I85PREP
⌘ K
PECB ISO 22301 Foundation study materials
PECB ISO 22301 Foundation study resources

PECB ISO 22301 Foundation practice questions

One question at a time. Build your PECB ISO 22301 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a business continuity management system

In ISO 22301, what does the term "business continuity management system" (BCMS) primarily describe?

  1. An insurance contract that reimburses losses caused by disruptive incidents
  2. A documented set of interrelated processes used to establish continuity policy, objectives, and arrangements to protect prioritized activities Correct answer.
  3. A software platform that automatically restores servers after a data center outage
  4. A one-time recovery plan stored offline and activated only by the board

Explanation

A BCMS is a management system, meaning a set of interrelated or interacting elements of an organization used to establish policy and objectives and to achieve those objectives. In ISO 22301 this covers governance, planning, support, operation, evaluation, and improvement rather than a single plan or tool.

Question 2Fundamental principles and concepts of a business continuity management system

Which statement best reflects the process approach underlying a BCMS?

  1. Each department works independently on its own continuity arrangements
  2. Continuity results are achieved mainly through individual heroics during incidents
  3. Continuity is achieved by documenting every procedure in maximum detail
  4. Interrelated activities are managed as a system to produce intended outcomes consistently Correct answer.

Explanation

The process approach means managing interrelated activities and their inputs and outputs as a system to achieve intended results consistently and effectively. It emphasizes interaction and overall system performance rather than isolated departmental efforts.

Question 3Fundamental principles and concepts of a business continuity management system

According to ISO 22301 terminology, what is a "disruption"?

  1. An anticipated, scheduled change to a critical service
  2. A planned maintenance window agreed with customers
  3. An incident that is not anticipated and disrupts operations Correct answer.
  4. A routine performance degradation within agreed tolerances

Explanation

In ISO 22301 usage, a disruption is an incident, anticipated or unanticipated, that causes an unplanned negative deviation from expected service or activity levels. The key element is the unplanned, negative deviation from what was expected.

Question 4Fundamental principles and concepts of a business continuity management system

What is the primary purpose of a business impact analysis (BIA) within a BCMS?

  1. To list every supplier contract held by the organization
  2. To identify prioritized activities and the consequences of their disruption over time Correct answer.
  3. To assign disciplinary responsibility after an incident
  4. To calculate the annual insurance premium for each site

Explanation

The BIA identifies activities that support the delivery of products and services and assesses the impact of their disruption over time. Its results underpin prioritization and the setting of recovery objectives.

Question 5Fundamental principles and concepts of a business continuity management system

In ISO 22301, what does "maximum acceptable outage" (MAO) express?

  1. The longest time the organization can tolerate before an activity's disruption causes unacceptable impact Correct answer.
  2. The contractual notice period for terminating supplier agreements
  3. The time needed to fully rebuild the primary data center
  4. The total duration of the last recorded incident

Explanation

MAO, also called maximum tolerable period of disruption, is the maximum time an activity can be unavailable before its impact becomes unacceptable. Recovery objectives must be set within this tolerance.

Question 6Fundamental principles and concepts of a business continuity management system

What distinguishes a business continuity plan (BCP) from a business continuity management system (BCMS)?

  1. The BCP is a documented response arrangement, while the BCMS is the broader management system governing it Correct answer.
  2. The BCP applies only to IT staff while the BCMS applies only to executives
  3. They are identical terms and can always be used interchangeably
  4. The BCP is the governing framework while the BCMS is a single response document

Explanation

A BCP is one documented element describing how the organization responds to and recovers from disruption. The BCMS is the wider management system of policy, processes, roles, and improvement that establishes and maintains such plans.

Question 7Fundamental principles and concepts of a business continuity management system

Which pair correctly matches ISO 22301 terms with their meanings?

