Which of the following approaches can be used by the Business Continuity (BC) professional as...

A gap analysis compares required recovery targets (such as RTOs derived from the BIA) against the organization’s actual demonstrated capability. The most defensible evidence for whether current recovery arrangements can meet RTO is what has been proven in practice—through prior exercises, technical tests, and real incident responses. The BCI’s validation guidance highlights the value of exercises and post-incident review to evaluate how well plans, capabilities, and competencies met continuity requirements, and to identify strengths and improvement areas.

This aligns with established BC good practice where exercise/test outputs are used to answer questions like whether a priority system “can be recovered and restored within the expected recovery time objective,” which is exactly the RTO gap being checked.

Horizon scanning and competitor analysis may help inform future improvements, but they do not directly demonstrate current performance against RTO. Health and safety risk assessments are important, yet they focus on workplace safety hazards rather than time-bound recovery performance of critical services.