A risk practitioner must rank several disruption scenarios for treatment funding but the organisation has not yet defined formal risk criteria. The practitioner argues that a business impact analysis should be completed first. What is the primary reason a business impact analysis should precede this prioritisation?
- AIt catalogues the technical controls already protecting each system so that overlapping safeguards can be removed before funding is allocated.
- BIt calculates the annualised loss expectancy for each scenario so that the residual risk figures can be compared directly against the inherent values.
- CIt quantifies the operational and financial consequences of disruption over time, supplying the impact criteria needed to rank scenarios objectively. Correct
- DIt confirms which scenarios the organisation has chosen to accept so that only the unaccepted exposures consume scarce treatment funding.
Why A is wrong: This is tempting because control inventories aid efficiency, but a business impact analysis assesses consequences of disruption, not the catalogue of existing technical safeguards.
Why B is wrong: This is plausible because both involve impact, but annualised loss expectancy is a quantitative analysis technique, whereas a BIA focuses on time-based disruption consequences.
Why C is correct: A business impact analysis measures how consequences grow over time, producing the impact criteria that let scenarios be evaluated and prioritised on a consistent basis.
Why D is wrong: This is attractive because acceptance affects funding, but recording acceptance decisions is a risk response activity, not the purpose of a business impact analysis.