I85PREP
⌘ K
BCPMP study materials
BCPMP study resources

BCPMP practice questions

One question at a time. Build your BCPMP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Continuity Program Initiation and Management

Which document formally authorizes a business continuity program and assigns its executive sponsor?

  1. The disaster recovery runbook
  2. The business continuity policy charter Correct answer.
  3. The business impact analysis report
  4. The internal audit plan

Explanation

A policy charter is the governing document that establishes the program's mandate, scope, and accountable executive, giving the work legitimate authority. The other artifacts are downstream deliverables that depend on the program already existing.

Question 2Business Continuity Program Initiation and Management

An organization's continuity policy is approved but no funding or staff have been assigned. Which program element is missing?

  1. A completed recovery time objective
  2. A third-party risk register
  3. Management commitment translated into resources Correct answer.
  4. A tested emergency communications tool

Explanation

Visible sponsorship must be expressed through budget, staffing, and decision authority, not just a signed document. Without resources the policy remains aspirational and the program cannot progress.

Question 3Business Continuity Program Initiation and Management

What is the primary purpose of defining the scope of a business continuity program?

  1. To establish which units, sites, and services the program governs Correct answer.
  2. To guarantee that no disruption will ever affect operations
  3. To replace the enterprise risk management function
  4. To satisfy insurance underwriting requirements only

Explanation

Scope sets boundaries so planning, analysis, and testing effort is directed at the right organizational units and services. Clear boundaries also prevent gaps and duplicated effort across departments.

Question 4Business Continuity Program Initiation and Management

A continuity manager is drafting the program's first-year roadmap. Which sequencing is most defensible?

  1. Plan testing, then policy approval, then business impact analysis
  2. Strategy selection, then governance design, then scope definition
  3. Business impact analysis, then plan testing, then policy approval
  4. Policy and governance, then business impact analysis, then strategy and plans Correct answer.

Explanation

Governance must precede analysis so that the impact study has authority, agreed scope, and participants. Strategy and plan development logically follow the impact findings.

Question 5Business Continuity Program Initiation and Management

Which role typically owns the continuity program's day-to-day coordination while the executive sponsor provides authority?

  1. The chief financial officer
  2. The business continuity program manager Correct answer.
  3. The external audit partner
  4. The facilities maintenance supervisor

Explanation

The program manager runs planning cycles, coordinates business impact analysis, and reports status, while the sponsor removes obstacles and secures funding. Separating these roles keeps accountability clear.

Question 6Business Continuity Program Initiation and Management

A newly appointed continuity manager wants to build a network of departmental planners. What structure best supports this?

  1. An informal chat group without named members
  2. A continuity steering committee with business unit representatives Correct answer.
  3. An outsourced vendor with no internal counterparts
  4. A single part-time analyst working alone

Explanation

A cross-functional committee with named representatives embeds ownership across the organization and provides a forum for decisions and escalation. Single points of failure or unnamed groups undermine sustained participation.

Question 7Business Continuity Program Initiation and Management

Which statement best describes how continuity policy should relate to other corporate policies?

  1. It should be written and approved only by the continuity team
  2. It should be approved at the same executive level and cross-reference related policies Correct answer.
  3. It should remain confidential to the continuity office
  4. It should duplicate the content of the information security policy

Explanation

Policy harmonization at a consistent approval level prevents conflicts and ensures the continuity requirements are recognized across the organization. Cross-references make dependencies on related policies explicit.

Question 8Business Continuity Program Initiation and Management

What is the most appropriate first step when a continuity program is being initiated in an organization with no prior planning?

  1. Draft detailed recovery procedures for every system
  2. Conduct a maturity assessment and stakeholder analysis Correct answer.
  3. Schedule a full-scale live failover exercise
  4. Purchase a continuity planning software suite

Explanation

Understanding the current state and identifying stakeholders lets leaders target effort and build a credible roadmap. Tooling and detailed procedures should follow once needs are understood.

Question 9Business Continuity Program Initiation and Management

How does a continuity program's awareness and training component contribute to program initiation?

