A risk practitioner is helping the board embed business process resilience into the enterprise governance framework. Which action would BEST ensure that resilience priorities reflect what the organisation values most?
- AMandate that every business process has a documented recovery procedure stored in the central repository.
- BRequire each department head to define recovery time objectives for the systems they personally own.
- CIncrease the frequency of full disaster recovery testing across all production environments quarterly.
- DAlign resilience objectives to the criticality ranking produced by a business impact analysis. Correct
Why A is wrong: Documenting recovery procedures everywhere is useful operational hygiene, but treating all processes equally ignores their differing value and so misdirects resilience investment.
Why B is wrong: Departmental targets set in isolation produce inconsistent objectives that are not anchored to enterprise value, leaving cross-cutting dependencies unaddressed and priorities skewed.
Why C is wrong: More frequent testing improves assurance but says nothing about which processes matter, so it cannot by itself ensure priorities reflect enterprise value.
Why D is correct: A business impact analysis ranks processes by the harm caused if they fail, so aligning resilience objectives to it directs effort to what the organisation values most.