Business Continuity Management Flashcards

Question 1

What does business continuity management aim to achieve for an organization?

Accepted Answer

Business continuity management is a structured discipline that prepares an organization to keep its critical activities running during disruption and to restore normal operations afterward. Its aim is to limit financial loss, protect people and reputation, and meet legal and contractual duties even when facilities, systems, staff, or suppliers are unavailable.

Question 2

What term describes any event that interrupts normal business operations, regardless of its size?

Accepted Answer

A business disruption is any event that interrupts normal operations for a period long enough to affect customers, revenue, or obligations. Disruptions range from a brief power interruption or a single failed application to a flood, cyberattack, or loss of a key supplier. Planning treats each one as a scenario to prepare for.

Question 3

What are the core objectives that every business continuity program should address?

Accepted Answer

Every program should protect life safety first, then protect critical activities, limit financial and reputational damage, and meet legal or contractual obligations. It should also restore operations in an orderly sequence. These objectives guide every later decision, from which activities receive resources first to which recovery targets are acceptable.

Question 4

What is the difference between business continuity and disaster recovery?

Accepted Answer

Business continuity covers the whole organization and focuses on keeping essential business functions operating, including people, processes, suppliers, and facilities. Disaster recovery is narrower, concentrating on restoring specific technology such as servers, data, and applications after an outage. Disaster recovery is usually one component within a broader continuity plan.

Question 5

Why do organizations define a governance structure for continuity management?

Accepted Answer

A governance structure assigns clear ownership, authority, and accountability so that continuity decisions are made quickly and consistently. It typically includes an executive sponsor, a program manager, and a cross-functional team with representatives from operations, IT, facilities, human resources, and communications. Without defined roles, plans stall during an actual incident.

Question 6

What does the term business continuity plan refer to?

Accepted Answer

A business continuity plan is a documented set of procedures that guides an organization through the response, recovery, and return to normal operations after a disruption. It names responsible people, lists contact details, describes activation criteria, and sets out steps for each critical activity. Plans must be reviewed and updated regularly.

Question 7

How do planners recognize a critical business function within an organization?

Accepted Answer

A critical business function is an activity whose interruption would cause unacceptable harm, such as lost revenue, regulatory breach, or safety risk. Planners recognize one by asking what would happen if the function stopped for a day or a week. Identifying these functions focuses limited recovery resources where they matter most.

Question 8

What is the main purpose of a continuity policy?

Accepted Answer

A continuity policy is a short, approved statement from senior leadership that commits the organization to maintaining essential operations. It sets scope, states the authority of the program, and establishes the expectation that resources will be provided for planning, testing, and maintenance. Policies give staff and auditors a clear reference point.

Question 9

What is a business impact analysis and what is its main output?

Accepted Answer

A business impact analysis is a structured process that identifies critical functions, estimates how their disruption would affect the organization over time, and sets recovery priorities. Its main output is a ranked list of activities with their impact profiles and recovery requirements, which feeds directly into strategy selection and plan development.

Question 10

What is maximum tolerable period of disruption, and why does it matter?

Accepted Answer

The maximum tolerable period of disruption is the longest time a business function can be unavailable before the organization suffers unacceptable consequences. It is often abbreviated MTPD. It matters because it sets the outer limit for recovery, so every recovery time objective must be shorter than this period.

Question 11

How is a recovery time objective defined, and how does it differ from recovery point objective?

Accepted Answer

A recovery time objective is the target maximum duration between a disruption and the restoration of a function to an agreed service level. A recovery point objective is the maximum acceptable amount of data loss, measured in time since the last usable backup. One concerns outage length; the other concerns data loss.

Question 12

Which information sources are typically used to gather data during a business impact analysis?

Accepted Answer

Analysts typically gather data through structured interviews with process owners, questionnaires, reviews of existing procedures, and examination of financial and operational records. Workshops with cross-functional teams help validate dependencies and resolve conflicting answers. Documented evidence should support each estimate so that the results can be defended during audits or executive review.

Question 13

Why are dependencies important to examine during a business impact analysis?