  1. Maximum acceptable outage: the point in time when backups must be restored
  2. Recovery time objective: the maximum tolerable impact before an outage becomes unacceptable
  3. Business continuity: the ability to continue delivery of products or services at acceptable predefined levels Correct answer.
  4. Recovery point objective: the amount of data loss measured in time that can be tolerated

Explanation

ISO 22301 defines business continuity as the capability of an organization to continue the delivery of products or services at acceptable predefined levels following a disruption. The other pairings mix up the definitions of RTO, RPO, and MAO.

Question 8Fundamental principles and concepts of a business continuity management system

Which of the following is a fundamental principle of a well-functioning BCMS?

  1. Continuity should be owned exclusively by a dedicated specialist team
  2. Continuity exercises should be avoided to prevent operational disturbance
  3. Top management should provide leadership and commitment to the system Correct answer.
  4. Documentation should be minimized so that nothing is written down

Explanation

Leadership and commitment from top management is a core principle, ensuring continuity is integrated with strategy and direction. ISO 22301 places this expectation in the leadership requirements of the management system.

Question 9Fundamental principles and concepts of a business continuity management system

An organization states that its order fulfillment activity must resume within 12 hours of a disruption because customer penalties escalate sharply after that point. Which concept does the 12-hour figure most directly represent?

  1. The maximum acceptable outage for order fulfillment Correct answer.
  2. The service level agreement term for supplier deliveries
  3. The retention period for archived order records
  4. The recovery point objective for the order database

Explanation

The 12-hour figure is the point beyond which impact becomes unacceptable, which is the maximum acceptable outage. Recovery objectives for the activity must then be set within that tolerance.

Question 10Fundamental principles and concepts of a business continuity management system

During a BIA workshop, a team argues that payroll is critical because staff would complain. How should the analyst apply ISO 22301 concepts to reach a defensible prioritization?

  1. Accept the argument because staff satisfaction always outranks other impacts
  2. Prioritize the activity with the largest department headcount
  3. Assess the time-based operational, financial, legal, and reputational consequences of disrupting payroll Correct answer.
  4. Defer prioritization until an actual disruption occurs

Explanation

Prioritization under ISO 22301 rests on assessed consequences of disruption over time across categories such as operational, financial, legal, and reputational impact. Emotional arguments are replaced by evidence of time-based impact.

Question 11Fundamental principles and concepts of a business continuity management system

A bank sets its recovery time objective for online payments at 4 hours, but its BIA shows the maximum acceptable outage is 2 hours. What is the most accurate conclusion?

  1. The MAO should be increased to match the RTO
  2. The arrangement is acceptable because RTO and MAO are unrelated measures
  3. The RTO exceeds the tolerance, so recovery capability must be improved or the impact assessment revisited Correct answer.
  4. The BIA should be discarded because it conflicts with the technical target

Explanation

The recovery time objective must sit within the maximum acceptable outage, otherwise recovery would occur after impact has already become unacceptable. A mismatch signals a need to strengthen capability or to re-examine the impact assessment with evidence.

Question 12Fundamental principles and concepts of a business continuity management system

Which statement correctly describes the relationship between risk assessment and business impact analysis in a BCMS?

  1. Risk assessment is performed only after a disruption has occurred
  2. The BIA replaces risk assessment entirely in ISO 22301
  3. Risk assessment evaluates likelihood and consequences of threats and vulnerabilities, while the BIA evaluates consequences of disrupting activities over time Correct answer.
  4. They are the same activity performed with different job titles

Explanation

Risk assessment examines threats, vulnerabilities, and resulting likelihood and consequences, informing the selection of treatments. The BIA works from the activity perspective, quantifying how impact grows over time and setting prioritization and recovery objectives.

Question 13Fundamental principles and concepts of a business continuity management system

A newly appointed continuity manager wants to embed the BCMS into daily operations. Which action best reflects the principle of integration in ISO 22301?