  1. It eliminates the need for executive sponsorship
  2. It builds staff understanding of roles before disruptions occur Correct answer.
  3. It replaces the need for documented recovery plans
  4. It transfers legal liability to individual employees

Explanation

Training and awareness create baseline competence and familiarity with roles so response is faster and more coordinated. They support, but never replace, documented plans or executive sponsorship.

Question 10Business Continuity Program Initiation and Management

A regulator requires the organization to demonstrate continuity capability. How should this requirement influence program initiation?

  1. It should be ignored because regulations rarely affect continuity
  2. It should be captured as a compliance driver shaping scope and priorities Correct answer.
  3. It should postpone the program until the next audit cycle
  4. It should be delegated entirely to the legal department

Explanation

Regulatory obligations are legitimate drivers that shape scope, documentation standards, and testing frequency, and should be tracked within the program charter. Deferring or ignoring them creates compliance exposure.

Question 11Business Continuity Program Initiation and Management

Which metric best indicates that a continuity program is gaining organizational traction in its first year?

  1. The percentage of critical units with approved plans and named coordinators Correct answer.
  2. The number of pages in the continuity policy document
  3. The total count of software licenses purchased
  4. The number of meetings held by the continuity office

Explanation

Coverage of critical units with approved plans and accountable coordinators demonstrates real embedding of the program. Volume-based measures such as page counts or meeting tallies do not show capability.

Question 12Business Continuity Program Initiation and Management

What is the primary function of a program charter in continuity management?

  1. To define objectives, scope, authority, and reporting lines Correct answer.
  2. To serve as the contract with the recovery vendor
  3. To record the results of the most recent recovery test
  4. To list every server and network device in the data center

Explanation

A charter establishes the program's purpose, boundaries, delegated authority, and reporting relationships, giving the program manager a clear mandate. Inventories, test results, and contracts are separate artifacts.

Question 13Business Continuity Program Initiation and Management

An organization operates in several countries with differing labor and privacy laws. What should the continuity program do first when setting global scope?

  1. Identify legal and regulatory variations that constrain planning and data handling Correct answer.
  2. Outsource all international continuity planning to local staff without oversight
  3. Apply a single plan template everywhere without local review
  4. Exclude international sites to simplify the program

Explanation

Legal, privacy, and labor differences affect what data can be shared and how staff can be mobilized, so they must be identified before templates are imposed. Local review and oversight remain necessary even when planning is decentralized.

Question 14Business Continuity Program Initiation and Management

Which activity belongs to program initiation rather than to later program phases?

  1. Negotiating alternate site lease terms
  2. Performing detailed recovery strategy cost analysis
  3. Establishing governance and securing executive approval Correct answer.
  4. Executing a tabletop exercise with all departments

Explanation

Initiation establishes authority, governance, and sponsorship that make later work possible. Strategy cost analysis, exercises, and vendor negotiations occur in subsequent phases once the program is authorized.

Question 15Business Continuity Program Initiation and Management

Senior leaders ask how continuity spending will be justified. What approach best supports the business case?

  1. Present the cost without any reference to risk or impact
  2. Tie investment to prioritized risks and quantified impact of disruption Correct answer.
  3. Promise that continuity eliminates all future losses
  4. Emphasize that continuity is a legal formality only

Explanation

A credible business case connects spending to identified risks and the financial and operational consequences of disruption. Overpromising or framing the program as a formality weakens credibility.

Question 16Business Continuity Program Initiation and Management

What distinguishes a continuity program's governance from its operational response structure?

  1. Governance only applies during audits, while response structure applies daily
  2. Governance is owned by vendors, while response structure is owned by staff
  3. Governance and response structure are identical in purpose and membership
  4. Governance sets decision rights and oversight, while response structure executes during incidents Correct answer.

Explanation

Governance provides ongoing oversight, policy, and decision rights, whereas the response structure is activated to manage incidents and recovery. Conflating them blurs accountability.

Question 17Business Continuity Program Initiation and Management

Which element is essential when defining continuity roles for business unit leaders?

