Analysis
Two connected analyses
Analysis combines business impact analysis (BIA) and risk assessment. The BIA identifies critical activities, dependencies, impacts over time, maximum tolerable period of disruption (MTPD), recovery time objective (RTO), recovery point objective (RPO), minimum business continuity objective (MBCO) and resource requirements. Impacts should be assessed across financial, operational, regulatory, reputational and safety categories. Risk assessment examines threats, vulnerabilities, likelihood, impact, existing controls, risk appetite and treatment. The BIA sets recovery requirements; the risk assessment informs what could cause disruption and how it should be treated. Do not substitute one for the other.
Traps
Questions frequently test RTO versus MTPD versus RPO. MTPD is the maximum outage before impact becomes unacceptable; RTO is the target time to restore the activity and must sit inside the MTPD. RPO is the tolerable data loss, usually expressed in time. MBCO is the minimum acceptable output during disruption, not normal service. Another trap is ignoring dependencies and cumulative impact over time.
Worked example
Order fulfilment can tolerate financial and regulatory impact for up to 48 hours: MTPD = 48 hours. The business sets RTO = 24 hours and RPO = 1 hour for order data. MBCO = 50% of orders through a manual workaround. Strategy design must meet these figures.
Rule of thumb: set RTO comfortably inside MTPD, then design to the RTO and RPO.