I85PREP
⌘ K
ISO 22301 LA study materials
ISO 22301 LA study resources

ISO 22301 LA practice questions

One question at a time. Build your ISO 22301 LA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a business continuity management system

In ISO 22301, what is the primary purpose of a business continuity management system (BCMS)?

  1. To satisfy insurance underwriters by producing a single recovery plan document
  2. To replace the organization's enterprise risk management framework entirely
  3. To guarantee that an organization will never experience a disruptive incident
  4. To provide a documented framework for building resilience and protecting priority activities Correct answer.

Explanation

A BCMS is a management system: a set of interrelated elements, including policy, objectives, processes and resources, used to build resilience. It establishes a documented, continually improved framework rather than promising that disruption can be prevented outright.

Question 2Fundamental principles and concepts of a business continuity management system

Which statement best captures the meaning of 'business continuity' as used in ISO 22301?

  1. The ability of an organization to continue delivery of products or services at acceptable predefined levels following a disruption Correct answer.
  2. The capacity of an organization to avoid all operational risk through preventive controls
  3. The financial strategy used to fund recovery activities after a crisis
  4. The process of restoring IT infrastructure to its original configuration after failure

Explanation

Business continuity is defined around the capability to keep delivering products or services at acceptable predefined levels during and after disruption. The emphasis on predefined levels links continuity directly to objectives agreed before an incident occurs.

Question 3Fundamental principles and concepts of a business continuity management system

What does the term 'disruption' refer to in the context of a BCMS?

  1. An anticipated or unanticipated event that causes an unplanned negative deviation from expected delivery of products or services Correct answer.
  2. A regulatory audit finding that requires corrective action
  3. Any change in customer demand that requires the organization to adjust production levels
  4. A planned maintenance window that temporarily reduces service capacity

Explanation

A disruption is an event, whether anticipated or unanticipated, that interrupts normal operations and causes an unplanned negative deviation in delivery. Planned maintenance and normal demand variation are managed operations, not disruptions.

Question 4Fundamental principles and concepts of a business continuity management system

Which concept describes the point in time by which a priority activity must be resumed to avoid unacceptable consequences?

  1. Recovery point objective (RPO)
  2. Recovery time objective (RTO)
  3. Minimum business continuity objective (MBCO)
  4. Maximum tolerable period of disruption (MTPD) Correct answer.

Explanation

The maximum tolerable period of disruption is the duration after which the impacts of a disruption become unacceptable to the organization. Recovery objectives must be set within this limit to keep consequences tolerable.

Question 5Fundamental principles and concepts of a business continuity management system

An organization states that its customer service function must resume within eight hours of a disruption. Which term does this statement illustrate?

  1. Business impact analysis threshold
  2. Recovery time objective Correct answer.
  3. Recovery point objective
  4. Maximum tolerable period of disruption

Explanation

A recovery time objective is the targeted duration within which a product, service or activity is resumed after disruption. Stating that a function must be back within eight hours is a target resumption time, so it is an RTO.

Question 6Fundamental principles and concepts of a business continuity management system

What is the role of a business impact analysis (BIA) within the BCMS?

  1. To assign disciplinary responsibility for staff who fail to follow procedures
  2. To identify the likelihood of each threat materializing at each site
  3. To determine which activities are priority activities and what impacts arise if they are disrupted Correct answer.
  4. To document the technical configuration of backup systems and data replication

Explanation

The BIA analyzes activities and the consequences of their disruption over time, which allows the organization to identify priority activities and set objectives. Threat likelihood assessment belongs to risk assessment, which complements but does not replace the BIA.

Question 7Fundamental principles and concepts of a business continuity management system

An analyst finds that losing a warehouse for two days is tolerable, but beyond three days customer penalties become severe and contracts are at risk. What has the analyst primarily established?

  1. The recovery point objective for warehouse data
  2. The maximum tolerable period of disruption for the warehousing activity Correct answer.
  3. The minimum business continuity objective for the sales team
  4. The risk appetite of the logistics department

Explanation

The analysis identifies the duration beyond which impacts become unacceptable, which is the maximum tolerable period of disruption. Recovery objectives for the warehousing activity would then be set to fall within that three-day limit.

