CRIS common mistakes
CRIS · Understand the traps and how to avoid them.
Answering the lifecycle stage the topic keyword suggests rather than the stage the question stem describes - e.g. selecting a preventive/planning action when the stem says the incident 'has just been confirmed', or selecting a response action when the stem asks what should be in place 'before an event'.
Candidates skim for the subject noun (communications, BIA, recovery) and stop reading, so the tense and trigger words in the stem ('has occurred', 'during', 'prior to', 'immediately after') are never weighed against the options.
What to do instead
Before looking at the options, underline the stem's time marker and status word and write the required stage (prepare / respond / recover / learn) in the margin. Eliminate any option that belongs to a different stage before judging quality.
Treating 'crisis', 'emergency' and 'disruption' as interchangeable, and picking a single-site, operational response option when the stem describes cross-functional, reputational or strategic-level impact with high uncertainty.
Most candidates' intuition is drawn from emergency management, where a defined incident commander and a bounded scene are the norm; the exam's definition of crisis hinges on uncertainty, strategic visibility and multi-stakeholder impact instead.
What to do instead
Test every option against three filters: does it address more than one function, does it acknowledge uncertainty, and does it reach stakeholders beyond the operation? Options that only restore a local service fail all three.
Choosing an option that skips a step in the plan lifecycle - most often 'revise the plan' when nothing has been validated, or 'write the plan' when the stem says a capability already exists and has never been tested.
Revisions and rewrites feel like tangible, safe answers, so they attract candidates whenever the stem mentions a gap or a recent incident; the lifecycle order develop → approve → train → exercise → maintain is rarely held in mind as a sequence.
What to do instead
Memorise the five-step lifecycle and place each option on it. If the stem says the capability has never been exercised, only exercise-related options can be correct, regardless of how sensible a rewrite sounds.
Assigning approval authority for the crisis management plan, policy or framework to the crisis team lead, the business continuity manager or the IT director rather than to executive management or the board.
Candidates reason from operational ownership ('who runs the crisis team must own the plan') and forget that authority, budget and cross-organisational mandate are governance questions, not operational ones.
What to do instead
Apply a fixed split: executives/board approve policy, framework and plan and accept residual risk; the crisis lead executes, activates and directs the response; functional managers own their own sub-plans and recovery of their services.
Mis-selecting the exercise type - proposing a full-scale exercise as the first validation step, or proposing a tabletop when the stem's objective is validating communications interoperability, system failover or multi-agency coordination under realistic load.
All exercise types look like 'testing', so candidates pick the most impressive one; the distinguishing criteria (cost, disruption, whether systems are actually invoked, whether participants are in separate locations) are not applied.
What to do instead
Build a ladder and match to purpose: tabletop for plans, roles and decision-making; walkthrough for procedures; functional for a single capability with systems live; full-scale for end-to-end and external interfaces. First-time validation is always discussion-based.
On communication questions, choosing either 'wait until all facts are verified before saying anything' or its opposite, 'release all known details immediately to show transparency'.
Both options sound like defensible ethical positions, and candidates anchor on a personal instinct about honesty or caution instead of on the staged communication model the exam expects.
What to do instead
Default to the holding-statement pattern: acknowledge the event, express concern for those affected, state what is being done, give the next update time, and commit to updating as facts are confirmed. Facts are released as verified; silence is never correct, and unverified detail never is either.
Making the most senior executive the spokesperson for every audience on the grounds that seniority signals seriousness.
This is intuitive and hard to argue against, so candidates never test it; the exam instead tests consistency of message, media training and audience-appropriateness, which seniority does not supply.
What to do instead
Answer with a designated, trained spokesperson supported by subject-matter experts, with one coordinated message across all channels. Choose the CEO only when the audience is strategic (investors, regulators, staff-wide) and the message is about organisational commitment.
Sequencing errors during an active incident - selecting 'conduct a post-incident review', 'update the plan' or 'implement the corrective action' when the stem places the candidate mid-response, or selecting 'activate the crisis team' when the stem says the team is already convened.
Options that read as good practice feel safe, so the candidate evaluates each one for quality in isolation rather than against the clock; the habit of judging options one at a time instead of ordering them by time lets them all pass.
What to do instead
Lay the options out as a timeline before choosing. Anything that can only logically happen after stabilisation is wrong in a 'during the incident' stem, and any action already described in the stem is a distractor.
Confusing the recovery metrics - using RTO, RPO, MTD and work-recovery time interchangeably and picking the shortest stated time as 'safest'.
All four metrics are expressed in time, so they visually blend; candidates also carry a bias that shorter recovery equals better resilience, which ignores cost and the relationship between the metrics.
What to do instead
Fix the definitions: MTD is the maximum tolerable outage before unacceptable harm; RTO is the target time to restore the service and must be shorter than MTD; RPO is the tolerable data loss measured backwards from the incident; WRT covers verification before handing back to the business. No option that sets RTO equal to or beyond MTD can be correct.
Treating the business impact analysis and the risk assessment as the same study, or answering a BIA question with a likelihood-and-threat option and a risk question with an impact-over-time option.
Both feed the continuity programme and both produce a prioritised list, so the outputs look alike; candidates remember 'assessment' as a single activity and never separate the input each one uses.
What to do instead
Anchor on the input: the BIA takes time-based operational and financial impact of a loss of a service and outputs criticality, MTD and RTO; the risk assessment takes threats, vulnerabilities and likelihood and outputs risk ratings and treatment options. Ask which input the option depends on.