CBCA case studies
CBCA · Put your knowledge to work in context.
CBCA - the Continuity Audit certification - is one of the individual credentials awarded by DRI International. On DRI's certification pages it sits in the Continuity Audit family alongside CBCLA, distinct from the core business continuity track (ABCP, CBCP, CBCV, CFCP, MBCP) and from the risk management, supply chain resilience, cyber resilience, healthcare and public sector tracks. The CBCA case studies are 5 cases and about 4,458 words.
1The auditor who used to own the plan
You are a senior internal auditor at a regional insurer (1,100 staff, three offices). Fourteen months ago the chief audit executive assigned you to audit the business continuity programme.
662 words, about 3 min2640 hours, 22 units, one failed recovery test
You are planning the continuity audit for a 24/7 card payments processor (peak 4,200 transactions per minute, contractual availability 99.95%). The audit committee approved 640 hours and a 10-week field phase; you have two qualified auditors and one rotation auditor.
960 words, about 5 min3'Successful' exercise, absent engineers, stale SOC 2
You are testing whether the Order-to-Cash continuity plan is operable. Evidence provided: a tabletop exercise report from 11 months ago, graded 'Successful', covering a simulated 45-minute outage of the order platform; an attendance list showing 9 of 14 named participants attended and none of the four application support engineers did; an exercise script showing the pricing engine recovery steps were walked through verbally, not executed; a SOC 2 Type II report for the SaaS order platform covering a period ending 16 months ago, with no bridge letter; an undated vendor email stating 'DR failover was validated'; and plan version 7, last updated 19 months ago, whose contact list includes three departed staff among five names.
929 words, about 5 min4The critical rating the CRO wants downgraded
The draft report has eight findings: one critical, three high, four medium. The critical finding is that the Tier 1 claims platform has no viable alternate processing site - the DR contract lapsed seven months ago and the documented manual workaround handles 12% of normal volume.
971 words, about 5 min5'ISO 22301 certified' - scope, claims and criteria
The annual report and website state that the organisation is 'ISO 22301 certified'. The certificate, issued 14 months ago, carries the scope statement 'Provision of data centre hosting services from Site A'.
936 words, about 5 min