ISO-22301-Lead-Auditor PECB Certified ISO 22301 Lead Auditor Exam Questions and Answers

The Do step in the PDCA cycle is the stage where the plan is implemented and executed. It involves carrying out the activities and processes that are defined in the BCMS. It is also the step where communication with key stakeholders is maintained. Communication is a vital element of the BCMS, as it ensures that all relevant parties are informed and involved in the business continuity process. ISO 22301 requires organizations to establish communication procedures that enable timely and effective communication during a disruption. These procedures should include clear communication channels, escalation processes, and guidelines for communication with stakeholders such as customers, suppliers, and regulatory bodies1. Communication and training are also important aspects of the Do step, as they ensure that all stakeholders are involved and aware of the PDCA cycle and their role in it. Provide training and support to help employees understand the process and how they can contribute to it2. The Do step also involves testing and exercising the BCMS to verify its effectiveness and identify areas for improvement. Testing and exercising are essential for validating the assumptions, plans, and procedures of the BCMS and ensuring that they are fit for purpose. They also help to raise awareness and confidence among the staff and stakeholders and demonstrate the organization’s commitment to business continuity3. References: : ISO 22301 Clause 7.4 Communication : The Plan-Do-Check-Act (PDCA) Cycle: A Guide to Continuous Improvement : ISO 22301 Business Continuity Management Made Easy

According to ISO 22301:2019, clause 10, improvement consists of two elements: nonconformity and corrective action, and continual improvement. Nonconformity and corrective action is the process of identifying and addressing any deviations from the requirements of the standard or the organization’s own policies and procedures. It involves taking actions to eliminate the causes of nonconformities, prevent their recurrence, and reduce their impact. Continual improvement is the process of enhancing the suitability, adequacy, and effectiveness of the BCMS and its performance. It involves identifying and implementing opportunities for improvement based on the results of monitoring, measurement, analysis, evaluation, internal audit, and management review. References: : ISO 22301 Auditing eBook, page 11 : ISO 22301:2019, clause 10 : ISO 22301: Clause 10 - Improvement – ISO Templates and Documents Download : ISO 22301 continuous improvement – How to achieve it - Advisera

The outgoing commitment from executive management helps to embed a positive business continuity culture within the organization by demonstrating leadership and support for the business continuity management system (BCMS) and its objectives. Executive management is responsible for establishing the BCMS policy, ensuring the alignment of the BCMS with the organization’s strategic direction, providing the necessary resources for the BCMS, communicating the importance of the BCMS, and promoting continual improvement of the BCMS. Executive management also sets an example for the rest of the organization by being actively involved in the BCMS activities and ensuring accountability and responsibility for the BCMS performance. References: ISO 22301 Auditing eBook, page 27; ISO 22301:2019 standard, clause 5.1

Process management is the framework that is a continuous and progressive cycle that requires managerial, operational, administrative and technical support. Process management refers to the design, implementation, monitoring, evaluation, and improvement of the processes that deliver value to the organization and its stakeholders. Process management involves the following steps:

• Define the process: Identify the purpose, scope, objectives, inputs, outputs, activities, roles, and responsibilities of the process.
• Document the process: Create a visual representation of the process flow, such as a flowchart, diagram, or map, that shows the sequence of tasks, decisions, and interactions within the process.
• Implement the process: Execute the process according to the defined and documented specifications, using the appropriate resources, tools, and methods.
• Monitor the process: Measure and analyze the performance of the process, using key performance indicators (KPIs), metrics, and feedback mechanisms, to ensure that the process meets the expected outcomes and quality standards.
• Evaluate the process: Review and assess the effectiveness and efficiency of the process, using audit, review, and evaluation techniques, to identify the strengths, weaknesses, opportunities, and threats of the process.
• Improve the process: Implement corrective and preventive actions, based on the results of the evaluation, to enhance the process and eliminate or reduce the causes of nonconformities, errors, or inefficiencies.

