The first step in conducting a BIA is to identify critical information assets. This involves determining which assets are essential to the organization's operations and would have the most significant impact if disrupted.
Understanding these assets sets the foundation for assessing potential impacts and developing appropriate recovery strategies.
Reference:ISACA CRISC Review Manual, 7th Edition, Chapter 2: IT Risk Assessment, Section: Business Impact Analysis.

The best way to assess the effectiveness of an access management process is to reconcile a list of accounts belonging to terminated employees. This will ensure that the access rights of the employees who have left the organization are revoked in a timely and accurate manner, and that there are no orphaned or unauthorized accounts that could pose a security risk. Comparing the actual process with the documented process, reviewing access logs for user activity, and reviewing for compliance with acceptable use policy are also useful methods, but they are not as direct and conclusive as reconciling a list of accounts belonging to terminated employees. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

Residual risk exceeds acceptable limits, because it indicates that the risk level is higher than the organization's risk appetite or tolerance, and that the risk responses and controls are insufficient or ineffective. Residual risk is the level of risk remaining in a process or procedure following the implementation of risk controls to limit or remove it. Escalation is a process that increases the awareness and involvement of higher-level stakeholders or authorities in a risk issue or situation. Escalation is appropriate when the risk issue or situation is outside the scope or authority of the current risk owner or manager, and requires the attention or action of the senior management or the board of directors. Residual risk exceeding acceptable limits is the best situation to justify escalation, as it implies that the current risk owner or manager cannot manage the risk within the predefined boundaries or expectations, and that the senior management or the board of directors need to intervene or approve the risk acceptance or transfer.
Residual risk being inadequately recorded, residual risk remaining after controls have been applied, and residual risk equaling current risk are all possible situations that may require escalation, but they are not the best situations, as they do not necessarily indicate that the risk level is higher than the acceptable limits, and that the senior management or the board of directors need to be involved.

The risk owner is the person who should be accountable for any related losses to the organization, because they are the person who has the authority and responsibility to manage the risk and its associated controls. The risk owner is also the person who accepts the risk and its residual level, and who monitors and reports on the risk status and performance. The IT risk manager, the server administrator, and the risk practitioner are all involved in the risk management process, but they are not the person who should be accountable for the risk and its outcomes, as they do not have the ultimate decision-making power and accountability for the risk.
References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.1.1, page 79