CBCP-002 Certified Business Continuity Professional (CBCP) Questions and Answers

Risk control is the control mechanism that is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects should it occur. Risk control is the process of implementing measures or actions to modify or influence the risk level of an organization. Risk control can involve various strategies, such as avoidance, reduction, transfer, sharing, retention, or acceptance. Risk control can help to improve the organization’s resilience and performance. Verified References: https://www.investopedia.com/terms/r/risk-control.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

The primary reason for developing and implementing a business continuity plan is to ensure the continuation of a company’s critical functions and processes in the face of a disruption that may otherwise cause severe losses or damage to the company’s reputation, assets, customers,or stakeholders. A business continuity plan can help a company to resume operations as quickly as possible after a disruption, minimize the impact on its performance and profitability, protect its brand and image, and fulfill its legal and contractual obligations. Verified References: https://www.ready.gov/business-continuity-plan https://drii.org/resources/professionalpractices/EN

Threats can be considered any events or situations that can cause harm or disruption to an organization’s functions or processes. Threats can be natural, human-made, or technological in origin. Some examples of threats are water (such as floods, leaks, or spills), technology failure (such as system crashes, cyberattacks, or power outages), and fire (such as arson, accidents, or explosions). Verified References: https://www.iso.org/publication/PUB100442.html https://phoenixnap.com/blog/what-is-business-continuity-management

A consultant is a person who borrows your watch to tell you the time, charges you for doing so and then sells you back your watch. This is false because it is a cynical and unfair description of a consultant’s role and value. A consultant is a person who provides professional or expert advice in a specific field or domain. A consultant can help an organization to identify problems, analyze situations, develop solutions, implement changes, improve performance, or achieve goals. A consultant can also provide knowledge, skills, tools, or resources that the organization may not have or need temporarily. Verified References: https://www.investopedia.com/terms/c/consultant.asp https://phoenixnap.com/blog/what-is-business-continuity-management

In pre-crisis management, CM activities are focused on prevention and preparedness activities. This is true because pre-crisis management is the phase before a crisis occurs, where theorganization tries to anticipate and avoid potential crises or reduce their likelihood and impact. Pre-crisis management involves activities such as risk assessment, business impact analysis, business continuity planning, contingency planning, crisis communication planning, training and awareness, testing and exercising, monitoring and reviewing. Verified References: https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.html https://phoenixnap.com/blog/what-is-business-continuity-management

A disaster lasting longer than seventy-two (72) hours requires implementation of a business continuity and disaster recovery plan. A business continuity and disaster recovery plan is a comprehensive document that outlines how an organization will respond to and recover from a disaster that disrupts its normal operations. It covers both the IT aspects (disaster recovery) and the business aspects (business continuity) of restoring the critical functions and processes within an acceptable time frame. A disaster lasting longer than seventy-two (72) hours is likely to have significant impacts on the organization’s performance, reputation, assets, and stakeholders, and therefore requires a coordinated and structured approach to ensure its survival and resilience. Verified References: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

Operational risk is the type of risk that is related to human error or achievement. Operational risk is the uncertainty or variability of the execution or outcome of an organization’s functions or processes. Operational risk can result from factors such as inadequate policies, procedures, systems, controls, skills, training, supervision, or compliance. Operational risk can affect an organization’s operational efficiency, quality, safety, security, reputation, or profitability. Verified References: https://www.investopedia.com/terms/o/operational_risk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Financial risks are the risks that result from business decisions that are influenced by changes in markets, liquidity, and credit. Financial risks are the uncertainties or variabilities of the financial performance or position of an organization due to factors such as interest rates, exchange rates, inflation, credit ratings, debt levels, or cash flows. Financial risks can affect an organization’s profitability, solvency, liquidity, or valuation. Verified References: https://www.investopedia.com/terms/f/financialrisk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization’s facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References: https://www.fema.gov/pdf/emergency/nims/Damage_Assessment.pdf https://drii.org/resources/professionalpractices/EN