Resilience and Business Continuity

1. Why Resilience and Business Continuity Matter

Every organization will eventually face a disruption: a cyberattack, a pandemic, a supplier failure, a flood, a power outage, a key-person loss, or a regulatory shock. The question is not whether disruption will occur, but whether the organization can keep delivering its critical products and services when it does. This is why resilience and business continuity sit squarely within Risk Management Governance on the IIA CRMA syllabus. They are the practical expression of an organization's risk appetite for disruption and a direct test of whether the board and senior management are truly governing risk rather than simply documenting it.

For the CRMA candidate, this topic is important for three reasons:
- It connects enterprise risk management (ERM) to real operational outcomes. A risk register that lists 'loss of data center' as a high risk is meaningless unless a tested recovery capability exists.
- It is a classic area where governance failures show up: plans owned by IT alone, never tested, not aligned to board-approved tolerances, or disconnected from third-party dependencies.
- It is a prime area for internal audit assurance. The CRMA exam repeatedly tests whether you understand internal audit's role as an independent assurance provider (third line) versus the roles of management (first line) and risk/continuity functions (second line) under the IIA Three Lines Model.

2. What It Is: Key Concepts and Definitions

Organizational resilience is the ability of an organization to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruption in order to survive and prosper (consistent with ISO 22316). Resilience is broader than continuity: it includes culture, adaptive capacity, financial strength, leadership, and the ability to learn.

Business Continuity Management (BCM) is the holistic management process that identifies potential threats and their impacts on business operations, and provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of key stakeholders, reputation, brand and value-creating activities (ISO 22301 is the leading international standard).

Business Continuity Plan (BCP) is the documented set of procedures that guide the organization to respond, recover, resume, and restore to a predefined level of operation following a disruption. The BCP focuses on business processes and people.

Disaster Recovery Plan (DRP) is a subset of continuity planning focused on restoring IT systems, data, and technology infrastructure. On the exam, remember: DRP is a component of BCM, not a substitute for it.

Crisis Management is the strategic, leadership-level capability to make decisions and communicate during a severe event (media, regulators, employees, customers). It sits above incident response and continuity recovery.

Incident Management is the tactical, immediate response to an event (evacuation, containment, notification).

Business Impact Analysis (BIA) is the process of analyzing activities and the effect that a business disruption might have on them over time. The BIA identifies critical activities, dependencies, and recovery priorities. It produces the key metrics below.

Key metrics you must know:
- MTPD / MAO (Maximum Tolerable Period of Disruption / Maximum Acceptable Outage): the time after which an activity's unavailability would cause unacceptable harm. This is the ceiling set by the business.
- RTO (Recovery Time Objective): the target time within which an activity or system must be recovered. RTO must be shorter than MTPD.
- RPO (Recovery Point Objective): the maximum acceptable amount of data loss measured in time (e.g., 4 hours of transactions). RPO drives backup frequency and replication strategy.
- MBCO (Minimum Business Continuity Objective): the minimum level of service acceptable during disruption.

A classic exam distinction: RTO is about time to recover; RPO is about data loss tolerance. If a question describes backups taken nightly and asks about data loss, it is testing RPO. If it describes how long systems were down, it is testing RTO.

3. How It Works: The BCM Lifecycle

Resilience is delivered through a continuous management cycle (Plan-Do-Check-Act), typically expressed as follows:

Step 1: Governance, Policy and Scope. The board approves a BCM policy, defines scope, and sets tolerance for disruption aligned to the risk appetite statement. Senior management assigns accountable owners and resources. A steering committee or BCM coordinator drives the program. Governance failure here is the root cause of most downstream weaknesses.

Step 2: Business Impact Analysis. Business process owners (first line) identify critical products and services, map dependencies (people, premises, technology, information, suppliers), quantify financial, operational, regulatory and reputational impacts over time, and set MTPD, RTO and RPO. The BIA, not IT preference, should drive recovery priorities.

