I85PREP
⌘ K
CBCI study materials
CBCI study resources

CBCI (Business Continuity Certifications) practice questions

One question at a time. Build your CBCI understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Business Continuity Policy and Programme Management

What is the primary purpose of an organization's business continuity policy?

  1. Describes step-by-step recovery procedures
  2. Lists individual employee home addresses
  3. Records details of past incidents
  4. States top management commitment and BC framework Correct answer.

Explanation

A BC policy is a high-level statement of intent that sets direction, demonstrates top management commitment, and provides a framework for setting BC objectives. Detailed procedures and incident records belong in plans and operational records, not in the policy itself.

Question 2Business Continuity Policy and Programme Management

Who is responsible for approving an organization's business continuity policy?

  1. External auditor
  2. Top management Correct answer.
  3. Facilities manager
  4. IT service desk

Explanation

Top management owns and approves the BC policy because it sets the programme's direction and demonstrates leadership. Other roles may draft or review the policy, but approval remains an executive responsibility.

Question 3Business Continuity Policy and Programme Management

What is the primary purpose of a business impact analysis?

  1. Drafts press releases
  2. Identifies time-critical activities Correct answer.
  3. Calculates insurance premiums
  4. Tests backup generators

Explanation

A BIA identifies time-critical activities, their dependencies, and the impacts of disruption over time. Those findings inform recovery priorities and continuity strategies.

Question 4Business Continuity Policy and Programme Management

In the BCM lifecycle, which stage normally follows 'understanding the organization'?

  1. Determine BC strategies Correct answer.
  2. Appoint an auditor
  3. Conduct post-incident review
  4. Purchase insurance

Explanation

After understanding the organization through BIA and risk assessment, the programme determines strategies for continuity and recovery. Implementation, exercising, evaluation, and maintenance follow later in the lifecycle.

Question 5Business Continuity Policy and Programme Management

Why does a BC programme conduct exercises?

  1. To replace the risk assessment process
  2. To eliminate all business risks
  3. To satisfy payroll reporting requirements
  4. To validate plans and build competence Correct answer.

Explanation

Exercises test whether plans and strategies work in practice and help participants build the competence and confidence needed during disruption. They also reveal gaps that feed corrective action and improvement.

Question 6Business Continuity Policy and Programme Management

What is the main purpose of a management review of the BC programme?

  1. Approve individual annual leave requests
  2. Calculate overtime payments
  3. Assess BC programme effectiveness Correct answer.
  4. Design marketing campaigns

Explanation

Management review evaluates whether the BC programme remains suitable, adequate, and effective. It considers performance information and directs improvement actions.

Question 7Business Continuity Policy and Programme Management

What does embedding business continuity mean?

  1. Storing plans only in a secure archival vault
  2. Outsourcing all business continuity activities
  3. Making BC part of everyday culture and decisions Correct answer.
  4. Encrypting every backup tape and disk

Explanation

Embedding means continuity considerations become part of normal management practice and everyday decision-making. It is demonstrated through behavior, training, governance, and routine business processes.

Question 8Business Continuity Policy and Programme Management

What is the primary role of a BC programme sponsor?

  1. Audits annual financial statements
  2. Provides executive authority and funding Correct answer.
  3. Performs routine data backup and restore operations
  4. Writes all employee call trees

Explanation

An executive sponsor gives the programme authority, resources, and visibility at senior levels. The sponsor champions the programme and helps remove organizational barriers.

Question 9Business Continuity Policy and Programme Management

Which statement best defines the scope of a BC programme for a multi-site organization?

  1. Only IT systems hosted on-premises
  2. All services, sites, and critical dependencies Correct answer.
  3. Only the headquarters building and its permanent staff
  4. Only activities by permanent employees

Explanation

Scope should reflect the organization's full range of products, services, sites, and dependencies that could affect time-critical activities. Excluding locations, suppliers, or outsourced work can leave critical exposure unmanaged.

Question 10Business Continuity Policy and Programme Management

Which business continuity objective is measurable?

  1. Be a fully resilient organization
  2. Recover all systems as quickly as possible
  3. Improve awareness as much as reasonably possible
  4. Restore order processing within four hours Correct answer.

