DRI CBCLA Certified Business Continuity Lead Auditor

Which ISO standard provides the primary guidance framework for planning, conducting, reporting, and following up audits of management systems, including a business continuity management system?

• AISO 22301
• BISO 19011
• CISO 17021
• DISO 31000

A lead auditor is setting up the audit programme for a three-year BCMS certification cycle. According to ISO 19011, which factor should MOST influence the audit frequency for each auditee?

• AThe number of auditors available in the audit team
• BThe auditee's risk profile, results of previous audits, and management system maturity
• CThe lead auditor's personal schedule and availability
• DThe certification body's fixed annual calendar

During the initiation phase of a BCMS audit, the audit team leader must confirm the audit's feasibility. Which action is MOST appropriate at this stage?

• AConduct on-site interviews with process owners
• BIssue the preliminary audit report to the auditee
• CReview the availability of information needed and confirm the scope, objectives, and crit…
• DAssign corrective action owners to identified gaps

ISO 22301 requires an organization to establish the context of the organization before defining the scope of its BCMS. Which output BEST results from this step?

• AA list of recovery time objectives for each critical process
• BAn understanding of internal and external issues and interested-party needs relevant to BC
• CA completed business impact analysis for all products and services
• DA documented incident response plan signed by senior management

A CBCLA auditor identifies that an organization's BIA has not been reviewed in four years despite two major restructurings. According to ISO 22301, this finding is BEST classified as:

• AAn observation requiring no formal documentation
• BA major nonconformity because a required process is not functioning effectively
• CA minor nonconformity because the BIA still exists on record
• DAn opportunity for improvement only, not a nonconformity

Which of the following BEST defines 'audit criteria' as used in ISO 19011?

• AThe specific questions the auditor plans to ask each interviewee
• BA set of policies, procedures, or requirements against which collected evidence is compar…
• CThe numerical score assigned to each audit finding
• DThe list of audit team members and their assigned process areas

A lead auditor is preparing the audit plan for an ISO 22301 stage 2 audit. Which statement BEST describes the purpose of a stage 2 audit?

• ATo confirm the BCMS documentation is drafted and the organization is ready for the main a…
• BTo evaluate the implementation and effectiveness of the BCMS against ISO 22301 requiremen…
• CTo review only the organization's top-level BC policy and leadership commitment
• DTo issue provisional certification before the full audit is completed

Which of the DRI Professional Practices covers establishing recovery time objectives, maximum tolerable downtime, and critical process dependencies?

• AProfessional Practice 1 — Program Management
• BProfessional Practice 2 — Risk Assessment
• CProfessional Practice 3 — Business Impact Analysis
• DProfessional Practice 4 — Business Continuity Strategies

During an ISO 22301 audit, an auditor finds that the organization's exercising programme tests only call-tree notifications and never involves operational staff in functional exercises. According to ISO 22301 clause 8.5, how should this be classified?

• AConformity — notification testing is sufficient under ISO 22301
• BMinor nonconformity — the organization exercises but the scope is too narrow to verify re…
• CObservation only — exercise formats are left entirely to the organization's discretion
• DMajor nonconformity — the organization has never conducted any exercise

An audit team leader notices a potential personal financial interest in the auditee organization before the audit begins. What should the lead auditor do FIRST?

• AProceed with the audit but disclose the interest in the final report
• BAssign that interest as a scope exclusion so it is not covered during fieldwork
• CDisclose the conflict of interest to the audit client and programme manager immediately s…
• DReduce the number of interviews in areas related to that financial interest

ISO 22301 clause 6.1 requires the organization to determine risks and opportunities related to the BCMS. What is the PRIMARY purpose of this clause?

• ATo replace the organization's enterprise risk management framework with a BC-specific one
• BTo ensure the BCMS can achieve its intended outcomes, prevent undesired effects, and achi…
• CTo document all external threats for use in the crisis communications plan
• DTo establish the financial budget for business continuity program activities

A lead auditor is reviewing evidence gathered during a BCMS audit. According to ISO 19011, what is the MOST reliable type of audit evidence?

• AVerbal assurances from senior management during the opening meeting
• BDocumented records generated through the normal operation of the BCMS
• CThe auditee's self-assessment survey completed before the audit
• DIndustry benchmark reports from third-party consulting firms

Which of the following BEST describes 'audit findings' as defined in ISO 19011?