Step 3: Risk Assessment. Threats and vulnerabilities to critical activities are evaluated. Note the difference: the BIA asks what the impact of disruption is regardless of cause; the risk assessment asks what could cause the disruption and how likely it is. The exam often tests this distinction.

Step 4: Strategy Selection. Options are chosen to meet recovery objectives cost-effectively: redundant sites (hot, warm, cold), cloud failover, alternative suppliers, cross-training staff, remote working, manual workarounds, insurance, or accepting the risk. A hot site offers near-immediate recovery at high cost; a cold site is cheap but slow. The strategy must be consistent with RTO; a cold site cannot support a two-hour RTO.

Step 5: Plan Development. Documented, role-based plans covering activation criteria, command structure, communication trees, recovery procedures, resource requirements, and return-to-normal steps. Plans must be accessible when primary systems are down (offline or off-site copies).

Step 6: Training, Awareness and Exercising. Plans are only as good as their last test. Exercise types escalate in realism and cost:
- Checklist / desk review: validate plan content.
- Tabletop / walkthrough: discussion-based scenario with key staff.
- Simulation: role-play of an event with some real actions.
- Parallel test: recovery systems run alongside production.
- Full interruption: production is actually shut down (highest assurance, highest risk, rarely performed).
Results, lessons learned and corrective actions must be tracked to closure and reported to governance bodies.

Step 7: Maintenance and Continuous Improvement. Plans are updated after organizational change, acquisitions, system changes, staff turnover, exercise findings, and actual incidents. Metrics (percentage of critical processes with current BIA, test completion rates, RTO achieved vs target) are reported to the board or risk committee.

4. Roles and Responsibilities (Three Lines Model)

- Governing body (board): sets tone, approves policy and tolerance, oversees program effectiveness, receives reporting. Ultimately accountable.
- Senior management / first line: owns the risk and the plans; process owners perform BIAs, maintain plans and participate in tests.
- Second line (risk management, BCM function, compliance): designs the framework, provides methodology and tools, challenges first-line output, monitors and aggregates reporting.
- Third line (internal audit): provides independent and objective assurance on the design and operating effectiveness of the BCM program and governance. Internal audit may advise, but must not own, write, or approve the plans, as this would impair independence (IIA Standards on independence and objectivity).

5. Internal Audit's Assurance Focus

When auditing resilience and continuity, the internal auditor typically assesses:
- Whether board-approved policy, scope and tolerance exist and align to ERM and the risk appetite.
- Whether the BIA is complete, current, approved by business owners, and covers all critical processes and dependencies including third parties.
- Whether RTO/RPO are achievable with the strategies actually in place (compare BIA targets to test results).
- Whether plans are documented, accessible, and assigned to named, trained individuals with alternates.
- Whether testing is risk-based, regular, realistic, and whether issues from tests and real incidents are remediated.
- Whether supply chain and outsourced services (including cloud) have continuity provisions, right-to-audit clauses and tested interfaces.
- Whether crisis communication plans cover regulators, customers and media.
- Whether management reporting gives the board an accurate view of readiness.

Common weaknesses the exam expects you to recognize: plans developed solely by IT without business input; no BIA or an outdated one; untested plans; single points of failure (one data center, one key supplier, one knowledgeable employee); recovery strategies that cannot meet stated RTO; plans stored only on the systems that would be unavailable; no link between BCM and the ERM risk register; no board oversight.

6. Exam Tips: Answering Questions on Resilience and Business Continuity

Tip 1 - Think governance first. CRMA questions in this domain are rarely about technical IT recovery detail. When several answers seem plausible, the one that addresses board accountability, policy, risk appetite alignment, or defined ownership is usually correct. Example: if asked for the most significant weakness, 'no senior management sponsorship or approved policy' outranks 'backup tapes are stored on-site'.

Tip 2 - Know the sequence. Policy and scope, then BIA, then risk assessment, then strategy, then plan, then test, then maintain. Questions asking what should be done first or what a plan should be based on are testing this. Recovery priorities are based on the BIA, not on management intuition or system age.