  1. Keep continuity work in a separate unit isolated from other management systems
  2. Align continuity objectives and processes with the organization's strategic and operational management processes Correct answer.
  3. Run continuity activities only when an audit is announced
  4. Outsource all continuity decisions to an external consultancy permanently

Explanation

Integration means the BCMS is embedded into the organization's business processes and aligned with its overall strategic direction and other management systems. Isolation or episodic activity undermines that principle.

Question 14Fundamental principles and concepts of a business continuity management system

What role does "acceptable predefined levels" play in the ISO 22301 definition of business continuity?

  1. It refers only to financial thresholds set by regulators
  2. It means all products and services must be delivered at full capacity at all times
  3. It allows any level of service to be declared acceptable after an incident
  4. It requires continuity to be judged against targets agreed in advance rather than improvised during disruption Correct answer.

Explanation

The definition ties continuity to predefined acceptable levels, meaning the organization decides in advance what service level must be maintained or restored. This prevents improvised, arbitrary standards during an incident.

Question 15Fundamental principles and concepts of a business continuity management system

A logistics firm discovers that its only fuel supplier is located in a flood-prone area. Which BCMS principle does this finding most directly relate to?

  1. The principle that continuity is solely an IT responsibility
  2. The need to reduce documentation to a minimum
  3. The requirement to hold exercises only annually
  4. Understanding the organization's context and dependencies, including supply chain exposure Correct answer.

Explanation

ISO 22301 requires the organization to understand its context, including internal and external issues and the dependencies on suppliers and partners. Concentration risk in a flood-prone supplier is a context and dependency finding that shapes continuity strategy.

Question 16Fundamental principles and concepts of a business continuity management system

Which outcome best demonstrates that a BCMS is delivering its intended result rather than merely existing on paper?

  1. Prioritized activities with recovery objectives that have been validated through exercises and improved over time Correct answer.
  2. An annual purchase of continuity software licenses
  3. A signed policy that has never been communicated to staff
  4. A complete set of documents stored in a shared drive

Explanation

Effectiveness is shown when arrangements are based on analysis, tested through exercises, and improved through evaluation. Documents or purchases alone do not demonstrate that continuity capability actually works.

Question 17Fundamental principles and concepts of a business continuity management system

What is the correct meaning of "recovery point objective" in ISO 22301 practice?

  1. The deadline for notifying regulators of an incident
  2. The point in time to which data must be restored, defining tolerable data loss Correct answer.
  3. The target time by which an activity must be resumed after disruption
  4. The maximum impact an organization can absorb financially

Explanation

The recovery point objective defines how far back in time data must be recoverable, expressed as the tolerable amount of data loss measured in time. It is distinct from the recovery time objective, which concerns resumption time.

Question 18Fundamental principles and concepts of a business continuity management system

A manager proposes that the organization's continuity strategy should rely on staff working from home, but no assessment has been made of home network capacity or critical system access. Which principle is being overlooked?

  1. The requirement for a documented continuity policy
  2. The need for management review minutes
  3. Evidence-based decisions about the viability of continuity solutions Correct answer.
  4. Continual improvement of the BCMS

Explanation

Choosing a solution without assessing whether it can actually deliver recovery within objectives contradicts evidence-based planning. ISO 22301 expects solutions to be evaluated for feasibility and effectiveness before being adopted.

Question 19Fundamental principles and concepts of a business continuity management system

How does ISO 22301 treat the concept of "continual improvement" within the BCMS?

  1. It is a one-time project completed before certification
  2. It is an ongoing process using evaluation results to enhance continuity performance Correct answer.
  3. It applies only to correcting typographical errors in plans
  4. It is optional and can be excluded from the management system

Explanation

Continual improvement is a recurring management system process in which performance is evaluated and arrangements are enhanced over time. It draws on monitoring, exercises, audits, and management review to drive change.

Question 20Fundamental principles and concepts of a business continuity management system

Which statement about the scope of a BCMS is most consistent with ISO 22301?