  1. Documented responsibilities for plan ownership and staff accountability Correct answer.
  2. Authority to override executive policy decisions
  3. Responsibility for approving the enterprise continuity budget
  4. A guarantee that their unit will never be disrupted

Explanation

Business unit leaders need explicit, documented responsibilities for maintaining plans and accounting for their people so ownership is unambiguous. They do not gain authority over enterprise policy or budget approval.

Question 18Business Continuity Program Initiation and Management

A continuity manager discovers that a key department has no representative on the steering committee. What is the best response?

  1. Add a representative to ensure the department's requirements are represented Correct answer.
  2. Remove another department to keep the committee balanced
  3. Proceed without them because committee size should stay small
  4. Assign the department's duties to the continuity office permanently

Explanation

Committees must include representatives of critical functions so decisions reflect operational reality and ownership is distributed. Permanently absorbing duties into the continuity office creates a bottleneck and weakens accountability.

Question 19Business Continuity Program Initiation and Management

Which statement best captures the relationship between the continuity program and enterprise risk management?

  1. Enterprise risk management has no connection to continuity planning
  2. Continuity feeds disruption scenarios and treatment plans into the enterprise risk process Correct answer.
  3. Continuity only addresses financial risk while risk management covers operations
  4. Continuity replaces enterprise risk management entirely

Explanation

Continuity analysis generates disruption scenarios, dependencies, and mitigation plans that inform the enterprise risk register. The two disciplines are complementary rather than substitutes.

Question 20Business Continuity Program Initiation and Management

What is the most appropriate way to secure sustained funding for a continuity program after its initial approval?

  1. Fund the program only from unspent project budgets
  2. Request a single large budget once and assume it continues
  3. Avoid reporting to leadership to reduce scrutiny
  4. Report readiness metrics and risk reduction to leadership on a regular cycle Correct answer.

Explanation

Recurring reporting on readiness and risk reduction keeps the program visible and lets leaders connect spend to outcomes. One-time budgets and ad hoc funding sources are fragile and erode program stability.

Question 21Business Continuity Program Initiation and Management

An executive sponsor leaves the organization mid-program. What is the most important immediate action?

  1. Transfer the program to an external consultant
  2. Suspend all continuity activities indefinitely
  3. Secure a replacement sponsor with equivalent authority Correct answer.
  4. Reduce the program scope to a single department

Explanation

Sponsorship continuity preserves funding, decision authority, and organizational attention. Suspending or shrinking the program in response to a personnel change creates avoidable risk.

Question 22Business Continuity Program Initiation and Management

Which practice best ensures continuity policy requirements are followed by business units?

  1. Embedding continuity obligations in unit objectives and performance reviews Correct answer.
  2. Relying solely on voluntary participation by interested staff
  3. Publishing the policy once without any follow-up
  4. Delegating enforcement to external auditors

Explanation

Embedding obligations in objectives and performance reviews aligns incentives and makes compliance a normal part of management. Voluntary participation and one-time publication rarely produce sustained adherence.

Question 23Business Continuity Program Initiation and Management

Which consideration most affects how a continuity program should be structured in a highly decentralized organization?

  1. Balancing local ownership with enterprise standards and oversight Correct answer.
  2. Centralizing every plan in a single corporate document
  3. Allowing each unit to define its own unrelated methodology
  4. Eliminating all local planning to enforce uniformity

Explanation

Decentralized structures require a framework that preserves local ownership while enforcing common standards, terminology, and reporting. Extremes of complete uniformity or complete autonomy both create dysfunction.

Question 24Business Continuity Program Initiation and Management

What is the purpose of a continuity program maturity model during initiation?

  1. To certify that the organization is fully resilient
  2. To replace the need for a business impact analysis
  3. To benchmark current capability and prioritize improvement steps Correct answer.
  4. To measure individual employee performance ratings

Explanation

Maturity models describe staged capabilities so leaders can benchmark the current state and sequence realistic improvements. They are diagnostic tools, not certifications of resilience.

Question 25Business Continuity Program Initiation and Management

A continuity program is being launched with limited staff. Which prioritization approach is most sound?

