CBCI Practice Questions

The selection of business continuity solutions is a critical step in the BCM lifecycle that follows the Business Impact Analysis (BIA) and risk assessment. This activity, often called an options appraisal, requires the activity or resource owner to evaluate potential solutions. This evaluation involves a detailed comparison of the advantages (e.g., effectiveness in meeting the RTO, ease of implementation, reliability) and disadvantages (e.g., cost, complexity, resource requirements) of each option. The goal is to choose the most appropriate and cost-effective solution that mitigates the identified unacceptable risks and single points of failure while meeting the organization's recovery requirements.

A. Findings from the BIA are an input that defines the requirements for a solution (e.g., the RTO), not the criteria for selecting one solution over another.

B. The risks expected to materialise are identified during the risk assessment phase, which precedes the selection of specific mitigation solutions.

D. The Business Continuity culture index is a high-level metric of program maturity and embedding, not a direct factor in the technical and financial evaluation of a specific solution.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. In Professional Practice 4: Business Continuity Solutions

Section 6.4

"Selecting business continuity solutions

" it states: "The selection process should consider a range of factors

including... cost versus benefit; and the advantages and disadvantages of each solution." This directly supports that weighing advantages and disadvantages is the core of the selection activity.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 8.3.3

"Selection of business continuity strategies and solutions

" requires the organization to "select appropriate strategies and solutions" that enable it to meet its recovery requirements. This selection process inherently involves an evaluation of the pros and cons of different options to determine their appropriateness.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management (3rd ed.). Chapter 20

"Determining the Business Continuity Strategy

" details the process of identifying and evaluating a range of strategy options. It emphasizes that "each option should be evaluated against a set of criteria

" which includes costs

benefits

risks

and overall impact

aligning with the analysis of advantages and disadvantages.

The activation of strategic, tactical, and operational plans must be proportionate to the nature and scale of the incident. Each level of the response structure should have its own plan with clearly defined activation triggers, roles, and responsibilities. An incident may only require an operational response, while a more severe event could escalate, triggering tactical and then strategic plans. This approach ensures a scalable and appropriate response, avoiding unnecessary resource allocation or escalation. Activation is therefore determined by the specific conditions documented within the relevant plan for that team or level.

A. Simultaneous activation is inefficient and often inappropriate, as many incidents only require an operational-level response.

B. This implies an "all-or-nothing" approach, which is inflexible and prevents a scalable response to smaller incidents.

C. Activation is not exclusively a top-down process; an incident can be identified and managed at the operational level without strategic involvement.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition.

Section 8.3.3

Plan Activation: "The plan should clearly state the circumstances under which it should be activated... The activation criteria should be clear

concise and easy to understand

avoiding any ambiguity." This directly supports that activation is based on documented conditions within the relevant plan.

Section 8.2

Response Structure: The GPG describes the three-tiered (Strategic

Tactical

Operational) structure

noting that it provides a "scalable response to any incident." This scalability refutes the simultaneous

all-or-nothing

or purely top-down activation models proposed in the incorrect options.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements.

Clause 8.4.2

Warning and communication: This clause requires procedures for internal and external communication upon incident detection.

Clause 8.4.4

Business continuity plans and procedures: Requires that procedures "contain the criteria and process for their activation." This aligns with the principle that each plan has its own documented activation triggers.

A fundamental principle of effective crisis communication is to ensure all messages are consistent with the organization's established identity. This includes its core beliefs, culture, and values. During a disruption, stakeholders look for reassurance and authenticity. Communications that align with the organization's character reinforce trust and credibility, helping to protect its reputation. Deviating from these core values can be perceived as disingenuous, potentially causing more reputational damage than the incident itself. This consistency ensures that the organization speaks with one voice, reflecting its commitment to its stakeholders even under duress.

B. Communications must be centralized through authorized and trained spokespeople to ensure a single, consistent, and controlled message, preventing misinformation.

C. This would violate privacy, compromise security, and overwhelm individuals who are critical to the response and recovery effort.

D. While initial holding statements are generic, subsequent communications must be specific and factual to be credible and useful to stakeholders.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. Section 8.4.2

"Crisis Communication Plan

" states that the plan should define "key messages that reflect the organization’s values and commitment to its stakeholders." This directly supports the principle that communications must be consistent with the organization's core identity. The guidelines also emphasize the need for authorized spokespeople (contradicting B) and providing factual

specific information (contradicting D).

