ISO-BCMS-22301 Practice Questions

The statement is fundamentally true within the context of any management system, including ISO 22301. Non-compliance refers to the failure to act in accordance with legal, regulatory, contractual, or other requirements to which an organization subscribes. The ISO 22301 standard explicitly requires an organization to identify these compliance obligations and integrate them into its Business Continuity Management System (BCMS). The primary purpose of this is to avoid the "undesirable outcomes" associated with non-compliance, which can include legal penalties, financial losses, contractual liabilities, reputational damage, and the inability to continue operations. Therefore, managing compliance is a critical risk mitigation activity.

B. False: This is incorrect. The entire framework of a BCMS is built on identifying risks and requirements to prevent negative impacts. Ignoring compliance obligations directly exposes an organization to predictable and often severe undesirable outcomes.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Clause 9.1.2, "Evaluation of compliance": This clause mandates that "The organization shall plan, establish, implement and maintain a process for evaluating compliance with applicable legal and regulatory requirements...". The implicit purpose of this evaluation is to identify and rectify non-compliance to prevent its negative consequences.

Clause 10.1, "Nonconformity and corrective action": This section requires an organization, when a nonconformity occurs, to react by "dealing with the consequences." This directly links non-compliance (a type of nonconformity) with undesirable outcomes that must be managed.

2. Ruzic-Dimitrijevic, L., & Glusac, D. (2015). The Role and Importance of the Implementation of Business Continuity Management System (BCMS) in Organizations in the Financial Sector. International Review, (3-4), 61-69.

Page 63: The paper discusses that a key driver for implementing a BCMS is "compliance with legal and regulatory requirements." It highlights that failure to comply can lead to sanctions and loss of business license, which are clearly undesirable outcomes. This reinforces the direct link between non-compliance and negative consequences.

3. Herbane, B. (2019). Rethinking business continuity management. Business Horizons, 62(5), 553-563. https://doi.org/10.1016/j.bushor.2019.07.008

Section 3.1, "The regulatory imperative": This section explains that regulatory pressure is a significant driver for BCM adoption. It states, "Non-compliance can result in fines, reputational damage, and even imprisonment for senior managers." This directly supports the assertion that non-compliance leads to undesirable outcomes.

Governance is the formal framework of rules, relationships, systems, and processes by which an organization is directed, controlled, and held to account. In the context of Business Continuity Management (BCM), governance establishes the policies, roles, responsibilities, and authority needed to manage the Business Continuity Management System (BCMS). It acts as the internal regulatory system that ensures BCM activities are consistently performed, monitored, and aligned with the organization's strategic objectives and legal obligations. This framework provides the structure for decision-making and control over the BCMS, making it the correct answer.

A. Leadership provides the vision, commitment, and resources for BCM, but it is not the regulatory system of control itself; rather, it enables and directs the governance framework.

B. Good Business Practice is a descriptor for BCM, signifying its value to organizational resilience, but it is not the specific system that controls the organization's activities.

D. Long Range Focus is a strategic perspective or an outcome of a mature BCM program, not the governing mechanism that controls its implementation and operation.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. Clause 5, "Leadership," particularly 5.1 (c) and 5.3, establishes the foundation for governance by requiring top management to ensure the BCMS is integrated into business processes and that roles, responsibilities, and authorities are assigned and communicated. This integration and assignment of authority are core components of a governance system.