  1. Scope is defined by the organization based on its context, obligations, and the products and services it provides Correct answer.
  2. Scope must cover every country in which any customer resides
  3. Scope is fixed by the certification body without organizational input
  4. Scope should exclude all activities that are outsourced

Explanation

The organization determines the scope of its BCMS considering external and internal issues, compliance obligations, and the nature of its products, services, and activities. It must be documented and available.

Question 21Fundamental principles and concepts of a business continuity management system

A BIA reveals that a warehouse fire would halt distribution, and the risk assessment shows the fire is unlikely but catastrophic. Which conclusion follows from applying both analyses together?

  1. The risk assessment should override the BIA and remove the activity from scope
  2. Continuity arrangements should address the high-consequence scenario even where likelihood is low Correct answer.
  3. The activity should be ignored because the threat is unlikely
  4. Only high-likelihood threats deserve continuity planning

Explanation

Low likelihood does not neutralize catastrophic consequence; the combination of BIA impact and risk assessment informs proportionate treatment. Continuity arrangements must be able to address high-consequence scenarios regardless of frequency.

Question 22Fundamental principles and concepts of a business continuity management system

An auditor finds that the organization's continuity objectives exist but no measures are tracked and no results feed management review. Which principle of the BCMS is most directly compromised?

  1. Supplier contract management
  2. The definition of maximum acceptable outage
  3. The process approach to documentation control
  4. Performance evaluation and evidence-based decision making Correct answer.

Explanation

Objectives must be measurable and monitored, with results evaluated and used as inputs to management review. Without measurement and feedback, the system cannot demonstrate effectiveness or drive decisions.

Question 23Fundamental principles and concepts of a business continuity management system

Two departments claim the same activity is their responsibility, and neither has tested its recovery arrangements. Which BCMS principle is most clearly absent?

  1. The principle of outsourcing all recovery tasks
  2. The requirement to minimize documented information
  3. The use of financial hedging as the primary continuity strategy
  4. Clear assignment of roles, responsibilities, and authorities combined with validation of arrangements Correct answer.

Explanation

ISO 22301 requires roles, responsibilities, and authorities to be assigned and communicated, and arrangements to be validated through exercising. Overlapping, untested ownership leaves the activity effectively unmanaged during disruption.

Question 24Fundamental principles and concepts of a business continuity management system

An organization achieves its recovery time objective during an exercise but only by bypassing a required regulatory control. How should this result be interpreted under BCMS principles?

  1. The RTO should be shortened to compensate
  2. The regulatory control should be permanently waived during incidents
  3. The arrangement is not acceptable because recovery must also satisfy compliance obligations Correct answer.
  4. The exercise was successful because the time target was met

Explanation

Continuity solutions must respect the organization's compliance and legal obligations, which are part of its context and requirements. Meeting a time target by breaching a required control means the solution is not viable as designed.

Question 25Fundamental principles and concepts of a business continuity management system

A board asks why the BCMS should not simply be a large binder of procedures. Which response best captures the ISO 22301 philosophy?

  1. The binder matters more than leadership commitment
  2. The binder is sufficient if it is long enough and signed by the chief executive
  3. The BCMS is a living management system whose processes must be planned, operated, evaluated, and improved, with documentation only as needed Correct answer.
  4. Documentation is prohibited in a certified BCMS

Explanation

ISO 22301 follows the plan-do-check-act logic of management systems, so the BCMS must be operated and improved rather than merely documented. Documentation is required where necessary for effectiveness but is not the system itself.

Question 26Fundamental principles and concepts of a business continuity management system

In ISO 22301, what does the term "disruption" refer to within the BCMS framework?

  1. An anticipated event that, if it occurred, could cause loss and which is analysed during risk assessment
  2. An incident, whether anticipated or unanticipated, that causes an unplanned negative deviation from expected delivery of products or services Correct answer.
  3. A documented procedure describing how staff should evacuate a building during an emergency
  4. A contractual clause requiring a supplier to maintain service levels during peak demand

Explanation

ISO 22301 defines disruption as an incident, anticipated or not, that causes an unplanned negative deviation from the expected delivery of products and services according to the organization's objectives. It is an outcome that has occurred, not a potential source of harm, and it is broader than an emergency or evacuation scenario.

