MBCP common mistakes
MBCP · Understand the traps and how to avoid them.
Answering BIA questions by selecting the option that identifies the most critical business process or the shortest recovery time, rather than the option that establishes the impact of disruption over time and the dependencies that drive recovery priorities.
Candidates carry over intuition that 'most critical' is the deliverable, but the BIA's purpose is to quantify impact across time (financial, operational, regulatory, reputational) and expose dependencies, which then justify RTOs and priorities rather than the reverse.
What to do instead
Before answering, restate the question as 'what decision does this BIA output support?' and choose the option that produces a defensible, time-phased impact statement or dependency map; reject options that merely rank processes or assert an RTO without an impact basis.
Treating RTO, RPO, MTD, and WRT as interchangeable, and picking an answer that gives a single recovery time without distinguishing maximum tolerable downtime from the target the plan is designed to achieve.
The terms appear together in strategy questions and the distractors reuse the same numbers, so candidates anchor on the number rather than on which tolerance or target the term defines.
What to do instead
Write the four definitions in one line each before the exam and, on each question, identify which term the stem is defining or constraining; eliminate options that use the wrong term for the stated purpose (e.g., an RPO stated as a recovery duration).
Choosing a continuity strategy on the basis of technical elegance or lowest cost alone, without first checking it against the BIA-derived RTO/RPO and the approved risk appetite.
Strategy questions often present a technically superior option and a cheaper option; candidates pick one on gut feel instead of testing both against the documented requirements and tolerance for residual risk.
What to do instead
For every strategy question, first extract the stated RTO, RPO, and any cost or regulatory constraint from the stem, then eliminate any option that cannot meet them; among survivors, prefer the one whose residual risk is explicitly accepted by management.
Writing plan-development answers that describe a document or template deliverable, when the question is asking about the process of building organizational capability, ownership, and activation authority.
Candidates equate 'plan' with 'document' and overlook that plan development includes governance, roles, delegation of authority, and integration with incident management.
What to do instead
When a stem mentions plan development, ask whether the correct answer creates capability (roles, authority, interfaces, maintenance ownership) or merely produces paperwork; choose the capability answer unless the stem specifically asks for document content.
Designing or evaluating an exercise program around a single large annual exercise instead of a progressive cycle of building-block exercises (plan walkthrough, tabletop, simulation, functional, full-scale) with defined objectives.
Full-scale exercises are the most visible and memorable, so candidates default to them and miss that the exam tests exercise-type selection matched to maturity and objectives.
What to do instead
Match exercise type to the stated objective and program maturity: discussion-based for validating concepts and roles, operations-based for validating capabilities; reject single-event programs that skip the progression and the after-action loop.
Treating the exercise as complete once the after-action report is written, omitting corrective actions, owners, due dates, and verification that fixes were implemented and re-tested.
The report feels like the deliverable, and candidates stop at documentation rather than closing the loop through the corrective action program.
What to do instead
Select answers that convert findings into tracked corrective actions with accountable owners and dates, and that feed results back into plan revision and the next exercise cycle; treat an untracked finding as an open risk.
Answering program-management questions with a project-management lens, focusing on schedule, budget, and deliverables rather than on establishing and sustaining the BCMS through governance, policy, performance evaluation, and management review.
Candidates with PM or IT backgrounds default to project mechanics, but the exam tests the ongoing management system that keeps continuity capability alive and improving.
What to do instead
For program-level questions, prefer options that establish authority, policy, roles, metrics, and periodic management review; treat one-off project outputs as insufficient unless the stem asks specifically about a project phase.
Confusing crisis management and crisis communications with business continuity, choosing options that keep the public informed or protect reputation when the question is about restoring prioritized business functions (or vice versa).
The disciplines overlap in a real incident, and stems often describe a scenario where both are relevant, so candidates pick the response that sounds most urgent rather than the one matching the question's stated focus.
What to do instead
Identify the question's subject from the stem's outcome: restoring prioritized functions and dependencies points to continuity; stakeholder messaging, media, and executive decision authority point to crisis management/communications; answer within that discipline.
Selecting supplier or dependency answers that rely on a vendor's general assurance (a certificate, a marketing claim, or a contract clause) rather than on verified, tested recovery capability and documented dependency mapping.
Assurance artifacts are easy to accept at face value, and candidates underestimate how often third-party recovery claims fail under actual disruption.
What to do instead
Prefer options that verify supplier recovery through evidence such as test results, RTO/RPO commitments that match your BIA, and exercised recovery; treat unverified contractual language as an unmitigated dependency risk.
Treating the plan as finished at approval and signing off maintenance as an administrative formality, instead of tying plan currency to change triggers (org changes, new systems, BIA updates, exercise findings) and scheduled review.
Approval feels like the endpoint, and maintenance is low-visibility work, so candidates pick 'distribute the plan' or 'review annually' over answers that trigger revision on material change.
What to do instead
Choose answers that define who owns the plan, what changes force a revision, and how reviews and exercise results update content; reject purely calendar-based or distribution-only answers when a material-change trigger is present.
Choosing awareness and training answers that consist of one-time communication (an email, a launch event, or a plan posted on the intranet) rather than role-based, recurring training with competence verification.
Awareness activities are visible and easy to implement, so candidates conflate them with the training needed to make responders competent in their assigned roles.
What to do instead
Prefer options that target specific roles (crisis team, recovery teams, alternates), recur on a schedule, and verify competence through drills or assessment; treat one-way communication as awareness only, not training.
Answering assessment and maturity questions with a binary 'compliant or not' judgment, ignoring that the exam tests measuring capability maturity and performance against defined objectives and criteria.
Audit and compliance experience trains candidates to look for pass/fail evidence, while continuity assessment asks how well the capability performs and how it improves over time.
What to do instead
Select answers that define assessment criteria and objectives up front and evaluate capability against them, using results to drive improvement; reject answers that only confirm a document exists or a control is nominally in place.
Mistaking risk assessment outputs (likelihood, vulnerability, threat analysis) for continuity decisions, choosing options that mitigate a threat when the question asks what to do about the resulting business impact.
Risk and continuity share vocabulary and both appear in scenarios, so candidates answer the risk question that seems implied rather than the continuity question actually asked.
What to do instead
Separate the two: risk assessment informs what could happen and how likely; continuity decides what must keep operating and how. When the stem asks about impact tolerance or recovery priority, choose the continuity answer even if a risk-mitigation option sounds prudent.