Process management is a continuous and progressive cycle that requires managerial, operational, administrative and technical support, as the process is constantly subject to change and improvement, based on the changing needs and expectations of the organization and its stakeholders. Process management also supports the implementation and maintenance of a business continuity management system (BCMS), as it helps the organization to identify, protect, and optimize its critical business processes and resources, and to ensure their continuity and resilience in the event of a disruption. References:

• ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4: Planning, Page 18
• ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.6: Performance Evaluation, Page 21
• ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.7: Improvement, Page 23
• ISO 22301 Auditing eBook, Chapter 4: Business Continuity Management System Audit, Section 4.1: Audit Principles, Page 26
• ISO 22301 Auditing eBook, Chapter 4: Business Continuity Management System Audit, Section 4.3: Audit Process, Page 28

Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service. This strategy involves the following steps:

• Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk assessment, identify the possible recovery options for each critical product and service. Recovery options are the alternative ways of resuming the delivery of the product or service within the recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options are: relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup, outsourcing to a third-party provider, etc.
• Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc. Compare the advantages and disadvantages of each option and rank them according to their suitability for meeting the recovery needs.
• Select the recovery options: Choose the best recovery option for each critical product and service, based on the evaluation results and the available resources. Ensure that the selected option aligns with the organization’s business continuity objectives, policies, and strategies. Document the rationale and justification for the selection and communicate it to the relevant stakeholders.

Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service, as it enables the organization to identify, evaluate, and select the most appropriate recovery option for each critical product and service, based on the BIA and the risk assessment results. This strategy helps the organization to ensure the continuity and resilience of its critical products and services in the event of a disruption, and to optimize the use of its resources and capabilities. References:

• ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4.2: Business Continuity Strategy, Page 19
• ISO 22301 Auditing eBook, Chapter 5: Business Continuity Management System Audit Activities, Section 5.3.2: Audit of Business Continuity Strategy, Page 37
• ISO 22301:2019, Clause 8.3: Business Continuity Strategies and Solutions, Page 18

Business continuity programs should be a part of the governance process of the organization, which is the system by which the organization is directed and controlled. The governance process involves setting the strategic direction, establishing the policies and objectives, allocating the resources, monitoring the performance, and ensuring the accountability and transparency of the organization. Business continuity programs support the governance process by ensuring the continuity of the organization’s critical functions and processes in the event of a disruptive incident, and by enhancing the organization’s resilience and reputation. References: ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems (BCMS), Section 1.1: Governance, page 8.

According to ISO 22301:2019, Clause 6.1.2, the organization must establish, implement, and maintain a documented process to manage risks related to the continuity of its critical functions and the achievement of its business continuity objectives. The risk management process should include the identification, analysis, and evaluation of the risks that may cause disruption to the organization’s operations, products, and services. The level of risk for an organization should be determined by combining the consequence and likelihood of the events that may lead to disruption, as well as the organization’s risk criteria, risk appetite, and risk tolerance. The consequence of an event is the impact or effect that it may have on the organization’s objectives, reputation, stakeholders, and resources. The likelihood of an event is the probability or frequency that it may occur, based on historical data, statistical analysis, expert judgment, or other methods. The organization should use appropriate tools and techniques to assess the level of risk, such as risk matrices, risk registers, risk maps, or risk software. The organization should also document the results of the risk assessment and communicate them to relevant interested parties. The purpose of risk management for business continuity is to find out what problems an organization may face, and to take appropriate actions to prevent, mitigate, or transfer the risks, or to accept them if they are within the organization’s riskcriteria. References: ISO 22301:2019, Clause 6.1.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

Business continuity objectives are the objectives that take the form of targets to enhance organizational resilience, as defined by ISO 22301. Business continuity objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Business continuity objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Business continuity objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Business continuity objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2

 According to ISO 22301, a business continuity management system (BCMS) is a part of the organization’s overall management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity. A management system is a set of interrelated or interacting elements of an organization that establishes policies and objectives and enables the achievement of those objectives. A management system can address one or more disciplines, such as quality, environment, information security, or business continuity. Therefore, a BCMS is not limited to the IT management system, nor is it always managed by an external service provider. A BCMS is integrated with the organization’s strategic direction, culture, values, and processes, and it involves the participation and commitment of all levels and functions of the organization. References: ISO 22301 Auditing eBook, page 9 1; ISO 22301:2019, clause 3.4 2

The Statement of Applicability (SOA) is a document that identifies the applicable requirements of ISO 22301 and explains how they are addressed by the organization’s Business Continuity Management System (BCMS). The SOA is prepared during the planning phase of the PDCA cycle, as part of the process of establishing the BCMS scope, objectives, and policy. The SOA is based on the results of the business impact analysis, risk assessment, and risk treatment, and it provides a rationale for the inclusion or exclusion of each requirement. The SOA also helps to demonstrate the conformity of the BCMS with the standard and to communicate the BCMS scope and objectives to interested parties. References: ISO 22301:2019, Clause 6.1.3; ISO 22301 Auditing eBook, Chapter 4.2.2.