Accepted Answer

A function rarely operates alone, so its recovery depends on people, systems, suppliers, facilities, and other functions. An analysis that ignores these links may set an achievable target for one activity while the activities it depends on remain offline. Mapping dependencies reveals bottlenecks and shows which upstream resources must be restored first.

Question 14

What is the purpose of ranking business functions by priority?

Accepted Answer

Ranking business functions by priority allows the organization to allocate scarce resources to the activities that matter most during a disruption. Priorities are based on impact severity, the time each function can tolerate being unavailable, and interdependencies. A clear ranking also gives responders a predictable sequence for recovery.

Question 15

How does a business impact analysis differ from a risk assessment?

Accepted Answer

A business impact analysis begins with the effects of disruption on the organization and asks how bad an outage would be, regardless of its cause. A risk assessment begins with threats and vulnerabilities and estimates how likely particular events are. Impact analysis sets recovery priorities, while risk assessment guides prevention.

Question 16

What kinds of data should an impact analysis record for each critical function?

Accepted Answer

For each critical function, the analysis should record financial losses, regulatory and legal exposure, customer and reputational harm, safety effects, and the rising impact over time. It should note peak periods, such as month-end or seasonal demand, when disruption would hurt more. Recording impacts at several time intervals shows when harm becomes unacceptable.

Question 17

How can planners estimate the financial impact of an outage?

Accepted Answer

Planners can estimate financial impact by combining lost revenue per hour or day with added costs such as overtime, expedited shipping, penalties, and replacement equipment. They should also consider losses that build over time, including customer defection and delayed collections. Estimates should be labeled as approximations, with the assumptions stated clearly.

Question 18

What is a single point of failure, and why does impact analysis look for it?

Accepted Answer

A single point of failure is one component, person, supplier, or location whose loss would stop a critical function with no alternative available. Impact analysis looks for these because they reveal where a relatively small event could cause a disproportionate outage. Identifying them early helps the organization prioritize redundancy or alternate arrangements.

Question 19

What is the difference between a threat, a vulnerability, and a risk?

Accepted Answer

A threat is any potential cause of harm, such as a flood, malware, or a supplier bankruptcy. A vulnerability is a weakness that a threat could exploit, such as an unpatched server or a site located in a flood zone. Risk is the likelihood that a threat exploits a vulnerability, together with its impact.

Question 20

What are common categories of threats that business continuity plans consider?

Accepted Answer

Common threat categories include natural hazards such as storms, earthquakes, and floods, technological failures such as power outages and software defects, human threats such as errors, sabotage, and staff unavailability, and third-party threats such as supplier collapse. Planners group threats this way to avoid listing every possible event.

Question 21

How is the likelihood of a threat usually estimated in a risk assessment?

Accepted Answer

Likelihood is usually estimated using historical records, industry experience, expert judgment, and available data about the frequency of similar events. Many organizations express it on a qualitative scale, such as rare, unlikely, possible, likely, or almost certain. Estimates should be reviewed periodically because conditions, technologies, and threats change.

Question 22

What does a risk register do in continuity management?

Accepted Answer

A risk register is a record that lists identified threats, their vulnerabilities, estimated likelihood and impact, existing controls, and an owner responsible for each risk. It gives leaders a single view of exposure and tracks whether agreed treatments are being carried out. Entries should be reviewed on a schedule and after significant incidents.

Question 23

How should a planner decide whether a risk needs treatment?

Accepted Answer

A planner compares each risk rating against the organization's risk appetite, which is the amount of risk leaders are willing to accept. Risks above that threshold need treatment, such as reducing likelihood, lessening impact, transferring exposure through insurance or contracts, or accepting the risk with documented approval. Risks below the threshold may be monitored.

Question 24

Why is it important to consider the cascading effects of a single event?

Accepted Answer

A single event can trigger several failures at once, including power loss, network outages, staff unable to reach work, and delayed deliveries. Assessments that examine only the initial event tend to underestimate recovery needs. Mapping how effects spread across systems, locations, and suppliers reveals where additional safeguards or alternate arrangements would help most.