Question 8Fundamental principles and concepts of a business continuity management system

Which pair correctly distinguishes risk assessment from business impact analysis in a BCMS?

  1. Risk assessment applies to suppliers; BIA applies only to internal departments
  2. Risk assessment evaluates consequences of disruption; BIA evaluates the likelihood of threats
  3. Risk assessment evaluates likelihood and impact of threats; BIA evaluates the consequences of disrupting activities over time Correct answer.
  4. Risk assessment is performed only after an incident; BIA is performed only before an incident

Explanation

Risk assessment examines threats and vulnerabilities and their likelihood and consequences, informing the selection of controls. The BIA works from the organization's activities outward, quantifying how impacts grow over time so that priority activities and objectives can be set.

Question 9Fundamental principles and concepts of a business continuity management system

Which element is a required component of the BCMS scope determination?

  1. The complete asset register for all IT hardware owned by the organization
  2. The products and services covered, together with the organizational units and locations involved Correct answer.
  3. The names of the external auditors who will certify the system
  4. A list of every employee's home address for call-tree purposes

Explanation

Scope determination must establish the boundaries of the BCMS, including the products and services to be protected and the organizational units, locations and interfaces involved. This prevents gaps and overlaps between the BCMS and other management systems.

Question 10Fundamental principles and concepts of a business continuity management system

What does the principle of 'continual improvement' require of an ISO 22301-conformant BCMS?

  1. Increasing the number of continuity plans produced each cycle
  2. Reducing the budget allocated to continuity activities over time
  3. Replacing the entire BCMS documentation set every year
  4. Ongoing enhancement of the suitability, adequacy and effectiveness of the BCMS Correct answer.

Explanation

Continual improvement means the organization persistently enhances the suitability, adequacy and effectiveness of the BCMS. It is driven by performance evaluation, lessons learned and corrective actions rather than by document volume or budget reduction.

Question 11Fundamental principles and concepts of a business continuity management system

Which statement describes the 'Plan-Do-Check-Act' model as applied to a BCMS?

  1. It is a financial control model used only for budgeting continuity activities
  2. It is a linear sequence that ends once the continuity plans have been tested once
  3. It is a certification scheme administered by accreditation bodies
  4. It is an iterative cycle in which planning, implementation, evaluation and improvement feed one another Correct answer.

Explanation

PDCA is an iterative management cycle: establish objectives and processes, implement them, monitor and evaluate results, and act to improve. In a BCMS the cycle repeats as the organization, its risks and its context change.

Question 12Fundamental principles and concepts of a business continuity management system

A continuity manager reviews how the BCMS interacts with the organization's quality and information security management systems. Which concept is being addressed?

  1. The maximum tolerable period of disruption for the audit function
  2. The business impact analysis threshold for security incidents
  3. The context of the organization and the integration of management systems Correct answer.
  4. The recovery point objective of the quality system

Explanation

Understanding the organization's context includes identifying internal and external issues and how the BCMS relates to other management systems. Integrated management systems reduce duplication and help ensure continuity requirements are reflected across disciplines.

Question 13Fundamental principles and concepts of a business continuity management system

Why does ISO 22301 require leadership commitment and a continuity policy?

  1. To allow the continuity function to operate independently of top management decisions
  2. To transfer legal liability for disruptions from management to operational staff
  3. To ensure continuity objectives are established and aligned with the organization's strategic direction Correct answer.
  4. To satisfy the documentation requirements of external certification bodies only

Explanation

Top management must provide direction by establishing a policy and objectives that are compatible with strategic direction and by integrating continuity into business processes. Leadership commitment ensures resources, authority and accountability are in place.

Question 14Fundamental principles and concepts of a business continuity management system

What is the purpose of defining 'priority activities' in a BCMS?

  1. To determine which suppliers should be paid first during a cash-flow crisis
  2. To rank employees according to their seniority for evacuation purposes
  3. To select the activities that will be outsourced to reduce continuity costs
  4. To identify the activities whose disruption would most threaten the organization's objectives and obligations Correct answer.

Explanation

Priority activities are those whose disruption would cause the greatest impact on products, services, objectives and obligations. Identifying them allows resources and recovery strategies to be focused where they matter most.

