Business Impact Analysis and Risk Assessment
Business impact analysis (BIA) and risk assessment are complementary, not interchangeable. The BIA works forward from disruption to consequence: it identifies priority activities supporting products and services, then determines the impact over time of losing them. The risk assessment works from threat to likelihood and consequence, informing which risks need treatment. Exams frequently test whether you can tell which technique answers a given question.
Core BIA concepts: maximum tolerable period of disruption (MTPD), recovery time objective (RTO), recovery point objective (RPO), minimum business continuity objective (MBCO), and dependencies. MTPD is the point beyond which impacts become unacceptable; RTO is the target time to restore, and must be shorter than MTPD to leave a margin. RPO concerns tolerable data loss, typically for IT. MBCO defines the minimum acceptable service level during disruption. Impacts are usually assessed across financial, regulatory, reputational, operational, and safety categories, and mapped over time (for example, hours, days, weeks) because impact grows nonlinearly.
Traps: candidates set RTO equal to MTPD (no margin), confuse RPO with RTO, treat BIA as a risk register exercise, or forget dependency mapping (suppliers, systems, people, facilities). Another trap is assuming the loudest business unit is the most critical; prioritization must be evidence-based and approved by management.
Worked example: a payment service has an MTPD of 24 hours, an RTO of 12 hours, and an RPO of 15 minutes. The 12-hour RTO leaves a 12-hour buffer for escalation and verification, and the 15-minute RPO drives backup frequency. A proposed recovery solution that restores in 20 hours fails the RTO test even though it is under the MTPD.
Rule of thumb: BIA answers "what matters and how quickly," risk assessment answers "what could happen and how likely."