ISO-22301-LEAD-AUDITOR Practice Questions

The act step in the PDCA cycle validates improvements by taking actions to address any gaps,

nonconformities, or opportunities for improvement identified in the check step. The act step also

involves reviewing the effectiveness of the actions taken and determining whether further

improvement is possible or necessary. The act step closes the PDCA cycle and leads to a new plan

step for the next cycle of continual improvement. The act step is one of the key requirements of ISO

22301, as it demonstrates the organization’s commitment to enhance its business continuity

capability and performance. Reference: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause

0.3 2

The team that is responsible for determining how the impact of the incident is managed within the

policy guidelines set by the strategic team is the tactical team. The tactical team is composed of

managers or experts who have the authority and competence to make decisions and allocate

resources to implement the business continuity plans and strategies. The tactical team coordinates

and communicates with the operational team, which is responsible for executing the recovery and

restoration activities, and reports to the strategic team, which is responsible for setting the overall

direction and objectives of the incident response1.

Reference: 1: ISO 22301 Auditing eBook, Chapter 7: Business Continuity Response, Section 7.2:

Incident Management Structure, Subsection 7.2.1: Incident Management Teams, Page 103

Thank you for your visit.

The media and press have a profound impact on the long-term performance, or in some cases, the

survival of an organization, especially in the aftermath of a disruptive incident. The media and press

can influence the perception and reputation of the organization, as well as the expectations and

satisfaction of its stakeholders, such as customers, suppliers, regulators, employees, and the general

public. Therefore, it is important for the organization to establish and maintain a positive relationship

with the media and press, and to communicate effectively and transparently during and after a crisis.

ISO 22301:2019, Clause 8.4.3, requires the organization to establish, implement, and maintain a

documented procedure to manage communications with relevant interested parties during a

disruptive incident. The procedure should include the identification of the spokesperson(s) who will

communicate with the media and press, the preparation of key messages and statements, the

approval and distribution of information, and the monitoring and evaluation of the effectiveness of

the communications. The organization should also consider the potential legal and ethical

implications of its communications, and ensure that the information provided is accurate, consistent,

and timely. Reference: ISO 22301:2019, Clause 8.4.3; ISO 22301 Auditing eBook, Chapter 4.3.3.

Strategy option evaluation and selection is the strategy that supports the recovery needs of each

critical product and service. This strategy involves the following steps:

Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk

assessment, identify the possible recovery options for each critical product and service. Recovery

options are the alternative ways of resuming the delivery of the product or service within the

recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options

are: relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup,

outsourcing to a third-party provider, etc.

Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery

option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc.

Compare the advantages and disadvantages of each option and rank them according to their

suitability for meeting the recovery needs.

Select the recovery options: Choose the best recovery option for each critical product and service,

based on the evaluation results and the available resources. Ensure that the selected option aligns

with the organization’s business continuity objectives, policies, and strategies. Document the

rationale and justification for the selection and communicate it to the relevant stakeholders.

Strategy option evaluation and selection is the strategy that supports the recovery needs of each

critical product and service, as it enables the organization to identify, evaluate, and select the most

appropriate recovery option for each critical product and service, based on the BIA and the risk

assessment results. This strategy helps the organization to ensure the continuity and resilience of its

critical products and services in the event of a disruption, and to optimize the use of its resources

and capabilities. Reference:

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4.2:

Business Continuity Strategy, Page 19

ISO 22301 Auditing eBook, Chapter 5: Business Continuity Management System Audit Activities,

Section 5.3.2: Audit of Business Continuity Strategy, Page 37

ISO 22301:2019, Clause 8.3: Business Continuity Strategies and Solutions, Page 18

A formal management system is a type of management system that provides the means for

organizations to improve internal controls and management competence. A formal management

system is a documented system that defines the policies, objectives, processes, procedures, roles,

responsibilities, and resources for managing a specific aspect of the organization’s performance. A

formal management system is based on a recognized standard or framework that specifies the

requirements and best practices for achieving the desired outcomes and performance. A formal

management system also includes mechanisms for monitoring, measuring, reviewing, and improving

the system’s effectiveness and efficiency. A formal management system helps the organization to

demonstrate its commitment and capability to meet the expectations and needs of its stakeholders,

such as customers, regulators, employees, suppliers, etc. A formal management system also helps

the organization to identify and manage the risks and opportunities that may affect its performance

and continuity. Examples of formal management systems are ISO 22301 for business continuity

management, ISO 9001 for quality management, ISO 14001 for environmental management, ISO

