CBCI (Business Continuity Certifications) common mistakes
CBCI · Understand the traps and how to avoid them.
Writing the BC policy as a description of what the organisation will do during a disruption - procedures, recovery steps, contact arrangements - instead of a short statement of intent, scope, authority, objectives and accountability.
Candidates learn policy content from plan templates and document packs, so 'policy' gets conflated with 'plan'. Longer answers feel more complete under exam pressure.
What to do instead
Learn the boundary between artefacts: policy = intent, scope, authority, objectives and commitment from top management; programme plan = how the programme is governed and resourced; BC plan = who does what, when, in a disruption. Self-test each sentence you would write: if it describes a procedure, it belongs in a plan, not the policy.
Naming the business continuity manager as the person accountable for business continuity, or as the owner of business unit plans.
'Manager' sounds like the owner, and the BC manager is the most visible BC role in the organisation, so candidates default to them for any 'who is responsible' question.
What to do instead
Fix the split in your head: accountability for BC sits with top management, and each plan is owned by the accountable manager of the area it covers. The BC manager coordinates, advises, maintains the programme and reports - they do not own the business's continuity. For any question about accountability or approval, default to top management; use the BC manager only where the question is about coordination or maintenance.
Offering an awareness campaign or a training course as the answer to 'how is BC embedded?', and treating attendance records as evidence of embedding.
Training is the easiest embedding activity to produce and to evidence, so it crowds out the harder mechanisms (competence assessment, objectives, exercises, assurance) that actually change behaviour.
What to do instead
Answer embedding questions with evidence of behaviour and outcome: role-based competence assessed, BC objectives in performance reviews, staff and suppliers taking part in exercises, plan quality reviewed, findings closed out. When a question asks how to embed, pick the mechanism (induction, objective-setting, exercising, assurance) rather than the communication channel.
Using RTO and MTPD as if they were the same figure, or setting an RTO equal to the MTPD.
Both are expressed in hours or days and most plans quote only the RTO, so the two collapse into one 'recovery time' idea in the candidate's memory.
What to do instead
Hold the definitions apart: MTPD is derived from impact over time - the point at which the impact becomes unacceptable to stakeholders, regulators or the business. RTO is the target for resuming the activity and must sit below the MTPD with margin left to bring dependent resources back. If a question supplies an MTPD and asks for a target, choose a value strictly less than it.
Moving straight from the list of critical activities to a recovery strategy without capturing the resources and dependencies each activity needs at its recovery time objective.
Candidates are keen to reach the strategy answer, and dependency capture feels like paperwork rather than an examinable step.
What to do instead
Treat the BIA output as a fixed set of fields per activity: impact over time, MTPD, RTO, dependencies (people, premises, technology, data, suppliers), and the minimum resources required at the RTO. On any strategy question, first check whether those requirements are stated; if they are not, the strategy choice cannot be justified and the requirement step is the answer.
Selecting a recovery option before requirements are agreed, or prescribing one familiar solution (hot site, cloud failover, work-from-home) for every activity in the scope.
Familiarity with a particular technology or tactic produces a confident-sounding answer that skips analysis, and a single solution appears simpler to describe and defend.
What to do instead
Sequence the answer: requirements from BIA and risk assessment, then options, then evaluation against MTPD/RTO, cost, risk, interdependencies and residual risk, then a recorded rationale approved by top management. If an option is proposed without stated requirements, the error being tested is usually the missing analysis step rather than the option itself.
Producing plans written as continuous prose that explain the organisation's approach, with no activation trigger, no named roles, no action cards and no contact data.
Academic writing habits carry over, and length feels like thoroughness; candidates rarely imagine a stressed deputy opening the plan at 3 a.m.
What to do instead
Check every plan against a fixed list: purpose and scope, activation authority and triggers, incident management roles and deputies, action cards by role, communications, interdependencies and suppliers, contact details, version control. If a plan cannot be executed by someone who did not write it, it fails regardless of how well it reads.
Leaving communication and third-party/supplier arrangements out of BC plans, on the basis that they are handled elsewhere or 'during the incident'.
Plans tend to be built around internal operations, and communications is mentally filed as a corporate affairs matter rather than a plan section.
What to do instead
Treat both as mandatory plan content: who tells whom, in what order, with what message, covering staff, customers, regulators, media and families; and how suppliers and outsourced providers are activated, contacted and monitored. If a scenario question involves reputational or supply-side impact, the communications and supply-chain elements are almost always part of the expected answer.
Running an exercise with no stated objectives, then judging it a success because 'it went smoothly' and nothing was found.
Exercises are often staged as a demonstration for management, so the social goal (looking competent) overrides the learning goal.
What to do instead
Insist on objectives tied to specific plan elements, a scenario, evaluation criteria and named observers before the exercise runs. The output is a post-exercise report with corrective actions, owners and due dates, fed back into the programme and tracked to closure. In the exam, an exercise with no objectives and no corrective-action loop is the wrong answer.
Choosing an operations-based exercise such as a drill or full-scale simulation as the first validation of a new or untested plan, or describing a tabletop discussion as a live exercise.
'More realistic equals better' feels intuitively right, and the exercise type labels are easy to blur when recalling them under pressure.
What to do instead
Learn the progressive cycle - seminar/workshop, tabletop, then functional, then full-scale - and match the type to the objective and the maturity of the plan and team. Know the distinguishing characteristic of each type (discussion-based versus operations-based, whether resources are deployed) so definition-style questions can be answered from the described features rather than the label.