nerdexam
Isaca

CISM · Question #147

At which stage of business continuity planning is risk identification performed?

The correct answer is A. Impact analysis. Risk identification, including the assessment of potential threats and vulnerabilities, is a critical component performed during the business impact analysis (BIA) phase of business continuity planning. The BIA determines the potential effects of disruptions and identifies…

Submitted by kwame.gh· Apr 18, 2026Information Security Risk Management

Question

At which stage of business continuity planning is risk identification performed?

Options

  • AImpact analysis
  • BStakeholder meeting
  • CDevelopment
  • DProject planning

How the community answered

(47 responses)
  • A
    87% (41)
  • B
    4% (2)
  • C
    2% (1)
  • D
    6% (3)

Why each option

Risk identification, including the assessment of potential threats and vulnerabilities, is a critical component performed during the business impact analysis (BIA) phase of business continuity planning. The BIA determines the potential effects of disruptions and identifies necessary recovery priorities.

AImpact analysisCorrect

Risk identification is a core part of the business impact analysis (BIA) stage, where organizations assess potential threats, vulnerabilities, and the likely impact of various disruptions on business operations. The BIA quantifies the financial and operational impact of interruptions and helps prioritize recovery efforts by understanding the risks involved.

BStakeholder meeting

Stakeholder meetings are collaborative discussions but not a formal stage for performing risk identification within the structured BCP process.

CDevelopment

The development stage focuses on creating the BCP strategies and plans, occurring after risk identification and impact analysis.

DProject planning

Project planning initiates the BCP process, but the detailed risk identification specific to business continuity is conducted in the impact analysis stage.

Concept tested: Business continuity planning stages - Risk Identification

Source: https://learn.microsoft.com/en-us/microsoft-365/compliance/business-continuity-management?view=o365-worldwide

Topics

#Business Continuity Planning#Business Impact Analysis#Risk Identification#Risk Assessment

Community Discussion

No community discussion yet for this question.

Full CISM Practice