Question 15Fundamental principles and concepts of a business continuity management system

A retailer decides it can operate with only its online channel for the first week of a disruption, accepting reduced revenue. Which concept does this decision express?

  1. The recovery point objective for the order database
  2. The risk treatment option of avoidance
  3. The maximum tolerable period of disruption for the stores
  4. The minimum business continuity objective Correct answer.

Explanation

The minimum business continuity objective defines the minimum level of products or services that is acceptable to the organization during a disruption. Accepting a reduced service level for a defined period is a statement of that minimum.

Question 16Fundamental principles and concepts of a business continuity management system

How does ISO 22301 treat the relationship between business continuity and risk management?

  1. Continuity planning replaces risk management once the BCMS is certified
  2. Continuity management uses risk assessment outputs to select strategies and controls for priority activities Correct answer.
  3. Risk management applies only to financial risks, while continuity addresses operational risks
  4. The two disciplines must remain entirely separate to preserve auditor independence

Explanation

Risk assessment identifies threats, vulnerabilities and their consequences, and these outputs inform the selection of continuity strategies and controls. The BCMS therefore consumes and complements the organization's broader risk management activity.

Question 17Fundamental principles and concepts of a business continuity management system

Which statement best explains why exercises and tests are fundamental to a BCMS?

  1. They eliminate the need for a business impact analysis in subsequent cycles
  2. They validate that strategies and plans work as intended and reveal gaps before a real disruption Correct answer.
  3. They provide evidence that no disruption will ever affect the organization
  4. They are conducted solely to satisfy insurance policy conditions

Explanation

Exercising and testing verify that arrangements are workable, build competence and expose weaknesses that can be corrected. Lessons from exercises feed back into the BIA, strategy selection and planning, reinforcing continual improvement.

Question 18Fundamental principles and concepts of a business continuity management system

An organization's continuity strategy relies on a reciprocal arrangement with a neighboring business. Which characteristic of continuity solutions does this primarily illustrate?

  1. A risk avoidance measure that removes the need for recovery planning
  2. A data replication technique for restoring backups
  3. A resource-based solution that depends on an external party's cooperation and capacity Correct answer.
  4. A contractual transfer of all continuity obligations

Explanation

Reciprocal arrangements are resource-based strategies in which another organization provides facilities or capabilities under agreed conditions. Because the solution depends on an external party, its feasibility, capacity and mutual obligations must be verified and exercised.

Question 19Fundamental principles and concepts of a business continuity management system

What is the primary purpose of a business continuity plan within the BCMS?

  1. To describe how the organization will respond to and recover from a disruption to priority activities Correct answer.
  2. To catalogue every risk the organization has ever identified
  3. To define the scope of the internal audit programme
  4. To record the minutes of management review meetings

Explanation

A business continuity plan provides structured guidance for responding to and recovering from disruption, including roles, actions and communication. It operationalizes the strategies chosen for priority activities.

Question 20Fundamental principles and concepts of a business continuity management system

A manager argues that because the organization has good insurance cover, a detailed continuity strategy is unnecessary. What is the most accurate response in BCMS terms?

  1. Insurance addresses financial consequences but does not restore delivery of products or services, so continuity capability is still required Correct answer.
  2. Insurance should be cancelled and the funds redirected to backup generators
  3. Insurance fully satisfies the requirement for continuity strategies and plans
  4. Insurance is relevant only to public sector organizations

Explanation

Insurance transfers some financial impact but does not by itself restore operations, protect reputation or meet obligations to customers. A BCMS therefore requires strategies and plans that deliver acceptable continuity, with insurance as one supporting measure.

Question 21Fundamental principles and concepts of a business continuity management system

Which statement correctly describes the relationship between the MTPD, the RTO and the MBCO?

  1. The MBCO determines the RTO, which in turn defines the MTPD
  2. The three parameters are independent and need not be reconciled
  3. The RTO must be set within the MTPD so that the MBCO can be delivered before impacts become unacceptable Correct answer.
  4. The MTPD must always be shorter than the RTO to allow a safety margin

Explanation

The MTPD sets the outer limit of tolerable disruption, and recovery objectives must be achieved within it. The MBCO defines the minimum acceptable delivery level, so strategies must restore that level before the MTPD is reached.