Question 27Fundamental principles and concepts of a business continuity management system

Which statement best captures the meaning of "business continuity" as defined in ISO 22301?

  1. The periodic testing of fire suppression equipment in an organization's primary data centre
  2. The ability of an organization to continue the delivery of products or services at acceptable predefined levels following a disruption Correct answer.
  3. The process of restoring all information technology systems to their original configuration after a failure
  4. The complete elimination of all risks that could interrupt an organization's critical activities

Explanation

Business continuity is defined as the ability of an organization to continue the delivery of products and services at acceptable predefined levels following a disruption. The emphasis on predefined levels means the organization decides in advance what performance is tolerable rather than promising zero interruption.

Question 28Fundamental principles and concepts of a business continuity management system

What is the primary purpose of a business impact analysis within a BCMS?

  1. To identify and evaluate the effects of a disruption over time on the organization's activities and their dependencies Correct answer.
  2. To list every conceivable threat and assign each a financial loss estimate
  3. To determine which legal regulations apply to the organization's products
  4. To record the training records of staff who will form the crisis management team

Explanation

A BIA analyses how the effects of a disruption develop over time and identifies the activities and dependencies whose loss matters most. It focuses on consequences and time sensitivity rather than on cataloguing threats, which belongs to risk assessment.

Question 29Fundamental principles and concepts of a business continuity management system

In ISO 22301 terminology, what does a "maximum acceptable outage" represent?

  1. The longest period an activity may remain unavailable before its loss becomes unacceptable to the organization Correct answer.
  2. The total downtime recorded across all incidents in the previous financial year
  3. The time a supplier is contractually allowed to take when responding to a support ticket
  4. The interval between two successive full backups of the organization's core database

Explanation

Maximum acceptable outage, also called maximum tolerable period of disruption, is the duration after which the loss of an activity would breach acceptable impact levels. It is derived from impact analysis and sets the upper bound within which recovery must occur.

Question 30Fundamental principles and concepts of a business continuity management system

Which element belongs to the "Plan" phase of the Plan-Do-Check-Act cycle as applied to a BCMS?

  1. Establishing business continuity policy, objectives and processes Correct answer.
  2. Delivering awareness training to staff on their continuity roles
  3. Conducting an internal audit of continuity arrangements
  4. Reviewing management review outputs for corrective action

Explanation

In the PDCA model used by ISO 22301, Plan covers establishing the policy, objectives, targets, controls and processes needed to deliver results consistent with the organization's overall policies. Auditing, training delivery and reviewing results all occur in later phases.

Question 31Fundamental principles and concepts of a business continuity management system

Which statement describes the role of top management under ISO 22301?

  1. Top management demonstrates leadership by establishing policy, ensuring resources and integrating BCMS requirements into business processes Correct answer.
  2. Top management limits its involvement to signing the business continuity plan once it is complete
  3. Top management assigns continuity solely to the IT department because most disruptions are technical
  4. Top management delegates all continuity decisions to an external consultant and reviews outcomes annually

Explanation

ISO 22301 places leadership and commitment with top management, which must establish the policy, ensure resources are available and integrate BCMS requirements into the organization's processes. Leadership is an active, continuing responsibility rather than a one-off endorsement.

Question 32Fundamental principles and concepts of a business continuity management system

What is an "interested party" in the context of a BCMS?

  1. A competitor that benchmarks the organization's published continuity arrangements
  2. A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  3. A regulator that has issued the organization a licence to operate
  4. An employee who has been formally designated as a continuity coordinator

Explanation

An interested party is any person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. The definition is deliberately broad and includes parties whose perception alone makes them relevant to the BCMS.

