Which of the following quantifies the effects of a potential disaster over a period of time?

A Risk Assessment identifies and prioritizes risks based on likelihood and magnitude, but does not specifically quantify the time-based financial and operational consequences of a disaster scenario on business functions.

A Business Impact Analysis systematically identifies critical business functions and quantifies the effect of their disruption over time using metrics such as Recovery Time Objective (RTO), Recovery Point Objective (RPO), and financial loss per unit of downtime. It directly measures how a potential disaster's consequences accumulate over a defined period, making it the correct answer for quantifying disaster effects over time.

Disaster Recovery Planning is the process of creating documented procedures to restore operations after a disruption - it consumes BIA outputs but does not itself quantify disaster effects over time.

Lessons Learned is a post-incident review conducted after a disruption to improve future responses, analyzing past events rather than prospectively quantifying the impact of potential future disasters.