Explanation

Measurable objectives include a specific target that can be assessed, such as a recovery time. General aspirations cannot be reliably measured or verified.

Question 11Business Continuity Policy and Programme Management

A new BC policy is approved, but staff remain unaware of it. What should the programme do next?

  1. Revise the business impact analysis immediately
  2. Wait for the next scheduled annual audit cycle
  3. Store it only in the legal archive for reference
  4. Communicate policy and assign responsibilities Correct answer.

Explanation

An approved policy must be communicated and understood by relevant personnel, with responsibilities made clear. Awareness is an ongoing programme activity, not something that can wait for an audit.

Question 12Business Continuity Policy and Programme Management

Who typically coordinates business impact analyses across business units?

  1. External catering supplier
  2. Payroll and benefits officer
  3. Website development contractor
  4. Business continuity manager Correct answer.

Explanation

The BC manager or coordinator usually plans, guides, and consolidates BIAs across business units. Business unit owners provide the operational knowledge, while the coordinator ensures consistency.

Question 13Business Continuity Policy and Programme Management

Which membership is most appropriate for a BC steering committee?

  1. Only external audit contractors
  2. Only junior IT support technicians
  3. Only front-line operational staff
  4. Senior leaders from key functions Correct answer.

Explanation

A steering committee needs senior decision-makers from key business functions to set direction, prioritize, and allocate resources. Operational and assurance roles may contribute but cannot replace executive representation.

Question 14Business Continuity Policy and Programme Management

Which metric best indicates BC programme performance?

  1. Critical plans exercised on schedule Correct answer.
  2. Average monthly stationery spend
  3. Number of social media followers
  4. Number of office chairs purchased each quarter

Explanation

A meaningful performance metric should relate to the programme's objectives and readiness, such as the proportion of critical plans exercised as scheduled. Unrelated operational or marketing measures do not indicate BC performance.

Question 15Business Continuity Policy and Programme Management

An exercise shows that a recovery contact list is out of date. What is the best corrective action?

  1. Remove the contact list entirely
  2. Cancel future exercises
  3. Update list and track to closure Correct answer.
  4. Ignore it as a minor administrative issue

Explanation

Corrective action should address the root cause, assign ownership, and track the fix until it is verified as complete. Removing the list or cancelling exercises would reduce preparedness rather than improve it.

Question 16Business Continuity Policy and Programme Management

How should BC policies and plans be controlled as documented information?

  1. Controlled versions available to authorized users Correct answer.
  2. Kept only in individual personal notebooks
  3. Shared publicly with all sensitive operational details
  4. Deleted immediately after the first exercise

Explanation

Documented information should be version-controlled, protected as appropriate, and available to those who need it. This ensures users rely on current, approved content.

Question 17Business Continuity Policy and Programme Management

What is the most effective way to secure resources for a BC programme?

  1. Rely entirely on unpaid volunteers
  2. Avoid senior management involvement
  3. Present a business case linked to objectives Correct answer.
  4. Use any leftover budget without formal approval

Explanation

Resources are more likely to be approved when the programme presents a clear business case tied to organizational objectives, risk reduction, and legal or contractual needs. Informal or unapproved funding is unsustainable.

Question 18Business Continuity Policy and Programme Management

Which approach best develops competence among BC plan owners?

  1. No training until an incident occurs
  2. Role-based training with refreshers Correct answer.
  3. One general email sent to all staff members
  4. Only a poster in the lobby

Explanation

Competence is built through training matched to specific roles, reinforced with refreshers and practical exercises. General communication alone is unlikely to develop the skills plan owners need.

Question 19Business Continuity Policy and Programme Management

A BC policy should include a commitment to which item?

  1. Outsourcing accountability
  2. Continually improving the BCMS Correct answer.
  3. Eliminating every possible business risk
  4. Avoiding management review

Explanation

A BC policy typically commits to continual improvement of the BC management system, along with meeting applicable requirements and providing a framework for objectives. It cannot reasonably promise to eliminate all risk.

Question 20Business Continuity Policy and Programme Management

How should BC be integrated with enterprise risk management?