  1. Focus first on functions whose disruption most threatens the organization Correct answer.
  2. Delay all planning until staffing is increased
  3. Prioritize the departments that volunteer first
  4. Plan every function simultaneously regardless of criticality

Explanation

Scarce resources should follow criticality so the greatest risks are addressed earliest. Volunteer-driven or simultaneous coverage can leave the most important functions unprotected.

Question 26Business Continuity Program Initiation and Management

During program initiation, a continuity manager must assemble the team that will write and maintain business continuity plans. Which group of people most appropriately fills the core plan-writing roles?

  1. The information technology help desk staff
  2. The corporate legal department
  3. Business unit subject matter experts who own the processes Correct answer.
  4. External auditors who can certify plan quality

Explanation

Plan authors must understand how a process actually works, its dependencies, and its recovery priorities, so the people who own and operate the process are the right authors. Specialists such as IT, legal, and audit advise and review, but they cannot describe business recovery requirements on the owner's behalf.

Question 27Business Continuity Program Initiation and Management

A continuity manager is drafting the schedule for the program's first year. Which sequencing principle should guide the order of major activities?

  1. Recovery strategy selection should precede the business impact analysis
  2. Business impact analysis and risk assessment should precede recovery strategy selection and plan development Correct answer.
  3. Training and awareness should run before any risk assessment is completed
  4. Plan exercising should occur before business impact analysis results are available

Explanation

Impact analysis and risk assessment establish which processes matter and what threats they face, and those findings drive the choice of recovery strategies and the content of plans. Exercising then validates plans built on that foundation, so it logically follows rather than precedes analysis.

Question 28Business Continuity Program Initiation and Management

A continuity manager wants the program to survive changes in executive leadership. Which action best builds that durability during initiation?

  1. Deferring formal approval of the program until results are proven
  2. Relying on a single charismatic executive sponsor to champion the program
  3. Embedding continuity requirements into documented governance such as charters, policies, and committee terms of reference Correct answer.
  4. Keeping program documentation informal so it can adapt quickly

Explanation

Programs anchored in formal governance instruments continue when individual champions depart, because authority and accountability reside in approved documents and standing committees. Personal sponsorship is valuable but is not transferable, so it should reinforce rather than replace institutional arrangements.

Question 29Business Continuity Program Initiation and Management

A continuity program is being initiated in an organization that already runs a mature information security management system. How should the continuity manager handle the overlap between the two disciplines?

  1. Duplicate all security controls inside the continuity program to ensure independence
  2. Transfer all continuity responsibilities to the security team
  3. Ignore the security program because continuity and security have no shared concerns
  4. Define interfaces and shared responsibilities so each discipline relies on the other's outputs without duplicating work Correct answer.

Explanation

Continuity and information security share concerns such as availability and incident response, so the program should document where each discipline contributes and how outputs flow between them. Clear interfaces prevent duplicated controls and gaps at the boundary while preserving each program's distinct scope.

Question 30Business Continuity Program Initiation and Management

A continuity manager is defining the program's scope for the first planning cycle. Senior leadership wants everything covered immediately, but resources are limited. Which scoping approach is most defensible?

  1. Scope the first cycle to processes and locations whose disruption would most threaten the organization's critical objectives, and expand later Correct answer.
  2. Include all organizational units in the first cycle and write abbreviated plans for each
  3. Postpone scoping until a full inventory of every asset and application is complete
  4. Limit the first cycle to the facilities department because it controls physical assets

Explanation

Sound scoping prioritizes what most threatens the organization's critical objectives, which concentrates limited resources where disruption would matter most and creates a credible basis for later expansion. Comprehensive but shallow coverage across all units tends to produce plans that cannot actually be executed.

Question 31Risk Assessment and Business Impact Analysis

Which statement best defines a business impact analysis (BIA)?

  1. A process that documents the organizational chart and reporting lines
  2. A process that lists every asset and assigns it a replacement cost
  3. A process that audits technical controls against a security framework
  4. A process that identifies time-critical business functions and quantifies the effect of disruption on them Correct answer.