2. Herbane, B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History, 52(6), 978-997. This paper discusses how the need for improved corporate governance has been a primary driver for the formalization of BCM, framing it as a necessary control mechanism for organizational resilience (p. 989). DOI: https://doi.org/10.1080/00076791.2010.511185

3. Smallman, C. (2019). Business continuity and crisis management: A review of the past, a look at the present, and a glimpse of the future. Continuity & Resilience Review, 1(1), 4-20. This review highlights that effective BCM is underpinned by a strong governance structure that provides oversight and ensures accountability, distinguishing it from day-to-day management or leadership actions (Section: "The Role of Governance"). DOI: https://doi.org/10.1108/CRR-03-2019-0003

The 'Act' phase of the PDCA cycle is centered on continual improvement and taking corrective actions based on the results of the 'Check' phase. This phase ensures the Business Continuity Management System (BCMS) remains effective, adequate, and suitable over time. A critical component of this is communicating the improvements, changes, and outcomes of corrective actions to key stakeholders. This communication closes the feedback loop, demonstrates responsiveness to stakeholder needs and performance data, and thereby actively maintains the integrity of the BCMS and the engagement of stakeholders.

A. Plan: This phase establishes the initial framework, including identifying stakeholders and defining the communication strategy, but it does not encompass the ongoing, active maintenance of communication.

B. Do: This phase involves the operational execution of the BCMS, including carrying out planned communications during exercises or incidents, rather than the strategic maintenance of the system through improvement.

C. Check: This phase focuses on monitoring and reviewing the BCMS's performance, which includes gathering feedback from stakeholders, but it is the subsequent 'Act' phase that responds and communicates the resulting actions.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 10.2 (Continual improvement): This clause, corresponding to the 'Act' phase, states, "The organization shall continually improve the suitability, adequacy and effectiveness of the BCMS." This process of improvement inherently requires communication with stakeholders to report on progress and changes, thus maintaining the system's relevance and stakeholder confidence. The 'Act' phase is where the system is actively sustained.

2. Moeller, R. R. (2017). Executive's Guide to COSO Internal Controls: Understanding and Implementing the New Framework. John Wiley & Sons.

Chapter 4, The COSO Internal Control Framework, PDCA Cycle: While discussing management systems broadly, the text explains that the 'Act' phase involves management taking action to improve processes based on what was learned in the 'Check' phase. This action includes communicating changes and improvements to ensure the system is maintained and stakeholder expectations are managed.

3. Zairi, M. (1997). Business process management: a boundaryless approach to modern competitiveness. Business Process Management Journal, 3(1), 64-80. https://doi.org/10.1108/14637159710161585

This academic paper discusses the PDCA cycle in the context of business process management. It emphasizes that the 'Act' stage is not just about implementing changes but also about standardizing improvements and communicating them throughout the organization and to relevant parties to sustain the gains, which aligns with the concept of "maintaining communication."

The Plan-Do-Check-Act (PDCA) cycle is the core methodological framework for all ISO management system standards, including ISO 22301. It is fundamentally a process-centric approach. The cycle provides a four-stage iterative method for the control and continual improvement of processes. 'Plan' involves establishing objectives and processes, 'Do' is the implementation of the process, 'Check' involves monitoring and measuring the process against objectives, and 'Act' involves taking actions to continually improve process performance. This entire structure is designed to manage and enhance processes, making it inherently process-centric.

B. False: This is incorrect. The PDCA cycle is a classic model for process management and continuous improvement, which is the essence of a process-centric approach as applied in ISO standards.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 0.3, Plan-Do-Check-Act (PDCA) cycle: This section explicitly states, "This document applies the Plan-Do-Check-Act (PDCA) cycle to planning, establishing, implementing, operating, monitoring, reviewing, maintaining and continually improving the effectiveness of an organization’s BCMS." This demonstrates that the standard's entire structure for managing the BCMS is based on this process-oriented cycle.

2. International Organization for Standardization (ISO). (2015). The Process Approach in ISO 9001:2015 (White Paper). ISO/TC 176/SC 2.

Page 4, Section "What is the PDCA cycle?": This official ISO guidance document, which explains concepts common to all management system standards, states, "The PDCA cycle is a tool that can be used to manage processes and systems... PDCA provides a simple and effective approach for solving problems and managing change. It enables the management of processes and the implementation of continual improvement."

3. Sari, D. P., & Hapsari, R. H. R. (2018). Implementation of Business Continuity Management System based on ISO 22301: 2012 and Plan-Do-Check-Act Cycle. IOP Conference Series: Materials Science and Engineering, 407, 012143.