  1. Only assess risks after an incident
  2. Keep BC separate from enterprise risk management
  3. Use risk outputs to prioritize BC strategies Correct answer.
  4. Focus solely on insurance

Explanation

Risk assessment outputs help the BC programme prioritize threats, vulnerabilities, and continuity strategies. Integration with enterprise risk management gives continuity decisions consistent visibility and treatment.

Question 21Business Continuity Policy and Programme Management

An organization has written plans but no BIA and no exercises. What is the most significant programme gap?

  1. Overuse of enterprise risk registers
  2. Excessive staff training and awareness
  3. No analysis-based planning or validation Correct answer.
  4. Too many active supplier relationships across the group

Explanation

Plans should be based on BIA and risk assessment and validated through exercising. Without those activities, recovery priorities and plan effectiveness are unproven.

Question 22Business Continuity Policy and Programme Management

Which set of inputs is most appropriate for a management review of the BC programme?

  1. Audit results, exercise outcomes, and corrective actions Correct answer.
  2. Employee birthdays, parking allocation, and office décor
  3. Canteen menus, travel claims, stationery
  4. Sales leads, ad campaigns, website traffic

Explanation

Management review should consider performance and assurance information, such as audit findings, exercise results, risk changes, and the status of corrective actions. This supports decisions on improvement and resources.

Question 23Business Continuity Policy and Programme Management

How should an organization govern a critical supplier's continuity capability?

  1. Include supplier recovery in internal plans without contracts
  2. Rely on verbal assurances only
  3. Assume suppliers will recover automatically after disruption
  4. Set BC requirements in contracts and monitor performance Correct answer.

Explanation

Critical suppliers should be subject to contractual continuity requirements and ongoing performance monitoring. Assumptions or verbal assurances do not provide sufficient evidence or enforceability.

Question 24Business Continuity Policy and Programme Management

What should be established first when initiating a BC programme?

  1. Write detailed recovery scripts before defining scope
  2. Delegate all programme decisions to IT staff
  3. Buy backup hardware before assessing requirements
  4. Define scope, governance, objectives, and resources Correct answer.

Explanation

Programme initiation requires clear scope, governance arrangements, objectives, and resource commitment. Detailed solutions should follow from analysis and agreed priorities rather than precede them.

Question 25Business Continuity Policy and Programme Management

Which observation best indicates that BC is embedded in an organization's culture?

  1. Staff cannot locate the policy
  2. Managers consider BC in change projects Correct answer.
  3. BC team works in isolation
  4. Plans are stored in a locked cabinet only

Explanation

Embedding is shown when continuity considerations are routinely included in business decisions such as change projects. Isolation of the BC team or poor policy awareness indicates the opposite.

Question 26Business Continuity Policy and Programme Management

Which document formally authorizes a business continuity programme and communicates top management's intent to the whole organization?

  1. The business impact analysis report
  2. The business continuity policy Correct answer.
  3. The annual exercise schedule
  4. The crisis communication plan

Explanation

The BC policy is the governing document that establishes the programme's authority, states top management's intent and commitment, and sets the framework for objectives. The other documents are programme outputs or deliverables that operate under the policy.

Question 27Business Continuity Policy and Programme Management

Who is normally accountable for keeping a single business continuity plan current and fit for purpose?

  1. The facilities management team for the site
  2. The internal audit function
  3. The IT service desk that supports the system
  4. The plan owner for that business area Correct answer.

Explanation

Each plan should have a named owner drawn from the business area it protects, accountable for its accuracy, review and exercising. Support functions contribute content but do not own the business plan.

Question 28Business Continuity Policy and Programme Management

Within a continual improvement cycle for business continuity, which activities belong to the 'check' stage?

  1. Identifying risks, impacts and dependencies across the organization
  2. Selecting and implementing recovery strategies
  3. Exercising, testing and reviewing performance against objectives Correct answer.
  4. Defining the programme scope and approving the policy

Explanation

The check stage measures whether the programme delivers what it set out to do, through exercises, tests, audits and performance review against objectives. Understanding the organization and choosing strategies belong to earlier stages of the cycle.