Suppliers are the role associated with specialist services offered by third parties, such as consultants, trainers, auditors, or certification bodies. Suppliers can provide external support and expertise to the organization in developing, implementing, maintaining, and improving its BCMS. Suppliers can also help the organization to demonstrate its conformance and competence to interested parties, such as customers, regulators, or investors. Suppliers are one of the key stakeholders of the BCMS, as they can influence or be influenced by the organization’s business continuity performance and objectives. References: ISO 22301 Auditing eBook, page 12 1; ISO 22301:2019, clause 4.2 2

 The Do step in the PDCA cycle implements the previous selected controls to meet the control objectives. According to the ISO 22301 Auditing eBook, the Do step involves implementing and operating the business continuity policy, controls, processes, and procedures that have been planned in the previous step. The Do step also includes establishing the necessary resources, competencies, awareness, communication, and documentation to support the effective operation of the business continuity management system (BCMS). The Do step aims to ensure that the organization is prepared to respond to and recover from disruptive incidents in a timely and effective manner. References: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.

A quality audit verifies that the BCM programme activities are adequately managed through conformance to the BCMS requirements, policies, and procedures. It also evaluates the effectiveness and efficiency of the BCMS processes and the continual improvement of the BCMS performance. A quality audit can be internal or external, depending on the source of the audit. References: ISO 22301 Auditing eBook, page 19 1; ISO 22301:2019, clause 9.2 2

 Document control is a process that ensures that documented information related to the BCMS is current, accurate, and available to relevant parties. It also ensures that the confidentiality of business continuity materials is safeguarded from unauthorized access, disclosure, or misuse. Document control covers the creation, approval, distribution, use, storage, preservation, retrieval, control of changes, retention, and disposition of documented information. Document control is required by clause 7.5.3 of ISO 22301:2019. References: ISO 22301:2019, clause 7.5.3; ISO 22301 Auditing eBook, page 56.

Reviewing is the stage that helps management to define where focus and resources should be invested. According to ISO 22301, reviewing is the process of evaluating the performance and effectiveness of the business continuity management system (BCMS) and identifying opportunities for improvement. Reviewing can be done through internal audits, management reviews, performance evaluations, and corrective actions. Reviewing can help management to ensure that the BCMS is aligned with the organization’s strategic objectives, meets the needs and expectations of interested parties, complies with the applicable requirements, andcontinually improves its resilience and capability to respond to disruptive incidents. References: ISO 22301 Auditing eBook, page 171; ISO 22301:2019, clause 92

According to the ISO 22301 Auditing eBook, there are five types of strategies involved in the process-centric approach to business continuity management. They are:

• Business continuity strategy: This is the overall approach that provides a framework for ensuring the continuity of an organization’s critical functions in the event of a disruption. It defines the objectives, scope, principles, and policies of the business continuity management system (BCMS).
• Recovery strategy: This is the specific approach that defines how an organization will restore its critical functions within a predefined time frame after a disruption. It identifies the resources, actions, and procedures required to recover the critical functions and resume normal operations.
• Continuity strategy: This is the specific approach that defines how an organization will maintain its critical functions during a disruption. It identifies the alternative arrangements, methods, and modes of operation that will enable the organization to continue delivering its products or services at an acceptable level of performance.
• Mitigation strategy: This is the specific approach that defines how an organization will reduce the likelihood and/or impact of a disruption. It identifies the preventive and protective measures that will minimize the exposure and vulnerability of the organization to potential threats and risks.
• Response strategy: This is the specific approach that defines how an organization will react to a disruption. It identifies the roles, responsibilities, and authorities of the incident management team, the communication channels and protocols, and the escalation and notification procedures.

