CRISC - Governance (26% of the exam) - Section 1.6

Incorporate business process resilience and continuity considerations into organisational governance.

Describe how enterprise resilience and business process continuity requirements feed into governance decisions about acceptable disruption thresholds and resource allocation. Apply dependency analysis to identify single points of failure that governance bodies must address.

Business process resilienceEnterprise resilienceContinuityDependencies

Practice question for this objective

Free sampleGovernancehard

A risk practitioner is helping the board embed business process resilience into the enterprise governance framework. Which action would BEST ensure that resilience priorities reflect what the organisation values most?

AMandate that every business process has a documented recovery procedure stored in the central repository.
BRequire each department head to define recovery time objectives for the systems they personally own.
CIncrease the frequency of full disaster recovery testing across all production environments quarterly.
DAlign resilience objectives to the criticality ranking produced by a business impact analysis. Correct

Resilience priorities should be governed by business impact analysis so investment follows the value each process delivers. A business impact analysis quantifies the consequence and timing of disruption for each process, giving governance an objective basis to rank criticality and steer resilience investment toward the processes whose loss would hurt the enterprise most.

Why A is wrong: Documenting recovery procedures everywhere is useful operational hygiene, but treating all processes equally ignores their differing value and so misdirects resilience investment.

Why B is wrong: Departmental targets set in isolation produce inconsistent objectives that are not anchored to enterprise value, leaving cross-cutting dependencies unaddressed and priorities skewed.

Why C is wrong: More frequent testing improves assurance but says nothing about which processes matter, so it cannot by itself ensure priorities reflect enterprise value.

Why D is correct: A business impact analysis ranks processes by the harm caused if they fail, so aligning resilience objectives to it directs effort to what the organisation values most.

See more CRISC practice questions, answers explained.

Exam traps in Governance

Answers that look right on this material and are not. Each one is a distractor from a different question in the CRISC bank for this domain.

An annual budget allocation ring-fenced for purchasing additional backup infrastructure capacity.
Why it is wrong: Reserved funding supports resilience spending, but money alone does not confirm that capabilities still align with the organisation's evolving dependencies.
The average recovery time across the three internal components that the process depends upon.
Why it is wrong: Averaging recovery times is tempting because it looks balanced, but a sequential chain is gated by its slowest link, so the average understates the true achievable recovery time.
Each process was assessed on a different reporting template, so the ratings cannot be compared.
Why it is wrong: Inconsistent templates hamper comparison, but the core danger here is the hidden shared dependency, not the formatting of the three separate assessments.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.