Question 29Business Continuity Policy and Programme Management

A business unit moves a critical application to a new platform without informing the continuity team, and its plan is now out of date. Which programme-level control addresses the root cause?

  1. Making a BC impact review a mandatory gate in the change process Correct answer.
  2. Storing all plans on a version-controlled shared drive
  3. Requiring plan owners to re-sign their plans once a year after review
  4. Adding another exercise to the annual exercise schedule

Explanation

The root cause is that significant change can happen without continuity input, so continuity review must be built into change and project approval gates. Annual sign-off, extra exercises and version control help detect staleness but do not prevent unassessed change.

Question 30Business Continuity Policy and Programme Management

Top management wants independent confirmation that the BC programme conforms to its policy and meets its objectives. Which activity provides this?

  1. A tabletop exercise with the crisis management team and observers
  2. An internal audit of the programme against agreed criteria Correct answer.
  3. A questionnaire sent to critical suppliers
  4. A refresh of the business impact analysis

Explanation

Internal audit evaluates conformity and effectiveness against defined criteria and reports its findings independently to top management. Exercises, BIA refresh and supplier questionnaires generate useful evidence but do not constitute independent assurance of the programme as a whole.

Question 31Business Continuity Policy and Programme Management

Three business units complete BIAs using their own formats and rating scales, so the results cannot be compared. What should the programme manager do?

  1. Outsource all future impact analysis to an external consultancy
  2. Accept the outputs and combine them using management judgement
  3. Issue a single BIA methodology with defined scales and templates Correct answer.
  4. Ask each unit to repeat its BIA without any further guidance

Explanation

Comparability requires a common methodology with defined criteria, scales and templates, plus guidance or training for those applying it. Repeating the work without a common method, or aggregating inconsistent data, will not produce reliable priorities.

Question 32Business Continuity Policy and Programme Management

Exercises and reviews keep generating improvement actions that are never closed out. Which practice best addresses this?

  1. Relying on participants to complete them from memory
  2. A central action log with named owners, due dates and status reviews Correct answer.
  3. Recording the actions only in the exercise report
  4. Adding the actions to the exercise schedule so they are revisited next year

Explanation

Improvement actions need to be managed as tracked items with accountability and follow-up, typically in a register reviewed at programme meetings. Leaving them in reports or revisiting them only at the next annual cycle removes the follow-up that drives completion.

Question 33Business Continuity Policy and Programme Management

A programme cannot fund every gap it has identified. What is the most defensible basis for prioritising improvements?

  1. Ranking gaps by risk to priority activities and cost-benefit Correct answer.
  2. Starting with the improvements that are easiest to deliver
  3. Addressing gaps in the order they were identified
  4. Dividing the available budget equally between business units

Explanation

Prioritisation should follow the risk to the organization's prioritized activities and the relative benefit of each improvement, with top management endorsing the trade-offs. Order of discovery, equal shares or ease of delivery are not risk-based and can leave critical exposures unaddressed.

Question 34Business Continuity Policy and Programme Management

An organization maintains its BC programme only to satisfy an insurer's checklist and has never linked it to its own operational risks. What is the most likely consequence?

  1. The programme will mature automatically as documents accumulate
  2. The insurer will withdraw cover as soon as it finds out
  3. Continuity costs will be lower than those of comparable organizations
  4. Plans may fail to support recovery of the organization's most critical activities Correct answer.

Explanation

A programme built around an external checklist rather than the organization's own risk and impact analysis is likely to address the wrong activities and miss critical dependencies. Checklist compliance can be achieved on paper without any evidence of real recovery capability.

Question 35Embedding Business Continuity

Which action by senior management is most effective in embedding business continuity into an organisation's culture?

  1. Visible, consistent personal involvement in continuity activities Correct answer.
  2. Sending a single organisation-wide email announcing the policy
  3. Outsourcing the continuity programme to an external specialist
  4. Delegating all continuity decisions to the BC manager

Explanation

Embedding depends on staff perceiving continuity as a genuine priority, and that perception is formed mainly by what leaders consistently do rather than by what they say once. Repeated, visible participation by senior leaders signals that continuity is part of normal management work. Delegation or one-off messages leave continuity framed as a specialist side activity.