References: ISO 22301 Auditing eBook, pages 40-42

Maintenance is the activity that ensures that the programme and its components remain in line with the organization’s overall strategy. Maintenance involves monitoring and reviewing the performance and effectiveness of the programme, identifying and implementing improvements, and ensuring alignment with the changing needs and expectations of the organization and its stakeholders. Maintenance is an essential part of the programme management cycle, as it helps to ensure that the programme delivers the intended benefits and outcomes, and that the programme remains relevant and adaptable to the changing environment. Maintenance is also a requirement of ISO 22301, the international standard for business continuity management systems (BCMS). According to ISO 22301, the organization shall establish, implement and maintain a process for continual improvement of the BCMS, which includes evaluating the need for changes to the BCMS, and ensuring that the BCMS remains suitable, adequate and effective1. References:

• ISO 22301:2019, clause 10.2

The draft report is not amended according to the feedback provided by the respondents, but rather according to the audit team leader’s judgment and discretion. The feedback from the respondents is only one of the inputs that the audit team leader considers when finalizing the audit report. The audit team leader has the ultimate responsibility and authority to decide on the content and conclusions of the audit report, based on the audit evidence and audit criteria. The audit team leader should ensure that the audit report is accurate, objective, clear, concise, constructive, and timely1.

References: 1: ISO 22301 Auditing eBook, Chapter 8: Closing an ISO 22301 Audit, Section 8.2: Finalizing the Audit Report, Page 128.

Organizational activities are the actions and processes that an organization performs to achieve its objectives and deliver its products and services. These activities are exposed to innumerable threats that have the potential to compromise the achievement of corporate goals. These threats can be internal orexternal, natural or man-made, intentional or accidental, and can affect the organization’s resources, capabilities, reputation, and continuity. Some examples of threats that can disrupt organizational activities are:

• Natural disasters, such as earthquakes, floods, storms, fires, or pandemics
• Cyber-attacks, such as hacking, malware, ransomware, denial-of-service, or data breaches
• Human errors, such as mistakes, negligence, or miscommunication
• Malicious acts, such as sabotage, theft, fraud, vandalism, or terrorism
• Supply chain issues, such as delays, shortages, quality problems, or contractual disputes
• Regulatory changes, such as new laws, standards, or policies that affect the organization’s operations or compliance
• Market changes, such as shifts in customer demand, preferences, or expectations, or increased competition or innovation
• Social changes, such as changes in demographics, culture, values, or behaviors that affect the organization’s stakeholders or environment To protect against these threats and ensure the continuity of organizational activities, organizations need to implement a business continuity management system (BCMS) that follows the requirements of ISO 22301. A BCMS is a set of policies, procedures, and practices that enable an organization to prepare for, respond to, and recover from disruptions when they arise. A BCMS helps an organization to identify its critical activities, assess the risks and impacts of potential disruptions, develop strategies and plans to mitigate and manage the disruptions, and test and improve the effectiveness of the BCMS. By implementing a BCMS, an organization can enhance its resilience, reduce its losses, and maintain its reputation and customer satisfaction. References: : What is ISO 22301 standard and what is its purpose? : Building Business Resilience: A Guide to ISO 22301 Certification : ISO 22301:2019(en), Security and resilience ? Business continuity management systems ? Requirements

Support does not lay out the foundation of planning and managing the BCMS, but rather provides the necessary resources and arrangements to enable the effective operation of the BCMS. Support includes aspects such as competence, awareness, communication, documented information, and organizational knowledge. The foundation of planning and managing the BCMS is laid out by the leadership and planning clauses of ISO 22301, which define the roles and responsibilities, policies, objectives, and actions to address risks and opportunities for the BCMS. References: ISO 22301 Auditing eBook, page 15 1; ISO 22301:2019, clauses 5, 6, and 7 2

 A control is a measure that is implemented to reduce or eliminate the risk from occurring, or to mitigate the impact of the risk if it occurs. A control can be preventive, corrective, or detective, depending on the stage of the risk management process. A control can also be administrative, technical, or physical, depending on the nature of the risk and the organization. A control can be designed, implemented, monitored, and evaluated based on the risk assessment and the risk treatment plan. A control can be documented in the business continuity policy, objectives, plans, procedures, and other relevant documents. A control can be audited to verify its effectiveness and efficiency in achieving the intended outcomes. References:

