or reputational impacts are classified as mission critical.