27001 for information security management, etc. Reference:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems,

Section 1.1: Management System Concepts1

What is a management system?2

ISO - Management system standards3

Deliverables are the specific tasks, products, or outcomes that are required in order to complete the

project. They are the tangible and measurable results of the project activities, and they should be

aligned with the project objectives and scope. Deliverables can be classified into two types: project

deliverables and process deliverables. Project deliverables are the outputs that directly contribute to

the achievement of the project goals, such as reports, plans, documents, software, hardware, etc.

Process deliverables are the outputs that support the management and execution of the project,

such as schedules, budgets, risk assessments, audits, etc. Deliverables should be clearly defined,

agreed upon, and accepted by the project stakeholders, and they should be monitored and

controlled throughout the project lifecycle. According to ISO 22301, some of the deliverables for

implementing a business continuity management system (BCMS) are: business continuity policy,

business continuity objectives, business impact analysis, risk assessment and treatment, business

continuity strategy, business continuity plans, business continuity procedures, performance

indicators, audit reports, corrective actions, etc. Reference: ISO 22301 Auditing eBook, Chapter 3:

Planning the BCMS, Section 3.1: Project Management, page 39. ISO 22301 Auditing eBook, Chapter

3: Planning the BCMS, Section 3.2: Project Deliverables, page 40.

The Check phase of the PDCA cycle is the phase that determines potential issues pertaining to the

management of the BCMS. The Check phase involves monitoring and evaluating the performance

and effectiveness of the BCMS and identifying any gaps, nonconformities, risks, or opportunities for

improvement. The Check phase also involves collecting and analyzing data and information related

to the BCMS, such as the results of audits, reviews, tests, exercises, surveys, and feedback. The Check

phase provides valuable input for the Act phase, where corrective and preventive actions are taken

to address the issues and improve the BCMS. Reference: : ISO 22301 Auditing eBook, page 11 : ISO

22301:2019, clause 9.1 : Business continuity and ISO 22301 - Qudos : ISO 22313:2020(en), Security

and resilience ? Business continuity …

Corporate Services and Information Technology are the functions that provide a range of physical

and technological infrastructure services to all other functions, such as human resources, finance,

legal, procurement, facilities, security, IT systems, networks, applications, databases, etc. These

functions are essential for the continuity of the organization’s operations, as they support the

delivery of products and services to customers and stakeholders. Therefore, they need to be included

in the scope and objectives of the business continuity management system (BCMS), and their roles

and responsibilities need to be defined and communicated. Reference: ISO 22301 Auditing eBook,

Chapter 2: Business Continuity Management System (BCMS), Section 2.1: Scope and Objectives, page

23.

According to ISO 22301 Lead Auditor objectives and content, the communication structure for

managing information between various groups of stakeholders in the organization should include

both internal and external communication. Internal communication refers to the exchange of

information and messages within the organization, such as between employees, managers, and

business continuity teams. External communication refers to the exchange of information and

messages with parties outside the organization, such as customers, suppliers, regulators, media, and

the public. Both types of communication are essential for ensuring the effective operation of the

business continuity management system (BCMS) and the successful response and recovery from

disruptions. The communication structure should be aligned with the organization’s communication

strategy, which should identify the communication needs, define the communication channels, and

establish the communication procedures for the BCMS. The communication structure should also

consider the unique communication requirements that may arise during a disruption, such as timely

and accurate information, alternative communication channels, and managing rumours and

misinformation. Reference: ISO 22301 Auditing eBook, page 291; ISO 22301 Clause 7.4

Communication2

The knowledge of BCM and its methodology is not related to technical expertise, but to domain

expertise. Technical expertise refers to the knowledge and skills related to the audit process, such as

audit principles, procedures, techniques, and tools. Domain expertise refers to the knowledge and

skills related to the specific field of the audit, such as BCM concepts, terms, definitions,

requirements, and best practices. Reference: ISO 22301 Auditing eBook, page 11; ISO 19011:2018,

clause 7.2.2