Question 36Embedding Business Continuity

How should business continuity awareness first be delivered to a newly recruited employee?

  1. Only after the first annual exercise has taken place
  2. During the employee's induction programme Correct answer.
  3. When the organisation next experiences a disruption
  4. At the point the employee is promoted to a management role

Explanation

Induction is the point at which an organisation establishes expected norms of behaviour for a new starter, so continuity awareness is most effective when introduced there. It should then be reinforced through refresher activity and role-specific training. Waiting for an event or a promotion leaves the employee without basic knowledge for too long.

Question 37Embedding Business Continuity

In the context of business continuity, what does 'embedding' most closely mean?

  1. Publishing the continuity policy on the corporate intranet
  2. Making continuity part of routine decisions and behaviour Correct answer.
  3. Certifying the management system against a national standard
  4. Transferring the continuity function to a specialist contractor

Explanation

Embedding describes the extent to which continuity capability becomes a normal part of how the organisation thinks and acts, rather than a set of documents held by a small team. It is demonstrated through everyday decisions, behaviours and accountability. Publication, certification and outsourcing are activities that may support embedding but do not define it.

Question 38Embedding Business Continuity

Who should formally approve the organisation's business continuity policy?

  1. The business continuity coordinator
  2. Top management and the governing body Correct answer.
  3. The internal audit function
  4. The facilities manager, acting on behalf of the building landlord

Explanation

A policy carries authority only when it is approved at the level that sets the organisation's direction and can commit resources. Top management and the governing body provide that authority and accountability. Operational roles may draft or review the policy but cannot give it organisation-wide mandate.

Question 39Embedding Business Continuity

What is the main reason for documenting business continuity roles and responsibilities?

  1. To satisfy the document control requirements of the BCMS
  2. So people know what is expected of them in a disruption Correct answer.
  3. To reduce the number of staff attending continuity training
  4. To allow the plan to be written by a single author

Explanation

Clear role definition removes ambiguity about who does what when normal management structures are disrupted, which is the practical purpose of assigning responsibilities. Document control, training volume and authorship are secondary considerations. Without explicit accountabilities, response activity tends to default to whoever is present.

Question 40Embedding Business Continuity

Why should business continuity awareness training be repeated periodically?

  1. Because repeat training removes the need for exercises
  2. Because the continuity policy must be re-approved each year
  3. Because staff change roles and learned skills fade over time Correct answer.
  4. Because auditors require a fixed number of training records each year

Explanation

Knowledge of what to do in a disruption decays if it is never used, and personnel turnover means the population that was trained changes continuously. Periodic refreshers keep competence current as roles and arrangements change. Training repetition complements exercises; it does not replace them.

Question 41Embedding Business Continuity

Which communication approach is most likely to embed continuity expectations across an organisation?

  1. Repeated messages, via several channels, to each audience Correct answer.
  2. Relying on staff to read the plan stored on the shared drive
  3. A single detailed technical briefing to the executive team
  4. Publishing the full plan as an appendix to the annual report

Explanation

Embedding requires reinforcement over time and relevance to each group's role, so a sustained multi-channel programme tailored to different audiences works best. One-off or passive methods rely on staff choosing to seek out information. Audience-specific messaging makes expectations concrete for each group.

Question 42Embedding Business Continuity

What is the main benefit of including continuity objectives in individual performance appraisals?

  1. It removes the need for a separate continuity training programme
  2. It guarantees that every recovery time objective will be met
  3. It makes continuity a recognised part of everyone's normal job Correct answer.
  4. It transfers accountability for continuity to the human resources function

Explanation

Performance objectives signal what the organisation genuinely values and reward, so including continuity goals normalises it as part of routine work. This reinforces accountability at the individual level. It cannot guarantee recovery outcomes, and it does not shift ownership away from line management.

Question 43Embedding Business Continuity

Which argument best supports spending on embedding continuity rather than on more detailed documentation?

