Risk Assessment and Business Impact Analysis
Two different questions
The risk assessment asks what could happen and how bad it might be. The business impact analysis (BIA) asks what happens to the organization over time if a process stops. Candidates must keep these separate: risk assessment drives mitigation and threat prioritization; the BIA drives recovery objectives and strategy selection.
In risk assessment, know the components: asset/process identification, threat identification, vulnerability assessment, likelihood, impact, and risk determination, often expressed as a matrix or scored register. Understand inherent versus residual risk and that controls reduce likelihood, impact, or both. Qualitative, semi-quantitative, and quantitative approaches are all acceptable; the method must be consistent and documented.
In the BIA, know criticality tiers, maximum tolerable downtime (MTD), recovery time objective (RTO), recovery point objective (RPO), and minimum business continuity objective (MBCO). MTD is set by the business and represents the limit of tolerance; RTO is the target time to restore, and must be shorter than MTD. RPO concerns data loss tolerance. BIAs gather financial, operational, regulatory, reputational, and life-safety impacts across time horizons.
Traps
- Treating RTO as a technical decision. It is a business decision derived from impact over time.
- Setting RTO equal to MTD with no margin for recovery execution.
- Confusing RPO (data loss) with RTO (downtime).
- Skipping dependency mapping, so recovery of one process fails because an upstream supplier or system is unavailable.
Rule of thumb
RTO plus recovery execution time should stay inside MTD. If the gap is thin, escalate rather than silently accepting it.
Worked example
Order entry tolerates four hours of outage (MTD). Technical restoration takes three hours, leaving one hour of margin. The BIA records RTO of three hours and flags the dependency on the payment gateway, whose own RTO must be validated.