Question 22Fundamental principles and concepts of a business continuity management system

During a BIA, an analyst discovers that a priority activity depends on a supplier whose own recovery time is longer than the activity's MTPD. What is the most appropriate BCMS conclusion?

  1. The activity should be reclassified as non-priority to remove the dependency
  2. The dependency can be ignored because supplier performance is outside the BCMS scope
  3. The MTPD should be extended until it matches the supplier's recovery time
  4. The dependency represents an unacceptable gap that requires an alternative strategy or supplier arrangement Correct answer.

Explanation

Interdependencies with external providers are part of the BCMS scope, and a supplier recovery time exceeding the MTPD leaves the priority activity exposed. The organization must select alternative strategies or renegotiate supplier arrangements to close the gap.

Question 23Fundamental principles and concepts of a business continuity management system

Which of the following best describes 'resilience' in the context of ISO 22301 principles?

  1. The ability to absorb and adapt to disruption and to restore delivery of priority products and services Correct answer.
  2. The speed with which an organization can dismiss continuity staff after an incident
  3. The capacity to operate without any documented procedures
  4. The ability to prevent every identified threat from occurring

Explanation

Resilience is the capability to anticipate, absorb, adapt to and recover from disruption, maintaining delivery at acceptable levels. It is built through the combination of prevention, protection, response and recovery arrangements within the BCMS.

Question 24Fundamental principles and concepts of a business continuity management system

An organization identifies that its only payroll system is hosted in a single data centre located in a flood plain. Which principle does this finding most directly engage?

  1. Payroll should be classified as non-priority because salaries can be paid late
  2. Concentrated single points of failure should be identified and mitigated through continuity strategies Correct answer.
  3. Flood risk should be excluded from the BIA because it is an insured peril
  4. The data centre location is irrelevant provided backups are taken weekly

Explanation

Single points of failure concentrate risk and can cause disproportionate disruption to priority activities. The BCMS requires such concentrations to be identified and addressed through strategies such as redundancy, relocation or alternative arrangements.

Question 25Fundamental principles and concepts of a business continuity management system

What distinguishes an 'incident' from a 'crisis' in business continuity terminology?

  1. An incident requires external reporting, while a crisis requires only internal notification
  2. An incident is an event that may be managed through normal response arrangements, while a crisis threatens the organization's strategic objectives or viability Correct answer.
  3. An incident occurs only in IT systems, while a crisis occurs only in operational facilities
  4. An incident is always caused by nature, while a crisis is always caused by people

Explanation

An incident is an event that disrupts or may disrupt operations and can often be handled through routine response. A crisis is a larger-scale situation that threatens strategic objectives, reputation or viability and typically demands executive-level direction.

Question 26Fundamental principles and concepts of a business continuity management system

In ISO 22301, what is the primary purpose of establishing a business continuity management system (BCMS)?

  1. To guarantee that an organization will never experience a disruptive incident
  2. To satisfy insurance requirements for continuity coverage
  3. To provide a systematic framework for building and maintaining organizational resilience Correct answer.
  4. To replace the organization's risk management function

Explanation

A BCMS is a management system that provides a structured, systematic approach to identifying potential threats, building continuity capabilities, and continually improving resilience. It is not intended to eliminate all disruptions or replace other management disciplines.

Question 27Fundamental principles and concepts of a business continuity management system

An organization defines a maximum tolerable period of disruption (MTPD) of 24 hours for a critical order-processing service. Which statement best describes how the recovery time objective (RTO) should be set relative to the MTPD?

  1. The RTO should be shorter than the MTPD to provide a margin of safety Correct answer.
  2. The RTO should be equal to the MTPD to ensure maximum recovery speed
  3. The RTO should be set longer than the MTPD to allow for thorough recovery
  4. The RTO is independent of the MTPD and determined solely by available resources

Explanation

The RTO is the target time to resume activities after disruption and must be set within the MTPD to allow recovery before unacceptable impacts occur. Setting an RTO shorter than the MTPD provides a buffer for unforeseen delays.

Question 28Fundamental principles and concepts of a business continuity management system

Which statement accurately describes the role of 'continual improvement' in an ISO 22301 BCMS?