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 7.4

"Communication

" requires a systematic process for communication with interested parties. This structured approach implies alignment with the organization's overall policies and objectives (Clause 5.2)

which are expressions of its core values and culture.

3. Coombs

W. T. (2014). Ongoing crisis communication: Planning

managing

and responding (4th ed.). Sage Publications. Chapter 6

"Crisis Response Strategies

" emphasizes that the selection of a communication strategy should be guided by the need to protect the organization's reputation

which is built upon its perceived character and values. Inconsistent messaging undermines this reputational asset.

The primary purpose of risk treatment is to modify unacceptable risks to a level that is tolerable to the organization, in line with its risk appetite. This is achieved by selecting and implementing appropriate controls and measures. The most common form of risk treatment is mitigation, which involves actions specifically designed to reduce the likelihood of a disruptive incident occurring or to lessen the negative consequences (impact) if it does happen. While other treatment options exist (e.g., accept, transfer, avoid), mitigation is the core activity described in the correct option.

A. This describes the assignment of a risk owner, a governance step to ensure accountability, not the purpose of the treatment action itself.

B. This describes risk analysis, the process of evaluating and scoring risks, which is performed before the risk treatment stage.

D. This describes risk monitoring and communication, which are ongoing activities to review the effectiveness of treatments and inform stakeholders.

1. ISO 31000:2018

Risk management — Guidelines. Clause 6.5.1

"General

" states: "The purpose of risk treatment is to select and implement options for addressing risk." Clause 6.5.2

"Selection of risk treatment options

" lists methods for modifying risk

including "changing the likelihood" and "changing the consequences

" which are the fundamental components of mitigation.

2. The Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. Professional Practice 2 (PP2): Analysis

Section 5.6

"Risk Treatment

" explains that after risks are evaluated

"the organization can decide on the most appropriate way to treat the risk." It outlines options

with a primary focus on mitigation through controls that reduce likelihood or impact.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 11

"Risk Assessment and Control

" details that the objective of risk treatment is to apply controls to reduce the identified risks to an acceptable level

primarily by addressing the probability (likelihood) and/or the business impact of a threat. (Referenced as a foundational academic text in the BCI domain).

The scope of the Business Continuity Management System (BCMS) is fundamentally determined by the organization's context, including its objectives, obligations, and internal and external environments. According to ISO 22301, the standard upon which the BCI Good Practice Guidelines are based, any change to the internal or external operating context must be considered during management reviews. Such changes, like new products, markets, regulations, or organizational structure, can directly impact the boundaries and applicability of the BCMS, necessitating a formal review of its scope to ensure it remains relevant, appropriate, and effective in meeting the organization's needs.

A. A new professional's appointment may bring new ideas, but personnel changes alone are not a formal trigger for a strategic scope review, which is driven by organizational needs.

B. Exercise findings typically lead to tactical updates of plans and procedures within the existing scope, not a fundamental reassessment of the BCMS's boundaries.

D. Poor personnel engagement is a cultural or awareness issue to be addressed through training and communication, not by altering the strategic scope of the BCMS.

1. ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 4.3

"Determining the scope of the business continuity management system

" states that when determining the scope

the organization must consider the external and internal issues referred to in Section 4.1 ("Understanding the organization and its context").

Section 9.3.2

"Management review inputs

" explicitly lists "changes in external and internal issues that are relevant to the business continuity management system" as a required input for management review

which is the formal process for evaluating the BCMS's continuing suitability

adequacy

and effectiveness

including its scope.

2. Business Continuity Institute (BCI)

"Good Practice Guidelines (GPG)

2018 Edition."

Professional Practice 1 (PP1): Policy and Programme Management

Section 3.3

"Determining the Scope of the BCMS

" explains that the scope is defined by the organization's context. It states

"The scope of the BCMS is influenced by the organization’s strategic objectives

culture

structure

products and services

supply chains

stakeholder relationships

and the external environment in which it operates." A change to any of these contextual factors would warrant a review.

Professional Practice 1 (PP1): Policy and Programme Management

Section 3.6

"Management Review

" aligns with ISO 22301

indicating that a key input for the review is "any changes to the internal and external context of the organization."

In the Business Continuity Management (BCM) lifecycle, strategies represent the high-level, overarching approaches selected to meet the recovery requirements identified during the Business Impact Analysis (BIA) and risk assessment. They answer the question, "What will we do?". For example, a strategy might be to use a third-party hot site for IT recovery. Solutions are the specific, tactical implementations of these strategies. They detail the "how," specifying the exact resources—people, processes, technology, and facilities—required to make the strategy operational. For instance, the solution would be the specific contract with a named vendor for a particular hot site facility.

