Question 1

Which step in PDCA Cycle validates improvements?

Accepted Answer

D

Explanation: The act step in the PDCA cycle validates improvements by taking actions to address any gaps, nonconformities, or opportunities for improvement identified in the check step. The act step also involves reviewing the effectiveness of the actions taken and determining whether further improvement is possible or necessary. The act step closes the PDCA cycle and leads to a new plan step for the next cycle of continual improvement. The act step is one of the key requirements of ISO 22301, as it demonstrates the organization’s commitment to enhance its business continuity capability and performance. Reference: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

Question 2

Which team is responsible for determining how the impact of the incident is managed within the policy guidelines set by the strategic team?

Accepted Answer

D

Explanation: The team that is responsible for determining how the impact of the incident is managed within the policy guidelines set by the strategic team is the tactical team. The tactical team is composed of managers or experts who have the authority and competence to make decisions and allocate resources to implement the business continuity plans and strategies. The tactical team coordinates and communicates with the operational team, which is responsible for executing the recovery and restoration activities, and reports to the strategic team, which is responsible for setting the overall direction and objectives of the incident response1. Reference: 1: ISO 22301 Auditing eBook, Chapter 7: Business Continuity Response, Section 7.2: Incident Management Structure, Subsection 7.2.1: Incident Management Teams, Page 103 Thank you for your visit.

Question 3

The actions of the media and press have a profound impact on the long-term performance, or in some cases.

Accepted Answer

A

Explanation: The media and press have a profound impact on the long-term performance, or in some cases, the survival of an organization, especially in the aftermath of a disruptive incident. The media and press can influence the perception and reputation of the organization, as well as the expectations and satisfaction of its stakeholders, such as customers, suppliers, regulators, employees, and the general public. Therefore, it is important for the organization to establish and maintain a positive relationship with the media and press, and to communicate effectively and transparently during and after a crisis. ISO 22301:2019, Clause 8.4.3, requires the organization to establish, implement, and maintain a documented procedure to manage communications with relevant interested parties during a disruptive incident. The procedure should include the identification of the spokesperson(s) who will communicate with the media and press, the preparation of key messages and statements, the approval and distribution of information, and the monitoring and evaluation of the effectiveness of the communications. The organization should also consider the potential legal and ethical implications of its communications, and ensure that the information provided is accurate, consistent, and timely. Reference: ISO 22301:2019, Clause 8.4.3; ISO 22301 Auditing eBook, Chapter 4.3.3.

Question 4

Which strategy supports the recovery needs of each critical product and service?

Accepted Answer

A

Explanation: Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service. This strategy involves the following steps: Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk assessment, identify the possible recovery options for each critical product and service. Recovery options are the alternative ways of resuming the delivery of the product or service within the recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options are: relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup, outsourcing to a third-party provider, etc. Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc. Compare the advantages and disadvantages of each option and rank them according to their suitability for meeting the recovery needs. Select the recovery options: Choose the best recovery option for each critical product and service, based on the evaluation results and the available resources. Ensure that the selected option aligns with the organization’s business continuity objectives, policies, and strategies. Document the rationale and justification for the selection and communicate it to the relevant stakeholders. Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service, as it enables the organization to identify, evaluate, and select the most appropriate recovery option for each critical product and service, based on the BIA and the risk assessment results. This strategy helps the organization to ensure the continuity and resilience of its critical products and services in the event of a disruption, and to optimize the use of its resources and capabilities. Reference: ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4.2: Business Continuity Strategy, Page 19 ISO 22301 Auditing eBook, Chapter 5: Business Continuity Management System Audit Activities, Section 5.3.2: Audit of Business Continuity Strategy, Page 37 ISO 22301:2019, Clause 8.3: Business Continuity Strategies and Solutions, Page 18

Question 5

Which type of management system provide the means for organizations to improve internal controls and management competence?

Accepted Answer

A

Explanation: A formal management system is a type of management system that provides the means for organizations to improve internal controls and management competence. A formal management system is a documented system that defines the policies, objectives, processes, procedures, roles, responsibilities, and resources for managing a specific aspect of the organization’s performance. A formal management system is based on a recognized standard or framework that specifies the requirements and best practices for achieving the desired outcomes and performance. A formal management system also includes mechanisms for monitoring, measuring, reviewing, and improving the system’s effectiveness and efficiency. A formal management system helps the organization to demonstrate its commitment and capability to meet the expectations and needs of its stakeholders, such as customers, regulators, employees, suppliers, etc. A formal management system also helps the organization to identify and manage the risks and opportunities that may affect its performance and continuity. Examples of formal management systems are ISO 22301 for business continuity management, ISO 9001 for quality management, ISO 14001 for environmental management, ISO 27001 for information security management, etc. Reference: ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.1: Management System Concepts1 What is a management system?2 ISO - Management system standards3

Question 6

Which of the following refers to a specific task products or outcomes that are required in order to complete the project?

