Risk Assessment & Business Impact Analysis Flashcards

What is 'single point of failure (SPOF)' analysis, and why is it a critical component of business continuity risk assessment?

Answer: An analysis identifying components or resources whose failure alone would cause a critical function to fail, enabling elimination or mitigation of those vulnerabilities

SPOF analysis identifies individual components, systems, or resources whose failure alone—without any other failure—would cause a critical business function to fail. Eliminating or mitigating SPOFs is fundamental to building resilient systems and processes.

A company's BIA reveals that its payroll processing function has an RTO of 24 hours and an RPO of 4 hours. What do these parameters tell the BC planner?

Answer: Payroll must be restored within 24 hours, and data must be recovered to within 4 hours before the disruption

An RTO of 24 hours means the payroll function must be restored within 24 hours of the disruption. An RPO of 4 hours means payroll data must be recoverable to a state no older than 4 hours before the disruption—meaning no more than 4 hours of data can be permanently lost.

Which qualitative risk analysis tool uses a grid to visually plot risks by their likelihood and potential impact to help prioritize mitigation efforts?

Answer: Risk matrix (heat map)

A risk matrix (heat map) is a two-dimensional grid plotting likelihood (probability) on one axis and impact (consequence) on the other, creating a visual representation that immediately shows which risks require priority attention.

During a risk assessment, the team identifies that a critical supplier is the sole provider of a key component. This is BEST addressed through which type of risk treatment?

Answer: Risk reduction — qualify and onboard alternative suppliers to reduce dependency

Risk reduction through qualifying and onboarding alternative suppliers directly addresses the single-supplier vulnerability, reducing the likelihood and impact of supply chain disruption without eliminating the business activity.

What is the purpose of conducting a 'gap analysis' as part of the business continuity risk assessment process?

Answer: To compare the organization's current continuity capabilities against the requirements identified in the BIA and risk assessment

A gap analysis in business continuity compares the organization's current recovery capabilities—existing plans, systems, resources—against the requirements identified through the BIA and risk assessment, identifying where additional investment or development is needed.

In risk assessment, what distinguishes 'inherent risk' from 'residual risk'?

Answer: Inherent risk is the risk existing before controls are applied; residual risk is the risk remaining after controls are implemented

Inherent risk is the level of risk existing before any controls, mitigations, or treatments are applied. Residual risk is the risk that remains after controls and treatments have been implemented.