  1. It applies only to corrective actions after incidents
  2. It is a one-time activity performed during initial certification
  3. It is an ongoing process of enhancing BCMS performance and effectiveness Correct answer.
  4. It is limited to annual management review meetings

Explanation

Continual improvement in ISO 22301 is a recurring process that seeks to enhance the suitability, adequacy, and effectiveness of the BCMS. It is not confined to initial certification, incident response, or periodic reviews alone.

Question 29Fundamental principles and concepts of a business continuity management system

A business continuity manager is analyzing how the organization's BCMS should address a newly identified dependency on a single cloud provider for all critical applications. Which principle of ISO 22301 is most directly relevant to this analysis?

  1. The principle of risk-based thinking applied to continuity Correct answer.
  2. The principle of documented information control
  3. The principle of leadership and commitment
  4. The principle of performance evaluation

Explanation

Risk-based thinking requires the organization to identify, assess, and treat risks to continuity, including single points of failure such as a sole cloud provider. This principle guides the analysis of dependencies and the selection of appropriate continuity strategies.

Question 30Business continuity management system requirements

According to ISO 22301, what is the primary purpose of a business impact analysis (BIA)?

  1. To rank suppliers by their annual contract value
  2. To record the maintenance schedule of fire-suppression equipment
  3. To list the legal penalties for late regulatory filings
  4. To identify time-critical activities and the consequences of disrupting them Correct answer.

Explanation

The BIA is used to identify activities that support key products and services and to assess the consequences of disruption over time, which produces recovery priorities and timeframes. It is the analytical foundation for setting recovery objectives rather than an asset or contract register.

Question 31Business continuity management system requirements

In ISO 22301 terms, what does a maximum acceptable outage (MAO) or maximum tolerable period of disruption represent?

  1. The maximum storage period for archived continuity records
  2. The longest interval allowed between two internal audits
  3. The maximum time a product or activity can be unavailable before unacceptable harm occurs Correct answer.
  4. The longest permitted duration of a management review meeting

Explanation

The maximum acceptable outage defines the point beyond which the impacts of disruption become unacceptable to the organization and its interested parties. It sets the outer boundary within which recovery capability must be demonstrated.

Question 32Business continuity management system requirements

What is the required relationship between the business continuity policy and top management under ISO 22301?

  1. The policy is issued by the audit function to preserve independence
  2. Top management must establish the policy and ensure it is compatible with strategic direction Correct answer.
  3. The BC manager drafts the policy and top management only signs it after certification
  4. The policy is optional for small organizations with informal governance

Explanation

Leadership clause requirements place responsibility on top management to establish the policy, ensure it is appropriate to purpose and context, and align it with strategic direction. Delegation of drafting is possible, but accountability for establishing and communicating the policy remains with top management.

Question 33Business continuity management system requirements

What distinguishes a business continuity plan from a business continuity strategy in ISO 22301?

  1. The strategy is a public document; the plan is confidential to the audit team
  2. The strategy selects solutions and resources; the plan defines structures and procedures to respond and recover Correct answer.
  3. The strategy covers only IT; the plan covers only facilities
  4. The strategy is written for suppliers; the plan is written for regulators

Explanation

Determining and selecting continuity solutions produces the strategy, such as relocating to an alternate site or using manual workarounds. Plans then translate that strategy into roles, communications, activation criteria and step-by-step procedures.

Question 34Business continuity management system requirements

Which statement best describes the role of an interested party register in the BCMS?

  1. It records the names of auditors assigned to each department
  2. It replaces the need for a legal and regulatory review
  3. It identifies parties relevant to continuity and their requirements, which feed into scope and risk decisions Correct answer.
  4. It lists employees eligible for overtime during a disruption

Explanation

The organization must determine interested parties and the requirements they impose on continuity, then use that understanding when defining scope and managing risk. The register is an input to decision-making, not a substitute for compliance evaluation.

Question 35Business continuity management system requirements

What must an organization do when a planned change to the BCMS is implemented?