  1. Regulators no longer accept written continuity plans alone
  2. Plans create value only when people know how to use them Correct answer.
  3. Embedding always costs less than writing a recovery plan
  4. Documentation is not required by any continuity standard

Explanation

Documentation is a prerequisite but not a capability; its value is realised only when people understand their roles and can act under pressure. Investment in awareness, training and exercising therefore converts paper arrangements into usable response capacity. Documentation remains required by standards and regulators.

Question 44Embedding Business Continuity

How should an organisation best confirm that staff have the competence required for their continuity role?

  1. By counting how many staff downloaded the policy
  2. By recording attendance at awareness sessions
  3. By assessing their performance in exercises and incident drills Correct answer.
  4. By asking line managers to sign a compliance form

Explanation

Competence is demonstrated through observable performance, so exercises and drills provide the most reliable evidence that individuals can carry out their assigned tasks. Attendance and download counts measure exposure, not capability. Manager sign-off records assertion rather than verified ability.

Question 45Embedding Business Continuity

How do exercises contribute to embedding business continuity?

  1. They provide evidence that no further training is required
  2. They demonstrate compliance to customers without staff involvement
  3. They convert written plans into practised behaviour Correct answer.
  4. They replace the need for documented recovery procedures

Explanation

Exercises move arrangements from the page into lived experience, giving participants familiarity with their roles and revealing assumptions that do not hold in practice. That rehearsal is what turns a plan into a capability. Exercises complement rather than replace documentation and training, and they require active staff participation.

Question 46Embedding Business Continuity

What is the most effective way to use lessons identified from incidents and exercises?

  1. Track corrective actions to closure and update plans and training Correct answer.
  2. Wait until the next annual review before recording any actions
  3. Share them only with the continuity team to avoid reputational risk
  4. File them with the incident report for audit purposes

Explanation

Learning becomes embedding only when identified weaknesses are converted into owned actions that are followed through and reflected in plans, training and procedures. Filing without action captures the lesson but changes nothing. Restricting circulation or delaying action allows the same failures to recur.

Question 47Embedding Business Continuity

How can an organisation best embed continuity requirements in its supply chain?

  1. Asking suppliers verbally whether they have a plan
  2. Building continuity criteria into tenders, contracts and reviews Correct answer.
  3. Requiring suppliers to use the organisation's own plan template
  4. Reviewing supplier continuity only after an incident occurs

Explanation

Suppliers respond to what is measured and contracted, so continuity expectations become durable when they are scored in selection, written into agreements and examined in periodic reviews. Verbal checks and post-incident reviews are too late and too informal. Imposing an internal template addresses format rather than capability.

Question 48Embedding Business Continuity

Which practice best embeds continuity into project and change management?

  1. Adding continuity to the agenda of the annual audit committee meeting
  2. Providing project managers with a copy of the continuity policy
  3. Making a continuity impact assessment a standard approval gate Correct answer.
  4. Asking the continuity team to review projects after go-live

Explanation

Change introduces new dependencies and alters recovery assumptions, so continuity must be considered before a decision is taken. Embedding the assessment into the standard approval gate makes that consideration routine and unavoidable. Post-implementation review or passive policy distribution leaves changes live before their continuity implications are examined.

Question 49Embedding Business Continuity

What does a cross-functional continuity steering group contribute to embedding?

  1. Independent assurance of the continuity management system
  2. Ongoing oversight, resourcing and shared accountability Correct answer.
  3. Technical authorship of every business continuity plan in the organisation
  4. Day-to-day management of individual recovery teams

Explanation

A steering group drawn from across the business creates shared ownership above the level of any single function, sustaining oversight and releasing resources over time. It operates at a governance level rather than managing recovery teams directly. Independent assurance and plan authorship remain distinct roles.

Question 50Embedding Business Continuity

Which observation is the strongest evidence that continuity is genuinely embedded?

  1. A current continuity plan is stored on the corporate intranet
  2. Managers can state their recovery priorities without the plan Correct answer.
  3. The continuity budget has increased year on year
  4. The organisation holds a valid certificate against a continuity standard

Explanation

Embedding is evidenced by knowledge and behaviour, so managers who can articulate priorities unaided demonstrate that continuity is understood rather than merely documented. Documents, certificates and budgets are inputs that may exist alongside a weak culture. The strongest indicator is capability held by people.