Which of the following will determine the way that an organization uses Business Impact Analysis...

In CBCI 7.0 / GPG 7.0, BIA is a core Analysis technique, but it is not “one size fits all.” The depth, method, and tooling used for BIA are determined primarily by the organization’s size, complexity, and type, because these factors dictate how products/services are delivered, how many activities and dependencies exist, how centralized or distributed operations are, and how much formalization is needed to produce consistent outputs. The BCI GPG Lite explicitly notes that implementation should suit “organizational size and complexity,” which directly applies to how BIA is performed (e.g., workshops vs. questionnaires, single-layer vs. multi-layer BIA, degree of consolidation, number of stakeholder groups involved). (thebci.org)

Stakeholder consultation (A) provides valuable input but doesn’t “determine the way” BIA is used as strongly as organizational characteristics do. Exercise outcomes (C) inform validation and improvements, not the fundamental BIA approach. Risk management feedback (D) can help align approaches, but BIA design is primarily shaped by organizational structure and complexity. Therefore, B is correct.