Question 25

What role do external sources such as government advisories and industry alerts play in threat identification?

Accepted Answer

External sources provide early warning about threats that an organization may not see from its own records. Examples include public weather alerts, emergency management notices, cybersecurity advisories, and information shared by industry groups and suppliers. Planners should record which sources they monitor and assign someone to review them regularly.

Question 26

How do planners use historical incident records during risk assessment?

Accepted Answer

Historical incident records show which disruptions have actually occurred, how often they happened, how long recovery took, and what the consequences were. Planners use these facts to ground estimates in evidence rather than assumptions. Records from near misses are also valuable because they reveal weaknesses before a serious event occurs.

Question 27

What is the difference between inherent risk and residual risk?

Accepted Answer

Inherent risk is the level of risk before any controls or treatments are applied. Residual risk is the level that remains after controls have been put in place. Comparing the two shows how much a control reduces exposure and whether the remaining risk is acceptable to leadership.

Question 28

Why should risk assessment results be reviewed after a real incident?

Accepted Answer

A real incident provides evidence about whether the assumed likelihood, impact, and controls were accurate. Reviewing the event may reveal threats that were missed, dependencies that were underestimated, or controls that failed in practice. Updating the assessment after such reviews keeps planning grounded in what actually happened rather than in outdated expectations.

Question 29

What are the main categories of continuity strategy for a critical activity?

Accepted Answer

Continuity strategies generally fall into four common options: reducing the likelihood or impact of disruption through prevention, avoiding dependence through alternative processes, transferring some risk through insurance or contracts, and accepting residual risk when other options are not justified. Most organizations combine several approaches for each critical activity.

Question 30

What is a workaround strategy and when is it useful?

Accepted Answer

A workaround strategy keeps a critical activity running through manual processes, temporary procedures, or simplified methods while the normal system or resource is unavailable. It is useful when outages are short, when the manual method can handle reduced volume, and when staff have been trained. Workarounds are usually temporary and need clear end points.

Question 31

What is an alternate site, and what are its common types?

Accepted Answer

An alternate site is a location where critical operations can be relocated if the primary site becomes unusable. Common types include hot sites, which are fully equipped, warm sites, which need some setup, and cold sites, which provide only space and utilities. Each type trades cost against speed of recovery.

Question 32

How do recovery strategies for people differ from strategies for technology?

Accepted Answer

Technology recovery usually relies on replication, backups, and failover to standby systems, which can often be automated and tested. People recovery relies on cross-training, succession planning, remote working arrangements, and flexible staffing agreements, because staff availability is harder to predict. Human strategies also must address welfare, communication, and fatigue during extended incidents.

Question 33

What are the main elements of a continuity plan for a single critical activity?

Accepted Answer

A plan for a critical activity should state its scope and objectives, list the required resources and their locations, identify the roles and contact details of responsible staff, and describe the step by step actions for activation, recovery, and return to normal operations. It should also name the recovery targets.

Question 34

When should a continuity plan be activated, and who has the authority to decide?

Accepted Answer

A continuity plan should be activated when a disruption exceeds defined thresholds, such as a predicted outage length, a loss of a critical system, or a safety event. A named decision maker, often a senior manager on call, has the authority to activate the plan and must be reachable at all times.

Question 35

How do communication plans support continuity during an incident?

Accepted Answer

Communication plans define who must be informed, what they need to know, which channels will be used, and who approves each message. They cover staff, executives, customers, suppliers, regulators, and the public as appropriate. Clear and timely updates reduce rumor, protect reputation, and help people act on accurate information rather than guessing.

Question 36

Why do continuity strategies need to be cost justified?

Accepted Answer

Resources for continuity are limited, so every strategy must be weighed against the loss it prevents. Leaders often compare the annual cost of a strategy with the expected loss from the disruption it addresses. A strategy costing more than the harm it prevents is hard to justify, unless legal duties require it.

Question 37

What is the difference between a crisis management plan and a business continuity plan?