Accepted Answer

B

Explanation: Deliverables are the specific tasks, products, or outcomes that are required in order to complete the project. They are the tangible and measurable results of the project activities, and they should be aligned with the project objectives and scope. Deliverables can be classified into two types: project deliverables and process deliverables. Project deliverables are the outputs that directly contribute to the achievement of the project goals, such as reports, plans, documents, software, hardware, etc. Process deliverables are the outputs that support the management and execution of the project, such as schedules, budgets, risk assessments, audits, etc. Deliverables should be clearly defined, agreed upon, and accepted by the project stakeholders, and they should be monitored and controlled throughout the project lifecycle. According to ISO 22301, some of the deliverables for implementing a business continuity management system (BCMS) are: business continuity policy, business continuity objectives, business impact analysis, risk assessment and treatment, business continuity strategy, business continuity plans, business continuity procedures, performance indicators, audit reports, corrective actions, etc. Reference: ISO 22301 Auditing eBook, Chapter 3: Planning the BCMS, Section 3.1: Project Management, page 39. ISO 22301 Auditing eBook, Chapter 3: Planning the BCMS, Section 3.2: Project Deliverables, page 40.

Question 7

Which phase determines potential issues pertaining to the management of the BCMS?

Accepted Answer

C

Explanation: The Check phase of the PDCA cycle is the phase that determines potential issues pertaining to the management of the BCMS. The Check phase involves monitoring and evaluating the performance and effectiveness of the BCMS and identifying any gaps, nonconformities, risks, or opportunities for improvement. The Check phase also involves collecting and analyzing data and information related to the BCMS, such as the results of audits, reviews, tests, exercises, surveys, and feedback. The Check phase provides valuable input for the Act phase, where corrective and preventive actions are taken to address the issues and improve the BCMS. Reference: : ISO 22301 Auditing eBook, page 11 : ISO 22301:2019, clause 9.1 : Business continuity and ISO 22301 - Qudos : ISO 22313:2020(en), Security and resilience ? Business continuity …

Question 8

Corporate Services and Information Technology are the functions that provide a range of physical and technological infrastructure services to all other functions.

Accepted Answer

A

Explanation: Corporate Services and Information Technology are the functions that provide a range of physical and technological infrastructure services to all other functions, such as human resources, finance, legal, procurement, facilities, security, IT systems, networks, applications, databases, etc. These functions are essential for the continuity of the organization’s operations, as they support the delivery of products and services to customers and stakeholders. Therefore, they need to be included in the scope and objectives of the business continuity management system (BCMS), and their roles and responsibilities need to be defined and communicated. Reference: ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.1: Scope and Objectives, page 23.

Question 9

Which communication structure should be established for managing information between various groups of stakeholders in the organization?

Accepted Answer

B

Explanation: According to ISO 22301 Lead Auditor objectives and content, the communication structure for managing information between various groups of stakeholders in the organization should include both internal and external communication. Internal communication refers to the exchange of information and messages within the organization, such as between employees, managers, and business continuity teams. External communication refers to the exchange of information and messages with parties outside the organization, such as customers, suppliers, regulators, media, and the public. Both types of communication are essential for ensuring the effective operation of the business continuity management system (BCMS) and the successful response and recovery from disruptions. The communication structure should be aligned with the organization’s communication strategy, which should identify the communication needs, define the communication channels, and establish the communication procedures for the BCMS. The communication structure should also consider the unique communication requirements that may arise during a disruption, such as timely and accurate information, alternative communication channels, and managing rumours and misinformation. Reference: ISO 22301 Auditing eBook, page 291; ISO 22301 Clause 7.4 Communication2

Question 10

The knowledge of BCM and its methodology relates to Technical expertise.