Explanation

A BIA focuses on business functions rather than assets or controls, determining which activities are time-critical and what operational and financial consequences follow from their disruption. It produces recovery priorities and impact tolerances that later drive strategy selection. Asset inventories and control audits are inputs or separate processes, not the BIA itself.

Question 32Risk Assessment and Business Impact Analysis

A function has a maximum tolerable downtime of four hours. What does this value represent?

  1. The longest outage the organization can absorb before the impact becomes unacceptable Correct answer.
  2. The interval between scheduled backup jobs
  3. The contractual notice period for terminating a supplier
  4. The time required to fully restore the function from backup media

Explanation

Maximum tolerable downtime expresses the threshold beyond which the consequences of an outage become unacceptable to the organization. It is an impact-driven limit derived from the BIA, not a technical restoration measurement. Recovery objectives are then set at or inside that limit.

Question 33Risk Assessment and Business Impact Analysis

Which pair correctly distinguishes a recovery time objective from a recovery point objective?

  1. RTO bounds acceptable data loss; RPO bounds the duration of recovery
  2. RTO is set by regulators; RPO is set by the BIA team alone
  3. RTO applies only to IT systems; RPO applies only to manual processes
  4. RTO bounds how long recovery may take; RPO bounds how much data loss is acceptable Correct answer.

Explanation

The recovery time objective is a target for restoring a function within a defined elapsed period, while the recovery point objective defines the acceptable data loss expressed as a point in time before the incident. Both are derived from impact analysis and drive different technical designs. Confusing them leads to mismatched backup and failover investment.

Question 34Risk Assessment and Business Impact Analysis

During a BIA workshop, a department head insists their function is the most critical. Which approach best resolves competing criticality claims?

  1. Rank functions using consistent, documented impact criteria applied across all departments Correct answer.
  2. Accept the department head's claim because they own the process
  3. Defer the ranking to the IT department because it hosts the systems
  4. Rank functions by the number of staff they employ

Explanation

Criticality ranking must rest on uniform, predefined impact criteria applied to every function so results are comparable and defensible. Stakeholder assertions are useful input but cannot substitute for consistent scoring. Ownership, headcount, and hosting location are not measures of business impact.

Question 35Risk Assessment and Business Impact Analysis

An organization uses a five-point impact scale for financial loss, regulatory breach, and reputational damage. Why is a common scale important?

  1. It allows impacts of different types to be compared and aggregated consistently Correct answer.
  2. It eliminates the requirement to define impact tolerances
  3. It removes the need for management approval of the BIA
  4. It guarantees that the financial estimates are accurate

Explanation

A shared rating scale lets analysts compare dissimilar impact categories, such as money, legal exposure, and reputation, on a common basis and combine them into an overall criticality rating. It improves consistency and transparency but does not validate the underlying estimates. Management approval and tolerance setting remain necessary.

Question 36Risk Assessment and Business Impact Analysis

Which metric best captures the financial consequence of a business function outage?

  1. Revenue loss and additional costs incurred per unit of downtime Correct answer.
  2. The purchase price of the primary server hosting the function
  3. The count of open change requests touching the function
  4. The number of employees trained on the recovery plan

Explanation

Financial impact from downtime is measured as lost revenue plus extra costs such as overtime, penalties, and expedited replacement, expressed per unit of time. This time-based figure can be compared directly against the maximum tolerable downtime. Hardware price, training counts, and change volume describe assets or activity, not downtime cost.

Question 37Risk Assessment and Business Impact Analysis

A retail bank finds that a payment function's impact rises steeply after two hours and becomes intolerable at six hours. How should this finding be used?

  1. Treat the function as non-critical because impact is tolerable for two hours
  2. Use the two-hour point as the recovery point objective for data loss
  3. Set the recovery time objective at twelve hours to allow comfortable margins
  4. Set the maximum tolerable downtime near six hours and design recovery well inside it Correct answer.

Explanation

The point at which impact becomes intolerable defines the maximum tolerable downtime, and recovery objectives should be set inside that boundary with margin for uncertainty. The early tolerable period does not make the function non-critical. Data loss tolerance is a separate objective from outage duration.

