CBCP common mistakes
CBCP · Understand the traps and how to avoid them.
In a Business Impact Analysis question, ranks threats by likelihood or severity ('flood = high risk') instead of identifying time-critical business functions and describing how impact grows as outage hours accumulate.
Risk evaluation and BIA are studied back to back, so 'impact' gets read as 'how bad a threat would be' rather than 'what happens to the business as the outage lengthens.' Candidates with security or audit backgrounds default to threat framing.
What to do instead
Force the split before answering: state that the BIA names the functions, their order of recovery, the time-based impact curve, and the resources each needs; likelihood and probability belong only in risk evaluation. Rehearse by naming the function first, then the impact at 4, 24, and 72 hours.
Uses RTO and MTD interchangeably, or defines RTO as 'how long recovery will actually take.'
The four time metrics look similar on paper and vendors use them loosely, so candidates memorize labels without the relationship between them.
What to do instead
Commit to exact definitions: MTD is the maximum tolerable downtime before unacceptable impact; RTO is the target restoration time set inside the MTD with buffer; RPO is tolerable data loss measured in time; work recovery time is the period after systems return before normal operations resume. Any answer where RTO exceeds MTD is wrong.
Answers program initiation questions by describing plan-writing tasks, with no mention of the charter, scope boundaries, executive sponsorship, steering committee, budget, or program authority.
Practitioners equate business continuity with the document, so they jump to the tangible deliverable and skip the governance that authorizes it.
What to do instead
Memorize the lifecycle order and what each phase produces. On initiation questions, look for the cues about authority, funding, and scope, and answer with the governance artifact (charter, sponsor, steering committee) rather than with planning activity.
Selects a recovery strategy such as a hot site or alternate location without tying it to BIA-derived RTOs, and ignores non-IT resources: people, workplace, suppliers, and manual workarounds.
Strategy questions feel like technology questions, and IT recovery is the most familiar and most vendor-documented option.
What to do instead
Require every strategy justification to name the requirement it satisfies (the RTO or MTD from the BIA) and to cover all resource categories, with the cost-versus-risk tradeoff stated. Strategy selection must come after the BIA and before plan development.
Treats the evacuation or fire response procedure as the business continuity plan, or places life-safety actions inside the business recovery section.
Both appear in the same binder and are triggered by the same event, so the boundary blurs under exam pressure.
What to do instead
Hold the scope boundary: emergency response protects life and property, is immediate, and may last hours; business continuity sustains and recovers critical functions afterward. When a question mentions life safety, injury, or evacuation, it is an emergency response question.
Writes plan content as policy narrative with no named recovery teams, no alternates, no activation authority, and no notification sequence.
Candidates describe intent rather than action because intent is easier to write and sounds more strategic.
What to do instead
Use the standard plan anatomy: purpose and scope, roles with primary and alternate named by position, activation criteria and the role that authorizes activation, call tree, function-level recovery procedures, resource inventories, and appendices. If the question asks who decides to activate, the answer is a role, not a department.
Treats a single full-scale test as the end goal and marks the plan complete after it, with no lessons-learned log or tracked corrective actions.
Tests feel like the finish line, and a passed exercise is emotionally satisfying, so the follow-through feels like administration rather than part of the cycle.
What to do instead
Describe a progressive, cyclical program: walkthrough or tabletop, then simulation, then full-scale. Every exercise produces objectives, observations, an after-action report, corrective actions with owners and dates, and a plan revision. Maintenance is also triggered by organizational, system, or supplier change.
Plans only external media messaging in crisis communications, omitting employee notification, call trees, pre-scripted templates, spokesperson authority, and redundant channels.
Crisis communications is mentally equated with press relations, and employees are assumed to already know what to do.
What to do instead
Cover both directions: internal audiences (employees, families, board) and external audiences (media, customers, regulators, suppliers). Include who speaks, approval routing, pre-approved message templates, alternate channels and their redundancy, contact data maintenance, and monitoring and rumor response.
Assumes the organization recovers alone, failing to identify which external parties must be engaged, at what point, and under what authority - first responders, utilities, regulators, suppliers, mutual aid, key customers.
External coordination sits at the edge of the candidate's own organizational experience, and public agencies have no reporting line to the organization, which makes the relationship easy to overlook.
What to do instead
For each scenario, list external dependencies and the liaison role responsible for each. Distinguish coordinating with public authorities (they do not take direction from the organization) from managing vendors contractually. Put the contact protocols in the plan and exercise them.
Uses 'awareness' and 'training' interchangeably, for example answering a question about general staff familiarity with a description of a full recovery-procedures course for recovery teams.
Both are delivered to people and both are called 'preparedness,' so the audience distinction is lost.
What to do instead
Awareness means all staff know what to do when something happens and why the program matters; training means designated responders learn specific skills and procedures; exercises mean practice and validation. Match audience to method and require attendance records for both awareness and training.