  1. Apply the change only after the next surveillance audit confirms suitability
  2. Obtain approval from every external interested party before proceeding
  3. Consider the purpose and consequences of the change and ensure resources and responsibilities are available Correct answer.
  4. Restrict the change to documentation edits so operations remain untouched

Explanation

The standard requires changes to be carried out in a planned manner, considering their purpose and potential consequences and addressing resource and responsibility impacts. Change control is prospective and does not wait for external audit confirmation.

Question 36Business continuity management system requirements

Which activity is part of the 'evaluation of business continuity performance' requirement?

  1. Replacing the BIA with a risk register
  2. Publishing the continuity plan on the public website
  3. Outsourcing incident response to a third party
  4. Monitoring, measurement, analysis and evaluation against defined criteria Correct answer.

Explanation

The performance evaluation clause requires the organization to determine what needs monitoring and measuring, the methods used, and when results are analysed and evaluated. This provides evidence that the BCMS achieves intended outcomes.

Question 37Business continuity management system requirements

What is the purpose of exercising and testing business continuity arrangements?

  1. To confirm that staff have read the policy document
  2. To satisfy customers by producing photographs of the exercise
  3. To validate that arrangements work as intended and to identify improvements Correct answer.
  4. To demonstrate that the BIA was approved by the board

Explanation

Exercises and tests verify that plans, strategies and recovery capabilities are workable and effective, and they generate findings for improvement. They are validation activities, not awareness or approval records.

Question 38Business continuity management system requirements

An organization sets a recovery time objective of four hours for an order-entry activity, but its alternate site contract guarantees activation within eight hours. What is the most appropriate conclusion?

  1. The selected solution cannot meet the stated recovery objective and needs revision Correct answer.
  2. The BIA should be deleted because it conflicts with the contract
  3. The gap is acceptable because alternate sites always activate faster in practice
  4. The recovery time objective should be changed to eight hours without further analysis

Explanation

Recovery objectives derived from impact analysis must be achievable with the selected continuity solutions. Where a solution's capability exceeds the tolerable timeframe, the solution, the objective or both must be revisited with justification.

Question 39Business continuity management system requirements

During a disruption, a team invokes the continuity plan before the incident has been formally classified. Which principle from ISO 22301 does this best illustrate?

  1. Response should wait until all interested parties are notified
  2. Activation is permitted only after the next management review
  3. Incidents must always be classified by the board before any action
  4. Plans should include clear activation criteria and authority so response is timely Correct answer.

Explanation

Continuity plans and procedures need defined activation criteria and assigned authority so that response can start promptly when thresholds are met. Pre-emptive activation based on agreed triggers is consistent with that design.

Question 40Business continuity management system requirements

A new cloud service supporting a prioritized activity is introduced. What should the continuity manager do first?

  1. Update the exercise schedule for the following year only
  2. Transfer all continuity responsibility to the cloud provider
  3. Add the vendor to the interested party register and take no further action
  4. Assess how the change affects risks, dependencies and the ability to meet recovery objectives Correct answer.

Explanation

Changes affecting continuity capability must be managed in a planned way, including reassessing risks, dependencies and recovery capability. Only after that assessment can plans, strategies and exercise schedules be updated appropriately.

Question 41Business continuity management system requirements

Which set of contents is most appropriate for a business continuity plan?

  1. Roles and authority, activation criteria, communication arrangements and recovery procedures Correct answer.
  2. Marketing forecasts, salary bands and office floor plans
  3. Supplier invoices, purchase orders and delivery schedules
  4. Audit findings, corrective actions and management review minutes

Explanation

A continuity plan documents the response structure, who has authority to act, the triggers for activation, how stakeholders are communicated with, and the procedures to recover prioritized activities. Financial and audit records serve different purposes.

Question 42Business continuity management system requirements

How should an organization treat a dependency on a single supplier for a time-critical component?

  1. Assume the supplier's own certification removes the dependency risk
  2. Remove the activity from the BIA to avoid reporting the dependency
  3. Assess the risk and consider continuity solutions such as alternate sources or buffer stock Correct answer.
  4. Rely on verbal assurances from the supplier's sales team

Explanation

Supply chain dependencies are part of risk assessment and strategy selection, and the organization must decide how to protect prioritized activities. A supplier's certification may reduce some risk but does not eliminate the organization's need for its own contingency arrangements.