Question 38Risk Assessment and Business Impact Analysis

Which dependency mapping result most directly informs recovery sequencing?

  1. The list of vendors with active support contracts
  2. The version numbers of installed operating systems
  3. The order in which upstream services must be restored before a downstream function can operate Correct answer.
  4. The physical location of each server rack in the data center

Explanation

Dependency mapping reveals which upstream services, data, and suppliers a function needs, which determines the order in which components must be recovered. Restoring a downstream application before its identity or database service yields no usable service. Rack location, OS versions, and contract lists are inventory details that do not by themselves define sequencing.

Question 39Risk Assessment and Business Impact Analysis

A BIA team interviews process owners, reviews financial records, and runs a structured workshop. What is the main purpose of this triangulation?

  1. To replace the need for management sign-off on results
  2. To shorten the BIA by reducing the number of interviews needed
  3. To satisfy insurance requirements for documented losses
  4. To increase confidence in impact estimates by corroborating qualitative and quantitative sources Correct answer.

Explanation

Combining interviews, records, and workshops cross-checks subjective perceptions against objective data, raising confidence in the estimates. Each method has blind spots, and corroboration reduces the risk of bias or omission. Triangulation adds rigor rather than removing governance steps.

Question 40Risk Assessment and Business Impact Analysis

Which statement about the relationship between the BIA and the risk assessment is accurate?

  1. The BIA replaces the risk assessment for all operational risks
  2. The BIA establishes impact tolerances, while the risk assessment evaluates the likelihood and severity of threats that could breach them Correct answer.
  3. The risk assessment must be completed before any BIA interview occurs
  4. The two activities are independent and should never share data

Explanation

The BIA defines what matters and how much disruption is tolerable, while risk assessment examines which threat events could cause such disruption and how likely and severe they are. Together they inform strategy selection. Neither replaces the other, and they can proceed iteratively while sharing data.

Question 41Risk Assessment and Business Impact Analysis

A hospital must maintain patient care continuously. Which recovery strategy consideration follows most directly from this impact profile?

  1. Backups should be taken once per week to reduce storage cost
  2. Recovery can be deferred until after business hours in all cases
  3. Only administrative systems need redundancy
  4. Solutions must provide near-continuous availability rather than reliance on restoring from backup Correct answer.

Explanation

When impact becomes intolerable almost immediately, the strategy must sustain availability through redundancy and failover rather than depend on restore-from-backup, which takes time. Weekly backups and after-hours deferral assume a tolerable outage window that this function does not have. Clinical systems, not just administrative ones, carry the highest impact.

Question 42Risk Assessment and Business Impact Analysis

Which output of a BIA is most useful to the teams that select recovery strategies?

  1. The organization's marketing plan for the coming year
  2. Prioritized functions with their impact tolerances and dependencies Correct answer.
  3. A full penetration test report for internet-facing systems
  4. A list of employee performance ratings

Explanation

Strategy selection needs to know which functions matter most, how quickly they must recover, and what they depend on, so that investment is directed where it reduces the most consequential risk. Security test reports and business plans may inform risk but do not define recovery requirements. Performance ratings are unrelated.

Question 43Risk Assessment and Business Impact Analysis

A BIA estimates that an outage of a claims system costs 40,000 per hour and that the tolerable loss is 200,000. What maximum tolerable downtime does this imply, ignoring other impact types?

  1. 5 hours Correct answer.
  2. 2 hours
  3. 20 hours
  4. 8 hours

Explanation

Dividing the tolerable loss by the hourly cost gives 200,000 divided by 40,000, which equals five hours. This is the point at which financial impact alone reaches the tolerance limit. Other impact categories could shorten it, so the figure is a ceiling rather than a target.

Question 44Risk Assessment and Business Impact Analysis

Which technique is most appropriate for quantifying the operational impact of losing a manual, paper-based process?

  1. Calculating the depreciation of office furniture used by the team
  2. Counting the number of emails sent by the team each day
  3. Measuring the uptime of the server that hosts the process
  4. Estimating backlog growth, error rates, and service delays per unit of downtime Correct answer.

