CBCA study plan

Diagram the clause structure of ISO 22301 (clauses 4-10) and label the audit criterion each element supplies.

Contrast ISO 22301, NFPA 1600, and the BCI Good Practice Guidelines on scope, terminology, and mandatory documented information.

Define the auditor's independence, objectivity, due professional care, and competence requirements from the IIA Standards and Code of Ethics.

Distinguish internal audit, external/third-party certification, and consulting roles within a continuity program, and state the independence limits of each.

Sequence the engagement planning steps: objectives, scope, criteria, risk assessment, resource and timing plan.

Write audit objectives and scope statements that name the criteria used and explicitly state boundaries and exclusions.

Build a risk-based audit program that ranks continuity processes by business impact, prior findings, and change since last audit.

Apply materiality and due professional care judgments to decide what to test and what to omit in a scoped BCMS audit.

Convert the engagement plan into a numbered test program with each procedure tied to a specific criterion reference.

Match evidence-gathering techniques (inquiry, observation, document review, walkthrough, re-performance, testing) to each type of criterion being tested.

Design sampling decisions for BIA records, exercise and test results, and supplier continuity agreements, stating population, method, and sample size.

Build a reusable working-paper template with criteria, evidence source, reliability rating, and conclusion fields.

Execute walkthroughs and interviews and record evidence with source, date, and a reliability rating.

Evaluate BIA outputs (RTO, RPO, MAO) against the stated criteria and document every gap found.

Assess exercise and test results plus prior corrective actions for sufficiency and appropriateness of evidence.

Write up findings in criteria-condition-cause-effect-risk form and assign a severity rating using a defined scale.

Test whether collected evidence is sufficient and appropriate, then conclude against each audit objective in writing.

Draft findings that separate nonconformities from observations and improvement opportunities.

Compose an executive summary that states the overall audit opinion and the residual risk position.

Evaluate management corrective action plans for root-cause treatment, named owner, and achievable dates.

Design a follow-up process with tracking fields, verification-of-implementation steps, and explicit closure criteria.

Decide and justify when a finding is closed versus escalated, and how residual risk is reported to the audit committee.

Apply a quality review checklist to your own draft report and revise it against each failed criterion.

Rehearse delivering a finding in an exit meeting and respond to management disagreement without weakening the evidence.

Rebuild a risk-based audit program for a new case scenario in 60 minutes without notes.

Justify in writing the evidence type and sample size chosen for five separate procedures.

Analyse every missed practice question and rewrite each weak concept as a corrected one-paragraph explainer.

Complete one 60-question timed mixed set spanning all five domains and log the result by domain.

Recite from memory the ISO 22301 clause structure and the list of mandatory documented information.

Resolve 10 independence and ethics scenario questions, citing the specific rule applied to each.

Map each of the five domains onto the audit lifecycle on a single page to consolidate integration.

Complete two full timed 100-question practice exams and score at or above 80% on each.