Accepted Answer

B

Explanation: The knowledge of BCM and its methodology is not related to technical expertise, but to domain expertise. Technical expertise refers to the knowledge and skills related to the audit process, such as audit principles, procedures, techniques, and tools. Domain expertise refers to the knowledge and skills related to the specific field of the audit, such as BCM concepts, terms, definitions, requirements, and best practices. Reference: ISO 22301 Auditing eBook, page 11; ISO 19011:2018, clause 7.2.2

Question 11

The Do phase in PDCA cycle consists of of operation

Accepted Answer

A

Explanation: The Do phase in the PDCA cycle consists of operation, which means implementing and operating the business continuity policy, controls, processes, and procedures that have been planned in the previous phase. The Do phase also involves establishing the necessary resources, competencies, awareness, communication, and documentation to support the effective operation of the business continuity management system (BCMS). The Do phase aims to ensure that the organization is prepared to respond to and recover from disruptive incidents in a timely and effective manner. Reference: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.

Question 12

Which of the following document is owned by executive management and sets the purpose of BCM in an organisation?

Accepted Answer

A

Explanation: The document that is owned by executive management and sets the purpose of BCM in an organization is the Business Continuity Policy. The Business Continuity Policy is a high-level document that defines the scope, objectives, principles, and roles and responsibilities for business continuity management within the organization. It also demonstrates the commitment of top management to support and continually improve the BCMS. The Business Continuity Policy is one of the mandatory documents required by ISO 22301, the international standard for BCMS12. The other options are not correct because they are not documents that are owned by executive management and set the purpose of BCM in an organization. A Business Process Policy is a document that describes the procedures and rules for performing a specific business process, such as procurement, sales, or accounting. A Register is a document that records and tracks the status of certain items, such as risks, incidents, or assets. A Worksheet is a document that contains data and calculations, such as a spreadsheet or a form. Reference: 1: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 5.3 2: ISO 22301 Auditing eBook, Chapter 2.2.2

Question 13

Which of the following defines the area of operation in which the task and its activities should be performed?

Accepted Answer

A

Explanation: Scope is the term that defines the area of operation in which the task and its activities should be performed, as described in ISO 22301. Scope is one of the key elements of a business continuity plan (BCP), which is a documented information that specifies the procedures and resources needed to manage a disruptive incident and ensure the continuity of the organization’s critical functions. Scope helps to define the boundaries and applicability of the BCP, as well as the roles and responsibilities of the involved parties. Scope also helps to ensure the consistency and compatibility of the BCP with the organization’s business continuity objectives and strategies. Scope is one of the key requirements of ISO 22301, as it provides the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). Reference: ISO 22301 Auditing eBook, page 36 1; ISO 22301:2019, clause 8.4.2 2

Question 14

Which step clarifies the requirements with business leads?

Accepted Answer

A

Explanation: The clarify and confirm step is the first step of the audit planning process, where the auditor clarifies the requirements with the business leads, such as the audit client, the auditee, and the audit team. The purpose of this step is to ensure that the audit objectives, scope, criteria, and deliverables are clearly defined, understood, and agreed upon by all the parties involved. The clarify and confirm step also involves the identification of the audit risks, opportunities, and resources, as well as the establishment of the audit communication channels and protocols. The clarify and confirm step is essential to ensure that the audit is aligned with the expectations and needs of the stakeholders, and that the audit is feasible, effective, and efficient. Reference: PECB Certified ISO 22301 Lead Auditor eLearning Training Course1, Module 4: Preparation of an ISO 22301 audit, Lesson 4.1: Audit planning, Slide 5: Audit planning process ISO 22301 Auditing eBook2, Chapter 4: Preparation of an ISO 22301 audit, Section 4.1: Audit planning, Subsection 4.1.1: Clarify and confirm

Question 15

Most government policies have direct influences on how organizations shape their business strategies and plans.

Accepted Answer

A

Explanation: Most government policies have direct influences on how organizations shape their business strategies and plans, as they affect the legal, regulatory, economic, and social environment in which the organizations operate. Government policies can create opportunities or threats for the organizations, depending on their nature and impact. For example, government policies can affect the taxation, trade, security, environmental, and human rights aspects of the organizations’ activities. Therefore, organizations need to monitor and analyze the government policies that are relevant to their business objectives and interests, and adapt their business strategies and plans accordingly. This is also important for the business continuity management system (BCMS), as it helps the organizations to identify and address the risks and opportunities related to the government policies, and to ensure the compliance and resilience of their BCMS. Reference: ISO 22301 Auditing eBook, page 13 1; ISO 22301:2019, clause 4.1 2

Free PECB ISO-22301-Lead-Auditor Actual Exam Questions