A. This is partially true but less precise. While strategies are guided by policy, solutions are the specific implementation of strategies, not just a general response to BCMS objectives.

B. This creates a false dichotomy. Both the BIA and the risk assessment are critical inputs for determining appropriate strategies, which are then implemented through specific solutions.

D. This is incorrect. Business Continuity strategies are designed for responding to and recovering from disruptions, not for "business as usual activities."

1. ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 8.3

"Business continuity strategies and solutions

" outlines the process. Clause 8.3.1 requires the organization to "identify and select business continuity strategies." Following this

Clause 8.3.2 requires the organization to determine the resource requirements and "implement the selected business continuity solutions." This sequential structure demonstrates that strategies are the high-level approaches

and solutions are their subsequent implementation.

2. Business Continuity Institute (BCI)

"Good Practice Guidelines (GPG)

2018 Edition."

Professional Practice 3 (PP3): Business Continuity Strategy

page 81

states that the purpose is to "identify and select strategic options for the continuity and/or recovery of prioritized activities."

Professional Practice 4 (PP4): Business Continuity Solutions

page 97

states its purpose is to "implement the strategies and tactics that were determined in PP3." This explicitly defines solutions as the implementation of the previously determined strategies.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons.

Chapter 16

"Developing Business Continuity Strategies

" describes strategy selection as choosing the appropriate methods to enable recovery within the RTO. The subsequent chapters on implementation detail the specific solutions (e.g.

alternate sites

technology) needed to realize those strategies. This supports the concept of strategy as a high-level approach and solutions as the detailed implementation.

The assertion that meetings must always be physical is incorrect. Modern business continuity and incident response practices emphasize flexibility and the use of technology. Virtual meeting locations and collaboration tools are essential components of a robust response structure. They enable teams to convene and manage an incident when physical assembly is impossible or impractical, such as during a pandemic, a natural disaster restricting travel, or a denial-of-access incident. The choice between a physical or virtual meeting space depends entirely on the nature and context of the incident.

A. Plans must be documented and communicated to team members to be effective; otherwise, the team would not know the arrangements during an incident.

B. Relying on a single meeting location introduces a single point of failure. Standard resilience practice dictates having primary and alternate locations.

D. A stable power supply is a critical utility for any incident management location, physical or virtual, to support the necessary communication and information systems.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. In Professional Practice 5 (PP5): Response

Section 8.4.3

"Incident Management Locations

" the guidelines explicitly discuss various types of locations

including dedicated incident rooms

alternative internal or external rooms

and virtual locations. The text states

"A virtual location can be used where team members are geographically dispersed or unable to travel to a physical location." This directly contradicts the absolute statement in option C.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 8.4.2

"Response structure

" requires an organization to establish a structure for responding to incidents. Clause 8.4.4

"Communication and warning

" requires procedures for communication. These clauses imply the need for effective and resilient methods of team coordination

which in modern practice includes virtual communication and collaboration platforms

especially when physical co-location is not feasible.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management (3rd ed.). Wiley. Chapter 25

"The Command Centre

" discusses the evolution of command centers

noting the increasing reliance on technology and virtual capabilities. It highlights that "virtual crisis management" allows teams to collaborate remotely

which is a critical capability for many types of disruptive incidents. This supports the invalidity of mandating a physical-only meeting location.

An effective Business Continuity Management System (BCMS) steering group requires a holistic view of the organization. This is best achieved by including multi-disciplinary experts from various departments such as IT, HR, Operations, Finance, and Legal. This cross-functional representation ensures that all critical business activities, interdependencies, and operational nuances are considered during the BCMS establishment. This structure fosters organizational buy-in, ensures the BCMS is practical, and integrates business continuity into the organization's culture, aligning with the principles of good governance.

A. This composition is too narrow. It lacks the necessary business context, authority, and input from the departments the BCMS is designed to protect.

B. While top management provides crucial sponsorship and direction, a group composed solely of them may lack the detailed operational knowledge required for effective oversight.

C. External parties can provide valuable input but should not form the core steering group due to potential conflicts of interest and confidentiality concerns.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. In Professional Practice 1 (PP1): Policy and Programme Management

Section 4.3

"Governance

" it is stated that a governance structure

often a steering committee

should be established with "representation from across the organization to ensure the BCM programme has the required authority and resources." This directly supports the need for a multi-disciplinary group.

