CBCA
DRI International CBCA - Continuity Audit Certification Examination
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
CBCA - the Continuity Audit certification - is one of the individual credentials awarded by DRI International. On DRI's certification pages it sits in the Continuity Audit family alongside CBCLA, distinct from the core business continuity track (ABCP, CBCP, CBCV, CFCP, MBCP) and from the risk management, supply chain resilience, cyber resilience, healthcare and public sector tracks. DRI uses a letter prefix to signal level: certifications beginning with "A" are associate, "C" certified and "M" master - so CBCA is a certified-tier designation.
It is aimed at practitioners whose job is to audit a continuity management program rather than only build one: assessing the program against recognized criteria, gathering and weighing evidence, writing findings, and tracking corrective action through to closure. DRI's related audit training is standards-based, with courses on auditing a business continuity program against ISO 22301 and against NFPA 1600, and audit specialty exams covering ISO 22301, NFPA 1600 and CSA Z1600-17.
At DRI, certification is a two-part process: verification of knowledge and confirmation of experience. Plan for both - the exam, and documentation of your audit experience. Useful preparation sources include the DRI audit courses and exams, the Professional Practices Library, and the glossary. Always confirm current exam logistics and fees on DRI's own certification pages.
What you'll study
About CBCA preparation
Is CBCA the same credential as CBCLA?
No. DRI lists them as two separate designations under its Continuity Audit heading - CBCA and CBCLA. DRI's catalog also separates audit training by criteria framework, offering "Auditing a Business Continuity Program: ISO 22301" and an NFPA 1600 equivalent. Because DRI's public pages here do not spell out how the two designations differ, confirm the distinction on DRI's certification overview before you commit.
What does the "C" in CBCA indicate?
According to DRI's own footnote, its three certification levels are associate certified, certified and master certified, and certifications beginning with "A" are associate, "C" certified and "M" master. CBCA therefore sits in the certified tier - not the associate tier (which would carry an A prefix) and not the master tier.
How many questions are on the exam, and how long do I get?
DRI's public course and inquiry pages in this source state no item count, time limit, passing score or fee for the Continuity Audit examination. Treat any precise number you hear secondhand with suspicion and verify against DRI's certification and examination pages before you schedule or budget.
Beyond passing a test, what does DRI require?
DRI describes certification as a two-part process: verification of knowledge and confirmation of experience. The exam addresses the knowledge half; you also need demonstrable professional experience. DRI states that it only certifies professionals who have demonstrated both knowledge and experience in the business continuity and/or disaster recovery profession, so prepare evidence of audit work too.
How do I keep the certification once I have it?
DRI states that maintaining a certification carries two requirements: an annual maintenance fee and Continuing Education Activity Points (CEAP). Qualifying activities earn points - DRI course pages note that continuing education points "may be awarded towards recertification if applicable." Log points as you earn them rather than reconstructing a multi-year history at renewal time.
What study order makes the most sense?
Start with the criteria, because audit work is criteria-driven: ISO 22301, NFPA 1600 and CSA Z1600-17 are the standards around which DRI builds its audit courses and audit specialty exams. Then layer on audit method - scoping, sampling, evidence sufficiency, writing findings, corrective action and follow-up. Use DRI's free Professional Practices Library and Glossary alongside a course.
Must I take a DRI course before sitting the exam?
DRI's pages in this source do not state whether a course is a prerequisite for the Continuity Audit exam, so do not assume either way. Note that where a DRI course includes an exam, the listed price covers both, and a certificate of completion is issued only after the exam is completed and payment received. Confirm prerequisites directly with DRI.
What most often trips candidates up?
Treating standards as trivia. Audit exams test judgment: given incomplete evidence, an uncooperative auditee, or a badly worded nonconformity, what should the auditor do? Practise classifying findings by severity, matching each to a proportionate corrective action and a follow-up date, and distinguishing an observation from a nonconformity. That reasoning transfers better than memorised clause numbers.
How long is the certification valid?
DRI's pages in this source do not state a fixed validity period for the Continuity Audit certification. What they do confirm is that maintenance is ongoing, involving an annual maintenance fee plus Continuing Education Activity Points. Treat recertification as a continuous obligation rather than a one-off renewal event, and verify the current cycle with DRI.