GRC - Governance, Risk, and Compliance Business Continuity and Resilience Questions and Answers

Question 1

What is the primary objective of conducting a Business Impact Analysis (BIA) as part of a business continuity management system?

Accepted Answer

To identify and prioritize critical business functions and their dependencies.

Answer

The primary objective of a BIA is to identify an organization's mission-critical functions and processes and determine the impact a disruption would have on them. This analysis provides the foundation for all other business continuity planning activities by establishing recovery priorities and objectives (like RTOs and RPOs). Developing technical procedures, selecting sites, and testing are all important subsequent steps based on the BIA's findings.

Question 2

A company's online transaction processing system has a defined Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. A major system failure occurs at 3:00 PM. Which statement accurately describes the business continuity requirement?

Accepted Answer

The system must be restored with data that is no older than 2:45 PM.

Answer

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time. An RPO of 15 minutes means that when the system is restored, the data must be from a point in time no more than 15 minutes before the disruption occurred. Therefore, if the failure was at 3:00 PM, the restored data must be from at least 2:45 PM. The RTO of 2 hours dictates that the system must be operational by 5:00 PM.

Question 3

In the context of GRC, how does organizational resilience differ from traditional business continuity?

Accepted Answer

Resilience incorporates the ability to adapt and thrive in a changing environment, not just recover from disruptions.

Answer

Organizational resilience is a broader, more strategic concept than business continuity. While business continuity focuses on recovering predefined functions after a disruption, resilience also includes the ability to adapt, learn, and even find opportunities during periods of stress or change. It's about evolving and thriving, not just returning to a previous state.

Question 4

An organization's GRC committee wants to validate its business continuity plan's effectiveness in a realistic manner without causing an actual business disruption. The team decides to conduct an exercise where key personnel gather in a conference room to talk through their roles and responsibilities during a simulated crisis scenario. What type of test is this?

Accepted Answer

Tabletop Exercise

Answer

A tabletop exercise is a discussion-based session where team members meet to discuss their roles and responses during a simulated emergency scenario. This type of test is designed to identify gaps in the plan and ensure personnel are familiar with procedures without the cost and risk of a live test, such as a full interruption or parallel test.

Question 5

From a GRC perspective, which of the following is the primary benefit of integrating Business Continuity Management (BCM) into the overall governance and risk management framework?

Accepted Answer

It ensures that the response to disruptive events is aligned with the organization's risk appetite and strategic objectives.

Answer

Integrating BCM into a GRC framework ensures that business continuity efforts are not siloed. This alignment connects the identification of critical processes and the investment in recovery capabilities directly to the organization's strategic goals and its overall tolerance for risk (risk appetite). It provides a holistic view, ensuring that continuity planning supports overarching governance objectives.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC - Governance, Risk, and Compliance Business Continuity and Resilience Questions and Answers