2. ISO 22313:2020

Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301. Clause 5.3

"Roles

responsibilities and authorities

" advises that the BCMS should be managed by individuals or a team with the appropriate competence

authority

and knowledge of the organization. This implies a multi-disciplinary approach to cover all organizational facets.

3. Herbane

B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History

52(6)

978-1002. https://doi.org/10.1080/00076791.2010.511185. The paper discusses the shift of BCM from a technical

IT-focused discipline to a holistic

management-led process

which necessitates cross-functional involvement for effective governance and integration (p. 994).

A primary benefit of conducting a business continuity exercise is to rehearse and validate the capabilities of the response teams. Exercises provide a practical, simulated environment for personnel to practice their assigned roles and responsibilities as defined in the business continuity plan. This confirms their familiarity with procedures, communication protocols, and decision-making authority in a crisis. By doing so, exercises build individual and team competence, confidence, and muscle memory, which are crucial for an effective response during an actual incident.

A. This is a broader objective better addressed through a management review or an audit of the entire Business Continuity Management System (BCMS).

C. Understanding the Business Impact Analysis (BIA) is a prerequisite for developing plans; an exercise validates the resulting plans, not the BIA itself.

D. This describes a compliance audit, which formally assesses the BCMS against standards and regulations, a distinct activity from an exercise that tests operational effectiveness.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition.

Section 10.3.2

"Exercise objectives

" lists key objectives for an exercise programme

including: "Practise the roles and responsibilities of the individuals in the teams" and "Build teamwork in the teams that will have to manage an incident." This directly supports option B.

Section 10.2.2

"Exercises and Audits

" explicitly distinguishes between the two activities: "An exercise is not an audit... An audit is a systematic and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the BCMS policy and objectives are fulfilled." This reasoning invalidates option D.

2. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements.

Clause 8.5

"Exercise programme

" states that an organization shall establish an exercise programme to "validate the effectiveness of its business continuity strategies and solutions" and "evaluate its business continuity capabilities and the competence of personnel with assigned business continuity responsibilities." This reinforces that confirming personnel familiarity (competence) with their roles is a core purpose.

3. Finch

J. (2017). Business Continuity Management: Preparing for the Worst. Kogan Page.

In the chapter on exercising and testing

the text emphasizes that exercises are crucial for "ensuring that all personnel involved in the plan are aware of their roles and responsibilities" and for "building confidence among the team members." This aligns with the rationale for selecting option B. (Note: While a book

it is a widely cited academic and professional text in the BCM domain).

A live exercise is the most comprehensive and realistic type of validation activity. It is designed to test an organization's business continuity and incident response capabilities in as near to real conditions as possible. This involves the actual mobilization of personnel, resources, and equipment to the designated locations, such as the primary workplace, alternate sites, or command centers. The key characteristic is the real-time, hands-on execution of plans and procedures by all relevant teams, simulating a genuine response to a disruption.

A. Simulation: This is a technique used within an exercise to replicate system behavior or inject events, not a distinct type of exercise in this context.

B. Discussion-based: This type of exercise, like a tabletop, involves talking through a scenario rather than physically deploying teams or using equipment in an operational setting.

C. Scenario: A scenario is the storyline or set of circumstances that an exercise is based upon; it is a component of an exercise, not the type itself.

1. Business Continuity Institute (BCI). (2018). Good Practice Guidelines (GPG)

2018 Edition. Section 7.4.5

'Live Exercises'

Page 148. The GPG states

"A live exercise is one where the organization’s response is tested in as near to real conditions as possible... Live exercises are carried out in the normal operational environment

alternative premises

or command centres and are designed to include everyone that could be involved in the response if the incident were real."

2. Hiles

A. (Ed.). (2011). The Definitive Handbook of Business Continuity Management (3rd ed.). John Wiley & Sons. Chapter 21

'Exercising

Maintenance and Review'

describes live exercises as those that "involve staff physically carrying out the activities they would be expected to perform in a real situation

" confirming their operational and inclusive nature.

3. ISO 22398:2013. Societal security — Guidelines for exercises. Section 4.3

'Types of exercise'. This standard categorizes exercises and describes a "live exercise" as one involving the actual deployment of resources and personnel to demonstrate operational capability

which aligns with the question's description.