Business Continuity Planning for the CPA BAR Exam
Understand business continuity and disaster recovery for the CPA BAR section. Covers BIA, recovery strategies, RPO/RTO, backup types, and testing methodologies.
What Is Business Continuity Planning?
Business continuity planning (BCP) is the process of creating systems and procedures that enable an organization to continue operating during and after a disruptive event. Disaster recovery planning (DRP) is a subset of BCP that focuses specifically on restoring IT systems and data after a disaster. Together, BCP and DRP help organizations minimize the impact of disruptions on operations, finances, and reputation.
On the CPA BAR exam, business continuity planning is tested as part of the risk management and IT governance content area. You should understand the planning process, key concepts such as RPO and RTO, recovery strategies, and testing methodologies.
Business Impact Analysis (BIA)
The business impact analysis is the first step in developing a BCP. It identifies the organization's critical business functions, the resources required to support them, and the impact of their disruption. The BIA determines the maximum tolerable downtime for each function -the longest period the organization can survive without that function before suffering unacceptable consequences.
The BIA also identifies dependencies between business functions and IT systems, quantifies the financial and operational impact of disruptions (lost revenue, regulatory penalties, customer loss), and prioritizes recovery efforts based on criticality. Functions with the shortest maximum tolerable downtime receive the highest recovery priority.
Key Recovery Concepts
Recovery Point Objective (RPO)
The recovery point objective defines the maximum acceptable amount of data loss measured in time. An RPO of four hours means the organization can tolerate losing up to four hours of data. The RPO determines backup frequency: achieving a four-hour RPO requires backups at least every four hours. An RPO of zero (no data loss) requires synchronous data replication to a secondary site.
Recovery Time Objective (RTO)
The recovery time objective defines the maximum acceptable time to restore a system or process after a disruption. An RTO of two hours means the system must be back online within two hours of the disruption. Shorter RTOs require more expensive recovery solutions, such as hot sites with systems ready to take over immediately.
Recovery Strategies
Backup Site Options
A hot site is a fully equipped facility with hardware, software, and data that can take over operations almost immediately. It provides the shortest RTO but is the most expensive. A warm site has hardware and network connectivity but requires software installation and data restoration before use. It offers a moderate RTO at a lower cost. A cold site is a facility with basic infrastructure (power, cooling, connectivity) but no pre-installed hardware or software. It has the longest RTO and lowest cost.
Data Backup Types
Full backups copy all data and provide the fastest restoration but take the longest to perform and require the most storage. Incremental backups copy only data that has changed since the last backup of any type; restoration requires the last full backup plus all subsequent incremental backups. Differential backups copy all data changed since the last full backup; restoration requires only the last full backup plus the most recent differential backup.
Data Replication
Synchronous replication writes data to both the primary and secondary sites simultaneously, ensuring zero data loss (RPO = 0) but requiring high-bandwidth, low-latency connections. Asynchronous replication writes data to the secondary site with a slight delay, offering near-zero data loss with less stringent network requirements. Both approaches are more expensive than traditional backups but essential for critical systems with very low RPO requirements.
Plan Development and Documentation
A comprehensive BCP/DRP includes emergency response procedures (immediate steps to protect people and assets), crisis communication plans (how to notify employees, customers, regulators, and the public), recovery procedures (step-by-step instructions for restoring systems and operations), roles and responsibilities (who is responsible for each recovery action), and contact information (key personnel, vendors, and emergency services). The plan should be documented, distributed to relevant personnel, and stored in multiple locations, including offsite.
Testing the Plan
A BCP is only effective if it works when needed, and the only way to know is through regular testing. Testing methods range from least to most disruptive. A checklist review distributes the plan to team members for review and feedback. A tabletop exercise walks through a disaster scenario in a conference room setting, discussing how the team would respond at each step. A simulation test executes recovery procedures but without actually disrupting production systems. A parallel test activates the backup site and processes transactions in parallel with the primary site. A full interruption test shuts down the primary site and switches all operations to the backup site. Full interruption tests are the most realistic but also the most risky.
Exam Preparation Tips
- Know the purpose of the business impact analysis and what it identifies.
- Understand the difference between RPO and RTO and how they drive recovery strategy decisions.
- Be able to compare hot, warm, and cold sites in terms of cost and recovery time.
- Know the three backup types and the tradeoffs between them.
- Understand the five BCP testing methodologies and their relative advantages and risks.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.