• AResults of evaluating collected audit evidence against audit criteria
• BThe final certification decision issued by the certification body
• CInterview transcripts submitted to the auditee after fieldwork
• DA list of corrective actions agreed to during the closing meeting

During a BCMS surveillance audit, the lead auditor discovers that the organization has made a significant change to its IT infrastructure that was not evaluated for BC impact. Under ISO 22301, which requirement was most likely NOT followed?

• AClause 7.3 — Awareness
• BClause 8.6 — Business Continuity Plan Evaluation
• CClause 8.3 — Business Continuity Strategy, specifically change management controls
• DClause 10.2 — Continual Improvement

According to DRI Professional Practice 1, which element is MOST essential for establishing a credible business continuity program?

• APurchasing BC software licensed from an approved vendor
• BExecutive sponsorship that provides authority, funding, and organizational commitment
• CHiring external consultants to write recovery procedures
• DImplementing an ISO 22301-certified BCMS within the first year

A lead auditor is preparing the audit work plan for a large multi-site BCMS audit. How should the auditor determine which sites and processes to include in the sample?

• ASelect only the headquarters site because senior management is located there
• BUse judgmental and/or statistical sampling based on risk, complexity, and prior audit his…
• CRandomly select any three sites regardless of their criticality
• DLet the auditee choose the sites to reduce scheduling conflicts

ISO 22301 defines 'maximum tolerable period of disruption' (MTPD). Which statement BEST describes this concept?

• AThe time from incident declaration to activation of the BC plan
• BThe duration after which an organization's viability is permanently threatened if a criti…
• CThe maximum time allowed for the IT team to restore a backup server
• DThe period during which senior management reviews BC plan updates

An auditor completes fieldwork and identifies three separate instances where the same corrective-action process was not followed. According to ISO 19011, how should these be documented?

• AAs three separate minor nonconformities, one per instance
• BConsolidated into one finding reflecting a systemic pattern, which may warrant a major no…
• CAs observations only, since no single instance caused an incident
• DExcluded from the report because they involve the same process

During a BCMS audit, the auditor reviews the organization's risk assessment and finds no documented treatment plan for high-rated risks identified eighteen months ago. Under ISO 22301 clause 6.1, how should this be classified?

• AA minor nonconformity because the risks were at least identified
• BA major nonconformity because the organization identified high risks and took no document…
• CAn opportunity for improvement because risk treatment is discretionary
• DA conformity because the risks were captured in the risk register

Which of the following BEST characterizes the role of a lead auditor distinct from that of an audit team member?

• AThe lead auditor only reviews documents while team members conduct interviews
• BThe lead auditor manages the overall audit process, communicates with the client, makes f…
• CThe lead auditor assigns all findings to team members to write and takes no direct eviden…
• DThe lead auditor's primary duty is to train team members with no accountability for audit…

An ISO 22301 certified organization experiences a major flood that activates its BC plans. After recovery, management decides not to conduct an after-action review. Under DRI Professional Practice 8 and ISO 22301, what does this represent?

• AAcceptable discretion because real incidents are inherently different from exercises
• BA missed opportunity to capture lessons learned — a potential nonconformity under clause…
• CFull conformity because the BC plan was activated and the organization recovered
• DA minor observation only, since the recovery itself was successful

A CBCLA candidate is reviewing the DRI Professional Practices to prepare for the Audit Examination. Which statement about the relationship between Professional Practice 3 (BIA) and Professional Practice 4 (BC Strategies) is MOST accurate?

• ABIA outputs are optional inputs to strategy selection when an organization has prior expe…
• BThe BIA determines recovery priorities, timing objectives, and resource requirements that…
• CPP4 strategy selection occurs first and then the BIA validates those choices
• DBIA and strategy selection are independent workstreams that do not depend on each other

According to ISO 19011, which principle requires auditors to report truthfully and accurately, including unfavorable findings, without omission or misrepresentation?