Accepted Answer

A crisis management plan focuses on the immediate response to a serious incident affecting life safety, reputation, or the organization's standing. A business continuity plan focuses on keeping critical activities running and restoring them after disruption. The two plans are usually coordinated so that the crisis team and recovery teams work from consistent information.

Question 38

What is the purpose of a recovery team structure?

Accepted Answer

A recovery team structure defines the teams that will carry out recovery tasks, the leaders of each team, and how they coordinate with one another and with the command function. Clear reporting lines prevent duplicated effort and missed tasks during the stress of an incident.

Question 39

Why is regular testing necessary for continuity plans that have already been approved?

Accepted Answer

Approved plans often contain assumptions that do not hold up under pressure, such as outdated contact lists, untested backups, or missing equipment. Regular testing reveals these gaps while there is time to fix them, and it builds familiarity so that staff can act without reading every step. Testing is the only reliable evidence that a plan works as written.

Question 40

What are the common types of continuity exercises?

Accepted Answer

Common exercise types include plan reviews or walkthroughs, where participants read through procedures together, tabletop exercises, where teams talk through a scenario and their decisions, functional drills that test one capability such as an alternate communication channel, and full-scale simulations that involve real resources and movement. Each type adds realism and cost.

Question 41

What should a post-exercise report include to drive improvement?

Accepted Answer

A post-exercise report should describe the objectives, scenario, participants, and what happened, then record each finding with its evidence, a root cause, and a recommended corrective action. It should assign an owner and a due date to every action and track progress until closure.

Question 42

How does a continuity program maintain plans as the organization changes?

Accepted Answer

A maintenance program sets a review schedule and triggers updates after changes such as new systems, office moves, reorganizations, supplier changes, or staff turnover in key roles. Owners confirm contact details, dependencies, and recovery targets on a regular cycle. Change management processes should include a step that asks whether continuity plans are affected.

Question 43

What is the role of executive governance in business continuity?

Accepted Answer

Executive governance provides sponsorship, funding, and oversight so that continuity receives the authority and resources it needs. Senior leaders approve policy, accept residual risk at the appropriate level, review performance measures, and resolve conflicts between departments. Without visible executive support, plans tend to become outdated documents rather than working capabilities.

Question 44

Which performance measures show whether a continuity program is improving?

Accepted Answer

Useful measures include the percentage of critical functions with current plans, the proportion of planned exercises completed on schedule, the number of exercise findings closed on time, and the results achieved against recovery time and recovery point objectives in tests or real events. Trends matter more than a single snapshot.

Question 45

Why do auditors and regulators often ask for evidence of continuity testing?

Accepted Answer

Auditors and regulators want evidence that an organization does more than write plans, since untested plans provide little assurance. Records such as exercise schedules, scenarios, attendance, findings, and corrective actions demonstrate that the program is active and improving. Good evidence also shows that leaders reviewed results and made decisions based on them.

Question 46

How should lessons learned from a real disruption be used?

Accepted Answer

Lessons learned should be captured soon after recovery, while details are fresh, through structured reviews that include the people who responded. Each lesson should lead to a specific change in plans, training, contracts, or infrastructure, with an owner and deadline. The review should be shared so that other teams can learn from the experience.

Question 47

What makes a continuity program sustainable over the long term?

Accepted Answer

Sustainability depends on embedding continuity into everyday management rather than treating it as a periodic project. This includes assigning ongoing budget, integrating continuity checks into procurement, projects, and change control, training new staff, and reporting progress to leadership regularly. Programs that depend on a single champion tend to fade when that person leaves.

Question 48

What is a continuity program's review cycle, and what triggers an unscheduled review?

Accepted Answer

The review cycle is the scheduled interval at which the whole program, including analysis, strategies, plans, and exercise results, is reassessed and approved. An unscheduled review is triggered by events such as a real activation, a major system or organizational change, a serious audit finding, or a significant change in the threat environment.

Business Continuity Management Flashcards

1Foundations of continuity management

2Business impact analysis essentials

3Risk assessment and threat identification

4Continuity strategies and plan design

5Testing, maintenance and governance

Learning Resources