CBCI (Other exams) common mistakes
CBCI · Understand the traps and how to avoid them.
Treating business continuity management as a one-off project with a start and end date, then disbanding the team once plans are published, instead of running it as a continuous lifecycle of analysis, strategy, planning, exercising and review.
Candidates with project-management backgrounds default to project thinking, and the exam's phrasing about 'establishing a BCMS' tempts them to treat the management system as a deliverable rather than an ongoing set of processes.
What to do instead
Frame every answer around the repeating cycle: understand the organization, determine continuity requirements, design solutions, implement, validate through exercise, and embed through review and improvement. When an option describes a finite end state, check whether a lifecycle-continuous option better matches the question's emphasis on governance and continual improvement.
Confusing the roles of the business continuity manager, the incident management team, and senior management, and selecting answers where the BC manager personally declares a disaster, authorizes spending, or directs operational recovery.
Job titles sound authoritative, so candidates assume the BC manager holds decision authority, when in fact authority to invoke plans and commit resources typically rests with senior leadership or a designated crisis leader.
What to do instead
Map each role to its decision rights before answering: senior management owns policy, resourcing and invocation authority; the BC manager coordinates the program and advises; business unit owners execute recovery; the incident team manages the response. Reject any option that gives coordination roles executive authority.
Performing a business impact analysis by listing every process the organization performs and assigning uniform recovery targets, rather than prioritizing activities by financial, regulatory, and operational impact over time.
The BIA looks like an inventory exercise, and candidates worry about missing something, so they produce exhaustive lists with identical recovery time objectives that carry no prioritization information.
What to do instead
Start from impact over time: for each activity ask what happens at one hour, one day, one week, and identify the point where impact becomes unacceptable. Derive recovery time objectives and recovery point objectives from those thresholds, and let lower-priority activities inherit later targets. Answers that assign the same target to everything are almost always wrong.
Treating the risk assessment as a duplicate of the BIA, or skipping it because the BIA already covers the important processes, and therefore failing to link identified threats and vulnerabilities to the continuity strategies chosen.
Both analyses feed strategy, so their outputs blur together in candidates' minds, and the exam's overlapping terminology encourages treating them as interchangeable.
What to do instead
Keep the two distinct: the BIA asks what the organization cannot afford to lose and when; the risk assessment asks what could cause that loss and how likely and severe it is. Practice stating, for a single scenario, both the impact-based recovery requirement and the likelihood-and-vulnerability assessment, then show how the pair drives the chosen strategy.
Selecting a single recovery strategy, usually full duplication or hot-site arrangements, without weighing cost against the recovery targets, and ignoring that different activities may need different strategies.
Candidates equate 'best' with 'most resilient' and overlook that the exam tests whether a strategy is proportionate to the requirement, not whether it is maximally robust.
What to do instead
For every strategy question, first identify the recovery time objective and recovery point objective, then evaluate options against them plus cost, complexity and dependence on third parties. Accept that a manual workaround may be correct for a low-impact activity and that a tiered strategy across activities is often the right answer.
Assuming a supplier's or cloud provider's continuity arrangements transfer responsibility, and writing plans that rely on vendor assurances without validating them or documenting internal fallbacks.
Outsourcing feels like risk transfer, and vendor claims of certification are persuasive, so candidates select options where the third party's plan substitutes for the organization's own arrangements.
What to do instead
Remember that accountability stays with the organization. Look for options that include due diligence on suppliers, contractual continuity requirements, testing of supplier arrangements, and internal contingency if the supplier fails. Any answer that says reliance on the vendor's plan is sufficient should be eliminated.
Writing plans that consist mainly of policy statements and organizational charts, without task-level procedures, contact details, resource requirements, or clear triggers for activation.
Strategy documents are easier to produce and sound comprehensive, so candidates pick answers emphasizing plan approval and distribution over operational usability under pressure.
What to do instead
Judge plan quality by whether a tired person at three in the morning could act on it: named roles and alternates, step-by-step recovery tasks with dependencies, resource and contact lists, activation criteria, and escalation paths. Choose options that describe usable procedures and validation over options describing intent and sign-off.
Designing an incident response structure with unclear escalation thresholds and no defined crisis communication or decision log, so the plan does not say who declares an incident, who speaks publicly, or how decisions are recorded.
Candidates focus on technical recovery steps and treat communication and governance as administrative afterthoughts, even though the exam tests coordination and stakeholder communication heavily.
What to do instead
For each incident scenario, be able to state the activation trigger, the escalation ladder, the single accountable incident leader, the spokesperson and approval route for messages, and the mechanism for logging decisions and actions. Prefer answers that establish clear command and communication over ones that add more technical detail.
Equating testing with exercising, and choosing answers where plans are validated only by desk review or by a single annual full-scale simulation, rather than a progressive program from component tests through integrated exercises.
The words are used loosely in practice, and candidates assume one big annual test satisfies validation requirements, missing the exam's emphasis on graduated, objective-driven exercises.
What to do instead
Learn the progression: plan review, component and call-tree tests, tabletop walkthroughs, simulation, and full integrated exercises, each with defined objectives and lessons capture. Select options that build complexity over time and that feed results back into plan revision rather than options describing a single annual event.
Treating training and awareness as a one-time communication at plan launch, and neglecting maintenance triggers such as organizational change, new systems, exercise findings, or staff turnover.
Candidates treat awareness as a communications task rather than a sustained program, and they underestimate how often plans decay without scheduled review and change-triggered updates.
What to do instead
Link awareness to role: general staff need what to do in the first minutes, responders need procedural competence, and leaders need decision-making practice. Pair this with defined review cycles and explicit triggers for plan updates, including post-exercise corrective actions with owners and dates. Choose answers that embed continuity in induction, ongoing training and change management.