Question 33Fundamental principles and concepts of a business continuity management system

Which pair of terms is used in ISO 22301 to express the time available for resuming an activity and the point to which data must be restored?

  1. Business continuity plan and business continuity management system
  2. Recovery time objective and recovery point objective Correct answer.
  3. Incident response and crisis communication
  4. Maximum acceptable outage and business impact analysis

Explanation

The recovery time objective states the target time to resume an activity or resource after disruption, while the recovery point objective states the point to which information must be recovered. Together they translate impact analysis results into measurable recovery targets.

Question 34Fundamental principles and concepts of a business continuity management system

During a risk assessment a team identifies a possible cyber attack on the order system. Which combination of factors should be used to prioritise this risk for treatment?

  1. The cost of the risk register software and the size of the audit team
  2. The name of the risk owner and the date of the last management review
  3. The number of staff trained in the previous year and the age of the building
  4. The likelihood of the event and the severity of its consequences Correct answer.

Explanation

Risk is prioritised by combining the likelihood of an event with the severity of its consequences, so that treatment effort is directed where exposure is greatest. Neither factor alone gives a reliable priority.

Question 35Fundamental principles and concepts of a business continuity management system

An organization's continuity objectives state that the payment service must be restored within six hours, but no one measures restoration times and exercises are not recorded. Which requirement of the BCMS is most clearly unmet?

  1. Determining the scope of the BCMS
  2. Evaluating business continuity performance and the effectiveness of the BCMS Correct answer.
  3. Establishing the context of the organization
  4. Identifying legal and regulatory requirements

Explanation

Setting objectives is only meaningful when performance against them is monitored, measured and evaluated, which is the Check element of the BCMS. The absence of measurement and exercise records shows the evaluation of continuity performance is not functioning.

Question 36Fundamental principles and concepts of a business continuity management system

A continuity manager wants to ensure the BCMS reflects the organization's internal and external context. Which action is most consistent with ISO 22301?

  1. Postpone context analysis until after the first certification audit
  2. Copy the continuity plan of a similar organization in the same industry
  3. Identify internal and external issues, legal requirements and interested party needs relevant to continuity Correct answer.
  4. Restrict the BCMS scope to the IT department to simplify documentation

Explanation

Context analysis requires the organization to determine external and internal issues, applicable requirements and the needs of interested parties that are relevant to its continuity capability. This evidence then informs scope, risk assessment and strategy.

Question 37Fundamental principles and concepts of a business continuity management system

What distinguishes a business continuity strategy from a business continuity plan?

  1. The strategy is written by external auditors, while the plan is written by the chief executive
  2. The strategy applies only to IT systems, while the plan applies only to people
  3. The strategy selects the arrangements for protecting prioritized activities, while the plan documents how the organization will respond and recover Correct answer.
  4. The strategy is optional under ISO 22301, while the plan is mandatory

Explanation

Strategy development decides which arrangements, such as alternate sites, resource redundancy or supplier options, will protect prioritized activities and their dependencies. The plan then translates those decisions into documented roles, actions and communications for response and recovery.

Question 38Fundamental principles and concepts of a business continuity management system

An exercise reveals that the crisis management team could not be reached because contact details were outdated. Which type of improvement does this most directly indicate?

  1. A revision of the risk criteria used to score suppliers
  2. A change to the organization's scope statement
  3. A corrective action to update and control communication arrangements Correct answer.
  4. A need to revise the business impact analysis methodology

Explanation

Outdated contact details are a nonconformity in the response arrangements, so the appropriate improvement is a corrective action that updates the information and controls how it is kept current. Exercises are intended to surface exactly this kind of weakness before a real incident.

Question 39Fundamental principles and concepts of a business continuity management system

Which statement best explains why ISO 22301 requires documented information to be controlled?