Explanation

For manual processes, impact shows up as accumulating backlog, increased error rates, and delayed service rather than system downtime. These measures can be translated into cost and service consequences. Server uptime, asset depreciation, and email volume do not capture the operational consequence of the process stopping.

Question 45Risk Assessment and Business Impact Analysis

An analyst assigns the highest impact rating to every function in scope. What is the most likely consequence?

  1. The BIA becomes more conservative and therefore more reliable
  2. Recovery objectives automatically tighten to zero downtime
  3. Prioritization becomes meaningless and recovery investment is spread too thinly Correct answer.
  4. Regulators will accept the BIA without further review

Explanation

Impact ratings exist to differentiate functions so that limited recovery resources go where they matter most. Rating everything as highest removes that differentiation and undermines prioritization. Inflated ratings also erode credibility with approvers and do not by themselves create tighter objectives.

Question 46Risk Assessment and Business Impact Analysis

Which factor most strongly justifies a shorter maximum tolerable downtime for a function?

  1. A large number of documented standard operating procedures
  2. Severe and rapidly escalating consequences such as safety risk or contractual penalties Correct answer.
  3. Use of a recently purchased application platform
  4. A team that is co-located with the data center

Explanation

Tolerable downtime is driven by the consequences of interruption, so severe and fast-escalating effects such as safety hazards, regulatory breaches, or penalty clauses justify shorter limits. Procedural documentation, platform age, and team location describe the environment but not the impact.

Question 47Risk Assessment and Business Impact Analysis

What is the primary role of senior management in the BIA process?

  1. Entering detailed downtime cost figures for each department
  2. Performing the technical dependency mapping for each application
  3. Writing the recovery procedures for each system
  4. Approving impact criteria and tolerances and resolving prioritization disputes Correct answer.

Explanation

Senior management sets the risk appetite that underpins impact criteria and tolerances and arbitrates when functions compete for priority. Detailed cost data, dependency mapping, and procedure writing are delegated to analysts and system owners. Executive involvement gives the results authority across the organization.

Question 48Risk Assessment and Business Impact Analysis

A function depends on a single supplier whose contract has no service-level commitments. How should this be reflected in the BIA?

  1. Record the dependency and flag the elevated risk to recovery objectives for treatment Correct answer.
  2. Omit the dependency because it is outside the organization's control
  3. Assume the supplier will recover within the organization's target
  4. Replace the dependency with the supplier's marketing assurances

Explanation

Dependencies on third parties belong in the BIA because supplier failure can prevent the organization from meeting its recovery objectives. Recording the dependency and flagging the risk allows it to be treated through contract changes or alternate sourcing. Omitting it or assuming favorable performance leaves the plan unsupported.

Question 49Risk Assessment and Business Impact Analysis

Which statement best describes the concept of impact over time in a BIA?

  1. Impact is measured solely by the number of affected users
  2. Impact typically grows as disruption persists, so analysis should consider multiple time horizons Correct answer.
  3. Impact is fixed at the moment of disruption and does not change
  4. Impact only matters after the recovery time objective has been exceeded

Explanation

Consequences usually accumulate, so a BIA evaluates impact at several elapsed times to find the point where it becomes intolerable. A single snapshot at the moment of disruption would miss that escalation. Impact begins immediately and is broader than user counts.

Question 50Risk Assessment and Business Impact Analysis

A BIA team cannot obtain precise downtime cost data for a legacy system. What is the most defensible approach?

  1. Assign the highest possible impact to avoid underestimation
  2. Use the cost of the original system purchase as the downtime cost
  3. Exclude the system from scope until precise data is available
  4. Use a documented range estimate with stated assumptions and mark it for later validation Correct answer.

Explanation

When precise figures are unavailable, a documented range with explicit assumptions preserves transparency and supports decisions while flagging uncertainty for later refinement. Inflating to the maximum distorts prioritization, and excluding the system leaves a real exposure unmanaged. Historical purchase cost does not represent downtime cost.