Business Continuity Management Knowledge (Qualifying Examination)
What the exam tests
Business continuity management (BCM) is a lifecycle discipline, not a single plan. Expect questions organised around the sequence: policy and programme management → business impact analysis (BIA) and risk assessment → strategy selection → plan development → exercising and testing → embedding into culture → review and audit. Know where each activity sits, because a common trap is placing an activity in the wrong phase (for example, treating a BIA as a risk assessment, or treating plan maintenance as an exercise).
Concepts to master
- BIA: identifies time-critical activities, maximum tolerable period of disruption (MTPD), recovery time objective (RTO) and recovery point objective (RPO). The BIA drives strategy; it does not select the solution.
- Risk assessment: likelihood and impact of threats to prioritised activities.
- Strategy: people, premises, technology, information, suppliers and stakeholders - chosen to meet the RTO at acceptable cost.
- Plans: response structure, roles, escalation, communications, and recovery procedures.
- Exercises: from plan walkthroughs to full simulations; each has a defined objective and a lessons-learned output.
Traps
Questions often invert RTO and MTPD (RTO must be shorter than MTPD, never longer); confuse crisis communication with stakeholder management; or imply a plan is 'complete' once written. Another frequent trap: assuming BCM sits only in IT - the discipline is organisation-wide, with IT disaster recovery as one component.
Rule of thumb
If the question asks 'how quickly must we recover?', the answer comes from the BIA, not the plan. Anchor every scenario to the activity's RTO and MTPD before choosing a strategy or a response.
Worked example
An order-processing activity has an MTPD of 48 hours and an RTO of 12 hours. A proposed manual workaround restores service in 36 hours. It fails the test: 36 hours exceeds the 12-hour RTO even though it beats the 48-hour MTPD. The strategy must be revised or the RTO renegotiated with the business owner.