• AConfidentiality
• BFair presentation
• CProfessionalism
• DEvidence-based approach

An organization's BCMS management review produced no documented outputs for a full calendar year. Under ISO 22301 clause 9.3, this finding MOST likely indicates:

• AThat management review is optional if leadership is actively engaged in daily operations
• BA nonconformity because management review with documented outputs is a mandatory ISO 2230…
• CA minor observation because no incidents occurred during that year
• DA conformity if management verbally discussed BC status in executive meetings

In an audit programme, 'audit scope' is BEST defined as:

• AThe time budget allocated to each audit team member
• BThe extent and boundaries of the audit, including locations, organizational units, activi…
• CThe list of findings generated at the end of the audit
• DThe qualifications required for team members assigned to the audit

A BCMS audit team conducts interviews and observes that the organization's BC coordinator has sole knowledge of plan activation procedures and no documented succession plan exists. Under ISO 22301 clause 7.2, this MOST likely constitutes:

• AA conformity because the coordinator is still employed
• BA nonconformity because the organization has not ensured competence is documented and tra…
• CAn observation because key-person dependency is a business risk not within ISO 22301's sc…
• DA major nonconformity only if the coordinator is currently absent

Which ISO 19011 audit principle is being violated when an auditor shares confidential auditee information with a competitor during a professional networking event?

• AEvidence-based approach
• BConfidentiality
• CFair presentation
• DIntegrity

An auditor reviews a corrective action submitted by an organization in response to a major nonconformity. The action plan identifies causes and describes containment steps but does not address root cause elimination. How should the lead auditor respond?

• AAccept the corrective action because containment is sufficient for a major nonconformity
• BReject the corrective action and request a revised plan that includes root cause analysis…
• CDowngrade the finding to a minor nonconformity since containment steps were taken
• DClose the finding after the next surveillance audit regardless of root cause

A lead auditor is planning a BCMS audit and must develop an audit plan. Which of the following is a required element of the audit plan under ISO 19011?

• AThe auditee's internal salary budget for the BCMS coordinator role
• BAudit objectives, scope, criteria, methods, team assignments, and schedule
• CA list of all employees who will be interviewed, with their home addresses
• DThe certification body's fee structure for the current audit cycle

ISO 22301 requires an organization to maintain documented information on its BC procedures. An auditor finds that procedures exist but are stored only on the primary production network, which becomes unavailable during the scenarios they are designed to address. This finding BEST reflects a gap in:

• AISO 22301 clause 7.5 — Documented information management, specifically accessibility unde…
• BISO 22301 clause 6.2 — Business continuity objectives
• CISO 22301 clause 9.1 — Monitoring, measurement, analysis, and evaluation
• DISO 22301 clause 10.2 — Continual improvement

According to DRI Professional Practice 9 — Crisis Communications, which element is MOST critical to ensure effective stakeholder messaging during an incident?

• AAllowing all employees to post updates on social media to speed information flow
• BPre-approving message templates and designating authorized spokespeople before an inciden…
• CWaiting for complete incident information before releasing any communication
• DDelegating all external communications to a public-relations agency with no internal appr…

Which of the following BEST describes a 'surveillance audit' in the context of ISO 22301 BCMS certification?

• AAn unannounced inspection conducted by a regulatory authority
• BA periodic audit conducted between recertification cycles to verify the BCMS continues to…
• CAn internal audit conducted by the organization's own audit team
• DA special audit triggered only when a major incident occurs

A lead auditor is conducting the closing meeting of a BCMS audit. Which action is MOST appropriate at this stage?

• AReveal all individual auditor notes to the auditee for their permanent records
• BPresent audit findings, explain the basis for nonconformity classifications, and confirm…
• CIssue the final audit report and certification decision simultaneously
• DAllow auditee management to reclassify minor nonconformities as observations before concl…

ISO 22301 clause 8.4.2 requires organizations to establish business continuity plans. Which element is REQUIRED content for these plans?

• AFull employee salary data and personal identification numbers
• BActivation criteria, roles and responsibilities, communication procedures, and resources…
• CA complete list of all IT vendor service-level agreements
• DAnnual budget projections for the BC program

A lead auditor discovers during fieldwork that a key auditee representative has been providing false information. What should the lead auditor do?

• AAccept the information to avoid conflict and note it as an observation
• BImmediately terminate the audit without issuing any report
• CReport the situation to the audit programme manager and client, and determine whether the…
• DReplace the representative with another auditee employee and continue normally

According to DRI Professional Practice 5 — Incident Preparedness and Response, what is the FIRST priority when an incident is declared?