  1. To increase the volume of records available to certification auditors
  2. To ensure that only current, approved and available information is used where the BCMS needs it Correct answer.
  3. To guarantee that no employee can read continuity documents without management approval
  4. To replace the need for training and awareness activities

Explanation

Control of documented information ensures that information is available and suitable for use wherever the BCMS requires it, and that it is protected from loss, unauthorized change and obsolete versions. Control supports consistency and confidence in the arrangements rather than restricting access for its own sake.

Question 40Fundamental principles and concepts of a business continuity management system

A supplier provides the only component used in a prioritized activity, and the organization has no alternative source. How should this dependency be treated in the BCMS?

  1. Rely on the supplier's own certification as sufficient assurance
  2. Remove the activity from scope so the dependency no longer applies
  3. Ignore it because supplier failures are outside the organization's control
  4. Record it as a single point of failure and develop a strategy such as an alternate source or buffer stock Correct answer.

Explanation

Dependencies on single suppliers are identified during business impact analysis and risk assessment and must be addressed through a continuity strategy such as dual sourcing, stock buffers or contractual assurances. Acknowledging the dependency without acting leaves the prioritized activity exposed.

Question 41Fundamental principles and concepts of a business continuity management system

Which outcome best shows that a BCMS is embedded in the organization's culture rather than maintained as a separate project?

  1. Continuity responsibilities appear in job descriptions and staff routinely apply procedures during normal operations Correct answer.
  2. Continuity exercises are conducted once, shortly after the system is implemented
  3. A dedicated continuity team keeps all documentation in a locked cabinet
  4. The BCMS is reviewed only when a certification audit is scheduled

Explanation

Embedding means continuity roles, procedures and thinking are part of everyday work, reflected in job descriptions and routine practice. A system that lives only in a separate team or awakens for audits is not integrated into the organization's processes.

Question 42Fundamental principles and concepts of a business continuity management system

What is the purpose of the management review within a BCMS?

  1. To certify the organization against ISO 22301
  2. To replace internal audit by having managers inspect each other's work
  3. To assess the continuing suitability, adequacy and effectiveness of the BCMS and decide on improvement actions Correct answer.
  4. To approve the annual budget of the continuity department

Explanation

Management review is a top-management activity that evaluates whether the BCMS remains suitable, adequate and effective and results in decisions on improvement and resource needs. It draws on inputs such as audit results, performance data and changes in context.

Question 43Fundamental principles and concepts of a business continuity management system

An organization defines a recovery time objective of eight hours for a critical service but its recovery strategy depends on a single backup site that takes two days to activate. What does this indicate?

  1. The discrepancy is acceptable because the site is owned by the organization
  2. The strategy is inconsistent with the recovery objective and must be redesigned or the objective reconsidered Correct answer.
  3. The objective should be deleted because strategies always determine the target
  4. The backup site should be removed from the BCMS scope

Explanation

Recovery objectives derived from impact analysis must be achievable with the chosen strategy, so a two-day activation cannot meet an eight-hour target. The organization must either redesign the strategy, for example with a warmer site or alternate arrangements, or revisit the objective through impact analysis.

Question 44Fundamental principles and concepts of a business continuity management system

Which activity belongs to the "Do" phase of the PDCA cycle in a BCMS?

  1. Implementing business continuity strategies and exercising the arrangements Correct answer.
  2. Determining the internal and external issues affecting the BCMS
  3. Reviewing audit findings and deciding on corrective actions
  4. Monitoring and measuring continuity performance against objectives

Explanation

The Do phase covers implementation and operation, including putting strategies and plans into effect, running exercises and maintaining awareness. Monitoring, review and context determination belong to other phases of the cycle.

Question 45Fundamental principles and concepts of a business continuity management system

A business impact analysis shows that a distribution centre must resume within 24 hours. The risk assessment shows a flood affecting that site is rare but would cause severe damage. Which conclusion is most appropriate?