Tip 3 - Master the metric definitions. RTO = time to recover. RPO = tolerable data loss. MTPD/MAO = the absolute limit set by the business; RTO must be less than MTPD. If a scenario says the business can tolerate 48 hours but the plan targets 24 hours, that is consistent; if the plan targets 72 hours, that is a control gap.

Tip 4 - Distinguish BIA from risk assessment. BIA = impact over time if a process stops (cause-agnostic). Risk assessment = likelihood and causes of threats. If the question mentions identifying critical processes and recovery priorities, the answer is BIA.

Tip 5 - Distinguish BCP, DRP and crisis management. DRP is technology recovery and is a subset of BCM. An organization with an excellent DRP but no business process plans is not resilient. Crisis management is leadership-level decision making and communication.

Tip 6 - Protect internal audit independence. Any answer where internal audit writes the BCP, selects the recovery site, approves the plan, or leads the crisis team is wrong as a primary role. Internal audit evaluates, tests the testing, and reports. It may participate in exercises as an observer or provide advisory input with safeguards.

Tip 7 - Testing is the proof. 'Plan exists but has never been tested' is almost always the most serious finding offered in a list of options, because an untested plan provides no assurance that recovery objectives can be met. Also recognize that a full interruption test is the most conclusive but carries the highest operational risk; tabletop exercises are the least disruptive.

Tip 8 - Watch for single points of failure and third parties. Modern exam scenarios include cloud providers, outsourced payroll, or sole-source suppliers. The best answer usually involves obtaining assurance over the third party's continuity capability (contractual requirements, SOC reports, joint testing), not simply assuming the vendor is responsible.

Tip 9 - People before processes. In any scenario involving an actual incident, life safety comes first, then stabilization, then recovery of critical processes according to BIA priorities, then return to normal. If an option prioritizes restoring servers over evacuating staff, eliminate it.

Tip 10 - Use the 'best' and 'most' logic. CRMA items ask for the best, most appropriate, or primary answer. Eliminate options that are technically true but narrow, that violate the Three Lines Model, or that skip a lifecycle step. Prefer answers that are risk-based, aligned to stakeholder expectations, and supported by evidence.

7. Worked Examples

Example 1. A company's BCP was written three years ago by the IT department, has not been tested, and recovery priorities were set by the CIO. Which is the most significant governance concern? Options: (a) plan is three years old, (b) plan was not tested, (c) recovery priorities were not based on a business impact analysis approved by process owners, (d) plan is stored electronically. Best answer: (c). While (b) is serious, the root governance failure is that priorities lack a business-driven BIA and ownership; testing an incorrectly prioritized plan would still leave the organization exposed. Note that in a different question where (c) is absent, (b) becomes the strongest answer.

Example 2. Nightly backups are taken at 23:00. A system failure occurs at 16:00. Which metric describes the potential 17 hours of lost transactions? Answer: RPO. The data loss window is a recovery point issue, not a recovery time issue.

Example 3. Management asks the CAE to lead the crisis management team during an incident. The most appropriate response is to decline the operational leadership role and offer advisory support or observer participation, because leading the response would impair the independence needed to later provide assurance on the organization's handling of the event.

Example 4. Which exercise provides the highest level of assurance that the recovery site can support operations? Full interruption test, with the caveat that it carries the greatest risk and is usually reserved for mature programs; a parallel test is the practical alternative.

8. Key Takeaways

- Resilience is the broad capability to anticipate, absorb, adapt and recover; business continuity management is the structured discipline that builds it.
- Governance is the foundation: board-approved policy, risk appetite alignment, defined ownership and regular reporting.
- The BIA drives everything downstream: critical processes, dependencies, MTPD, RTO and RPO.
- Strategies must be capable of meeting the stated objectives; plans must be documented, accessible, trained and tested; lessons must be acted upon.
- Internal audit provides independent assurance over the program and must never own the plans.
- In the exam, favor governance-focused, risk-based, lifecycle-correct, independence-preserving answers, and know your metric definitions cold.

Master these principles and you will be able to analyze any CRMA scenario on resilience and business continuity, identify the real control gap, and select the answer that reflects sound risk management governance.