A BIA report has been completed for a telecommunications company. The report includes RTOs and RPOs for critical functions. The risk committee is reviewing the report to decide on risk treatment. What should the report include to support this decision?

A list of all employees who participated in the BIA.

A recommendation for a specific vendor's recovery solution.

A detailed description of the BIA data collection methodology.

A comparison of the current recovery capabilities against the required RTOs and RPOs.

A utility company is conducting a BIA for its customer billing process. The process is supported by a legacy system that is difficult to restore. The BIA team is assessing the impact of a 24-hour disruption. Which factor should be considered to determine the RTO?

The cost of the legacy system's maintenance contract.

The time required to restore the legacy system.

The number of customers affected by the billing process.

The maximum period the business can operate without the billing process before impacts become unacceptable.

A financial services firm has completed a BIA and identified that its trade settlement function has an RTO of 1 hour. The risk assessment later identifies a high likelihood of a cyberattack that could disrupt this function. How should the BIA output be used in the risk assessment?

To set the RTO based on the likelihood of the cyberattack.

To justify accepting the risk because the BIA shows the function is critical.

To determine the risk level by combining the impact (from the BIA) with the likelihood of the threat.

To eliminate the need for a separate risk assessment for this function.

Who is the primary audience for the final BIA report?

Senior management and other key stakeholders

Which of the following is an example of a critical business function that would be prioritized in a BIA?

Internal newsletter publication

Order processing for a company's primary revenue stream

Certified in Risk and Information Systems Control

Domain 2Objective 6

Business Impact Analysis (BIA) CRISC Practice Questions (Page 7)

Part of the Domain 2: Risk Assessment domain, which accounts for 22% of the CRISC exam.

37questions here

8free pages

10concepts

22%of the exam

Questions 31–35

31application · medium
A BIA report has been completed for a telecommunications company. The report includes RTOs and RPOs for critical functions. The risk committee is reviewing the report to decide on risk treatment. What should the report include to support this decision?
Select an answer first
32application · medium
A utility company is conducting a BIA for its customer billing process. The process is supported by a legacy system that is difficult to restore. The BIA team is assessing the impact of a 24-hour disruption. Which factor should be considered to determine the RTO?
Select an answer first
33application · medium
A financial services firm has completed a BIA and identified that its trade settlement function has an RTO of 1 hour. The risk assessment later identifies a high likelihood of a cyberattack that could disrupt this function. How should the BIA output be used in the risk assessment?
Select an answer first
34foundation · easy
Who is the primary audience for the final BIA report?
Select an answer first
35foundation · easy
Which of the following is an example of a critical business function that would be prioritized in a BIA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.