  1. The distribution centre should be excluded from the BIA because the event is natural
  2. Because the flood is rare, no continuity arrangement is needed for the distribution centre
  3. The short tolerance combined with severe consequences justifies investment in an alternate distribution arrangement Correct answer.
  4. The risk assessment should be repeated until the flood likelihood is rated higher

Explanation

Continuity decisions combine the impact analysis tolerance with the risk assessment outcome, so a short maximum acceptable outage and severe consequences justify proportionate investment even when likelihood is low. Low probability does not neutralize a consequence the organization cannot tolerate.

Question 46Fundamental principles and concepts of a business continuity management system

A continuity manager proposes relying on staff working from home during a disruption, but no assessment has confirmed that home connectivity, data access controls and home-working capacity can support prioritized activities. What is the main weakness of this proposal?

  1. Home working is never an acceptable continuity strategy under ISO 22301
  2. The proposal duplicates an existing risk assessment and should be removed
  3. The strategy is too costly compared with building a new data centre
  4. The strategy has not been validated against the requirements of the prioritized activities and their dependencies Correct answer.

Explanation

A continuity strategy must be shown to meet the recovery objectives of prioritized activities, accounting for technology, information security and people dependencies. Proposing home working without validating connectivity, access controls and capacity leaves the strategy unproven.

Question 47Fundamental principles and concepts of a business continuity management system

Two departments each assume the other owns the recovery of a shared ordering platform, and neither has tested its arrangements. Which BCMS principle does this situation most directly violate?

  1. The principle that continuity roles, responsibilities and authorities must be clearly defined and communicated Correct answer.
  2. The principle that all risks must be transferred to insurers
  3. The principle that only senior managers may participate in exercises
  4. The principle that documentation must be stored in a single physical location

Explanation

ISO 22301 requires roles, responsibilities and authorities for continuity to be assigned and understood, so overlapping assumptions leave the shared platform without an accountable owner. Clear ownership is also a precondition for meaningful exercise and improvement.

Question 48Fundamental principles and concepts of a business continuity management system

An organization meets its recovery time objective during an exercise only by bypassing a regulatory reporting obligation. How should the BCMS treat this result?

  1. Record it as an unacceptable trade-off and revise the strategy so recovery respects legal and regulatory requirements Correct answer.
  2. Report the result as fully successful because exercises are not subject to regulation
  3. Remove the regulatory obligation from the exercise scope to avoid conflict
  4. Accept it because the recovery time objective was achieved

Explanation

Continuity strategies must operate within the organization's legal, regulatory and contractual obligations, so meeting a time target by breaching them is not a valid success. The finding should drive a revised strategy that satisfies both the recovery objective and compliance requirements.

Question 49Fundamental principles and concepts of a business continuity management system

An auditor finds that continuity objectives exist but no measures are tracked and no results are fed into management review. Which conclusion is most defensible?

  1. The deficiency is limited to documentation formatting and can be closed without action
  2. The organization cannot demonstrate the effectiveness of its BCMS, so performance evaluation is deficient Correct answer.
  3. The BCMS has fully met its performance evaluation requirements because objectives are documented
  4. The objectives should be removed because measurement is optional under ISO 22301

Explanation

Objectives must be supported by monitoring, measurement, analysis and evaluation, with results feeding management review so effectiveness can be judged. Without tracked measures the organization cannot show whether continuity capability is being achieved, which is a substantive performance evaluation gap.

Question 50Fundamental principles and concepts of a business continuity management system

A board asks why the BCMS should not simply be a large binder of procedures. Which response best reflects the ISO 22301 view of a management system?

  1. A management system is a software platform that stores continuity documents
  2. A management system is a set of interrelated elements, including leadership, planning, support, operation and evaluation, that together deliver continuity capability Correct answer.
  3. A management system is valuable mainly because a larger binder impresses certification auditors
  4. A management system is a collection of procedures that only needs updating after an incident

Explanation

ISO 22301 treats the BCMS as a management system whose interrelated elements, covering leadership, planning, support, operation, performance evaluation and improvement, work together to build continuity capability. Procedures are one output of the system, not its essence.