• AActivating the backup data center to restore IT services
• BNotifying vendors and suppliers of the delay to service delivery
• CLife safety of personnel and protection of people from harm
• DInitiating the crisis communications protocol with media outlets

A CBCLA candidate is reviewing ISO 22301 clause 8.2 requirements for business impact analysis. Which element does ISO 22301 explicitly require the BIA to produce?

• AA financial audit of all costs associated with prior disruptions
• BThe prioritized list of activities and their recovery time objectives consistent with the…
• CA vendor evaluation matrix for all third-party service providers
• DA physical site survey of all office locations

An audit team member disagrees with the lead auditor's classification of a finding as a major nonconformity, believing it should be minor. How should this disagreement be handled according to ISO 19011?

• AThe team member's view automatically overrides the lead auditor's decision
• BThe disagreement should be documented and the lead auditor makes the final determination;…
• CThe auditee is asked to decide which classification to accept
• DThe finding should be removed from the report until the certification body management res…

ISO 22301 clause 9.2 requires internal audits. What is the PRIMARY purpose of the internal BCMS audit?

• ATo prepare a certification application for submission to the certification body
• BTo provide information on whether the BCMS conforms to requirements and is effectively im…
• CTo replace the management review required under clause 9.3
• DTo evaluate employee performance for annual appraisal purposes

A lead auditor observes that the organization's continuity strategies focus only on technology recovery and do not address people, workspace, or supply chain. Under ISO 22301 clause 8.3, this MOST likely represents:

• AAcceptable practice because technology is always the critical recovery resource
• BA nonconformity because ISO 22301 requires strategies to address all categories of resour…
• CAn observation if the organization's critical processes are all IT-dependent
• DConformity because the BIA identified technology as the primary dependency

The DRI Professional Practices describe 'vital records' in the context of business continuity strategies. Which statement BEST characterizes vital records management?

• AVital records are only electronic data backups stored in the cloud
• BVital records include any information essential to the organization's recovery and ongoin…
• CVital records are limited to financial statements and tax filings
• DVital records management is exclusively an IT function and outside BC scope

An auditor evaluating a BCMS under ISO 22301 finds that the organization's leadership has not assigned BCMS roles and responsibilities in writing. Which clause is MOST directly applicable?

• AClause 4.1 — Understanding the organization and its context
• BClause 5.3 — Organizational roles, responsibilities, and authorities
• CClause 8.2 — Business impact analysis
• DClause 10.1 — Nonconformity and corrective action

A third-party BCMS certification body is reviewing an organization for recertification. The recertification audit finds two minor nonconformities and one observation. What is the MOST likely outcome?

• ACertification is immediately withdrawn until all findings are resolved
• BRecertification is granted with conditions requiring corrective action plans for minor no…
• CRecertification is denied because any nonconformity disqualifies renewal
• DRecertification is granted with no conditions because only minor nonconformities were fou…

DRI Professional Practice 10 covers coordination with external agencies. Which of the following BEST represents the purpose of a memorandum of understanding (MOU) in BC planning?

• AAn MOU is a legally binding contract requiring financial payment between the organization…
• BAn MOU documents pre-agreed mutual support or resource sharing arrangements with external…
• CAn MOU replaces the need for tested BC plans with the external agency
• DAn MOU is used only for regulatory compliance filings and has no operational BC value

During a BCMS audit, the lead auditor must verify that the organization addresses continuity of supply chain disruptions. Which ISO 22301 clause MOST directly requires this?

• AClause 7.4 — Communication
• BClause 8.3 — Business continuity strategies and solutions
• CClause 9.1 — Monitoring, measurement, analysis, and evaluation
• DClause 5.2 — Policy

A BCMS auditor is evaluating an organization's awareness programme. ISO 22301 clause 7.3 requires personnel to be aware of which of the following?

• AThe salaries of all BC program staff and the annual program budget
• BThe BC policy, their contribution to the BCMS's effectiveness, and the implications of no…
• CThe full technical specifications of the organization's backup systems
• DThe resumes of all audit team members assigned to the organization

Which type of audit is MOST appropriate when a customer wants to evaluate a potential supplier's BCMS before signing a long-term contract?

• AThird-party certification audit conducted by an accredited certification body
• BFirst-party (internal) audit conducted by the supplier's own team
• CSecond-party audit conducted by the customer or on the customer's behalf
• DSurveillance audit scheduled by the previous certification body