• PECB Certified ISO 22301 Lead Auditor eLearning Training Course1, Module 3: Fundamental principles and concepts of a business continuity management system (BCMS), Lesson 3.2: Business continuity management system (BCMS), Slide 15: Risk management
• ISO 22301 Auditing eBook2, Chapter 3: Fundamental principles and concepts of a business continuity management system (BCMS), Section 3.2: Business continuity management system (BCMS), Subsection 3.2.4: Risk management

The team that is responsible for determining how the impact of the incident is managed within the policy guidelines set by the strategic team is the tactical team. The tactical team is composed of managers or experts who have the authority and competence to make decisions and allocate resources to implement the business continuity plans and strategies. The tactical team coordinates and communicates with the operational team, which is responsible for executing the recovery and restoration activities, and reports to the strategic team, which is responsible for setting the overall direction and objectives of the incident response1.

References: 1: ISO 22301 Auditing eBook, Chapter 7: Business Continuity Response, Section 7.2: Incident Management Structure, Subsection 7.2.1: Incident Management Teams, Page 103

 One of the purposes of the business impact analysis (BIA) is to determine the minimal acceptable outage (MAO) for each critical function or process of the organization. The MAO is the maximum amount of time that a function or process can be disrupted before it causes unacceptable consequences for the organization. The MAO is used to define the recovery time objective (RTO) and the recovery point objective (RPO) for each function or process. The RTO is the time within which a function or process must be restored after a disruption, and the RPO is the point in time to which the data and information must be recovered. The BIA helps the organization to prioritize its recovery efforts and allocate the necessary resources for business continuity. References: ISO 22301 Auditing eBook, page 38; ISO 22301:2019 standard, clause 8.2.2

 The evaluation process that enables senior executives to manage decisions on building resilience in the development programme is the new product/service assessment. This process involves evaluating the potential impact of new products or services on the organization’s business continuity objectives, risks, and capabilities. The new product/service assessment helps senior executives to identify and prioritize the business continuity requirements and resources needed for the successful launch and delivery of new products or services. The new product/service assessment also helps senior executives to monitor and review the performance and effectiveness of the new products or services in relation to the business continuity objectives and expectations. References:

• ISO 22301 Auditing eBook, page 67
• ISO 22301:2019, clause 8.3

Regulatory compliance is the adherence to laws, regulations, guidelines and specifications relevant to an organization’s business processes. It has always been a challenge to organizations since it has a significant influence on corporate planning, such as strategic objectives, policies, procedures, risk management, performance measurement and improvement. Regulatory compliance can also affect the organization’s reputation, customer satisfaction, stakeholder confidence and legal liability. Therefore, organizations need to establish, implement, maintain and improve a business continuity management system (BCMS) that meets the requirements of ISO 22301 and other applicable regulations. References: ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems (BCMS), Section 1.2: Regulatory Compliance, page 9.

 The scope of the business continuity management system (BCMS) is the statement that defines the boundaries and applicability of the BCMS. It specifies which products, services, processes, locations, and organizational units are covered by the BCMS, as well as any exclusions or limitations. The scope should document and explain any exclusions, which are the products, services, or processes that are not within the scope of the BCMS. Exclusions may be justified for various reasons, such as:

• The products, services, or processes are not critical to the organization’s operations and objectives.
• The products, services, or processes are already covered by other management systems or plans.
• The products, services, or processes are outside the organization’s control or influence.
• The products, services, or processes are not relevant or applicable to the organization’s context or needs.

However, the exclusions should not affect the organization’s ability to provide products and services that meet the requirements and expectations of its interested parties. The exclusions should also not compromise the conformity of the BCMS with the requirements of ISO 22301, the international standard for business continuity management systems. The scope and the exclusions should be documented in a clear and concise manner, and communicated to all relevant stakeholders. The scope and the exclusions should also be reviewed and updated regularly to reflect the changing circumstances and needs of the organization. References:

• ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 4.3: Determining the scope of the business continuity management system1
• ISO 22301 Auditing eBook, Chapter 3: Business Continuity Integration, Section 3.1: Business Continuity Integration Levels2
• ISO 22301 Clause 4.3 Determining the Scope of the Business Continuity Management System3

Process-oriented objectives are the objectives that focus on the BCM activities that support the achievement of people-and performance-oriented objectives, as defined by ISO 22301. Process-oriented objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Process-oriented objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Process-oriented objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Process-oriented objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2