Question 43Business continuity management system requirements

What is the correct sequence of core BCMS activities after scope is defined?

  1. Risk assessment, plan development, business impact analysis, strategy selection
  2. Plan development, risk assessment, business impact analysis, strategy selection
  3. Business impact analysis, risk assessment, strategy selection, plan development Correct answer.
  4. Strategy selection, plan development, risk assessment, business impact analysis

Explanation

Impact analysis and risk assessment establish priorities and threats, and their outputs drive the selection of continuity solutions, which are then documented in plans. Reversing these steps would leave strategies and plans without an analytical basis.

Question 44Business continuity management system requirements

Which action best demonstrates top management commitment during a real disruption?

  1. Providing resources and making decisions consistent with the continuity policy Correct answer.
  2. Delegating all decisions to the facility security guard
  3. Waiting for the next scheduled management review to respond
  4. Commissioning a new BIA before any response begins

Explanation

Leadership commitment is shown through visible direction, resource provision and decisions aligned with the continuity policy during incidents. Response does not wait for periodic review cycles, and authority should rest with competent, designated people.

Question 45Business continuity management system requirements

An exercise reveals that the call tree failed because contact details were outdated. What is the most appropriate corrective action?

  1. Remove the call tree from the plan to avoid future failures
  2. Blame the individuals whose numbers changed
  3. Update contact data, define a maintenance routine and retest the communication arrangement Correct answer.
  4. Close the finding because the plan was still activated

Explanation

Exercises are intended to surface weaknesses that feed the improvement process. Corrective action should address the root cause through data maintenance and verification, and effectiveness should be confirmed by retesting.

Question 46Business continuity management system requirements

What does the standard require regarding documented information for the BCMS?

  1. It must be stored only in paper form for evidentiary reasons
  2. It must be approved by an external certification body before use
  3. It must be controlled, available where needed and protected as appropriate to its use Correct answer.
  4. It must be retained permanently regardless of legal or business need

Explanation

Documented information must be controlled to ensure it is available and suitable for use, and protected from loss of integrity, confidentiality or availability. Retention periods are determined by the organization's needs and obligations, not by a blanket rule.

Question 47Business continuity management system requirements

How should internal audit be used within the BCMS?

  1. To replace management review by reporting directly to customers
  2. To provide objective evidence on whether the BCMS conforms and is effectively implemented Correct answer.
  3. To certify suppliers against ISO 22301
  4. To write the continuity plans on behalf of operational teams

Explanation

Internal audit is a planned, objective evaluation of conformity and effectiveness that feeds the improvement cycle. It does not substitute for management review, and it is not a supplier certification or plan-writing service.

Question 48Business continuity management system requirements

A management review identifies that recovery objectives are no longer aligned with business priorities. What should follow?

  1. A revision of the policy statement only
  2. Decisions and actions on changes needed to the BCMS, with follow-up on their implementation Correct answer.
  3. Referral of the issue to the next audit cycle without action
  4. Immediate withdrawal from the certification scheme

Explanation

Management review outputs include decisions related to improvement opportunities and changes to the BCMS, including resource needs. Tracking implementation of those decisions closes the loop between review and improvement.

Question 49Business continuity management system requirements

What is the role of a business continuity awareness programme?

  1. Certifying staff as internal auditors of the BCMS
  2. Replacing competence requirements for continuity roles
  3. Transferring accountability for continuity to each individual employee
  4. Ensuring personnel understand the policy and their contribution to continuity effectiveness Correct answer.

Explanation

Awareness activities ensure people know the continuity policy, their relevant roles and how they contribute to the effectiveness of the BCMS. Competence and accountability requirements remain separate and are not satisfied by awareness alone.

Question 50Business continuity management system requirements

An organization outsources its data centre and help desk. How does ISO 22301 treat these outsourced processes?

  1. They are controlled only if the provider holds the same certification
  2. They are excluded from risk assessment to avoid duplication
  3. The organization remains accountable and must control them within the BCMS scope Correct answer.
  4. They fall outside the BCMS because another legal entity performs them

Explanation

Outsourced processes that affect continuity performance must be controlled and are part of the organization's BCMS accountability. Certification status of a provider may inform assurance but does not remove the need for control.