Which process determines the impact of losing the support of any resource on operations and objectives?

• A. Control risk self-assessment
• B. Business impact analysis (BIA)
• C. Control self-assessment
• D. Detective control

Answer: (B)

The main idea here is understanding what happens to operations and objectives if any essential resource becomes unavailable. A business impact analysis is used for this: it identifies critical business functions, the resources they rely on (people, information, systems, facilities, suppliers), and the potential impacts of disruption. It helps determine how severe those impacts would be, how quickly operations must recover (RTO), and how much data loss is tolerable (RPO). With that insight, you can prioritize recovery efforts, allocate resources, and plan redundancies.

The other options focus on controls rather than measuring disruption impact. A control risk/self-assessment looks at how well controls mitigate risk within processes, not at the consequences of losing resources. A detective control is about detecting events after they occur, not assessing the effect of resource loss on operations. So the process that best determines the impact of losing support of any resource on operations and objectives is the business impact analysis.