Section 3, "Result and Discussion": This academic paper details the application of the PDCA cycle to implement the ISO 22301 standard, describing it as a "cycle for process improvement" and mapping each clause of the standard to a phase of the PDCA cycle, reinforcing its process-centric nature. DOI: https://doi.org/10.1088/1757-899X/407/1/012143

Enterprise Risk Management (ERM) is the correct discipline. ERM is a strategic, top-down process designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. It takes a holistic, portfolio view of risk across the entire organization, managing the "full spectrum of risks" and their "combined impact as an interrelated risk profile," rather than treating risks in isolated silos. This integrated approach is central to the definition of ERM and distinguishes it from traditional risk management.

A. Enterprise Planning Management (EPM) focuses on the processes of planning, budgeting, forecasting, and consolidating financial results, not the holistic management of risk.

B. Enterprise Continual Management (ECM) is not a standard, recognized management discipline; it appears to be a distractor term combining unrelated concepts.

C. Enterprise Strategy Management (ESM) is concerned with the formulation and execution of organizational strategy; risk is a critical input, but ESM's primary focus is strategy itself.

1. ISO 31000:2018, Risk management — Guidelines. Clause 4, "Principles," states that risk management must be "integrated" and "structured and comprehensive." This supports the ERM concept of managing a full, interrelated profile of risks across the entire organization.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. The Executive Summary defines ERM as the practices organizations rely on "to manage risk in creating, preserving, and realizing value." It emphasizes a portfolio view of risk (p. 5) which directly aligns with managing an "interrelated risk profile."

3. Hoyt, R. E., & Liebenberg, A. P. (2011). The Value of Enterprise Risk Management. The Journal of Risk and Insurance, 78(4), 795–822. This academic paper defines ERM as a process that manages "all risks... in a coordinated, portfolio fashion" (p. 796), which directly corresponds to the question's description of managing a full spectrum of risks and their combined impact. DOI: https://doi.org/10.1111/j.1539-6975.2011.01413.x

The term "stakeholders" refers to any individuals, groups, or organizations that have an interest in, or can be affected by, an organization's performance, decisions, and activities. The ISO 22301:2019 standard uses the synonymous term "interested parties" and, in Clause 4.2, mandates that an organization must identify these parties and their requirements relevant to the Business Continuity Management System (BCMS). This ensures the BCMS addresses the needs of all relevant entities, including employees, customers, suppliers, regulators, and owners, not just a single group.

A. Individuals: This term is too general. While stakeholders can be individuals, not every individual is a stakeholder for a specific organization.

B. Customers: This represents only one specific type of stakeholder. The term fails to include other critical groups like employees, suppliers, or investors.

D. Competitor: A competitor is a specific external entity, but "stakeholder" is the comprehensive term that encompasses all parties with an interest.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 3.1.4: Defines "interested party (stakeholder)" as a "person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity."

Clause 4.2: Titled "Understanding the needs and expectations of interested parties," this section requires the organization to determine "the interested parties that are relevant to the business continuity management system" and "the relevant requirements of these interested parties."

2. Abidin, N. Z., & Ahmad, R. (2021). A Framework for Business Continuity Management in Higher Education Institutions based on ISO 22301. International Journal of Academic Research in Business and Social Sciences, 11(12), 1138–1157.

Page 1145: The paper discusses the implementation of ISO 22301 and explicitly states, "According to ISO 22301:2019 clause 4.2, the organization needs to identify the interested parties and understand their needs and expectations." This reinforces the centrality of identifying all stakeholders. DOI: https://doi.org/10.6007/IJARBSS/v11-i12/11829

3. ISO. (2021). ISO/IEC Directives, Part 1, Consolidated ISO Supplement — Procedures specific to ISO. Annex SL, Appendix 2.

Clause 4.2: This foundational document, which provides the high-level structure for all modern ISO management system standards including ISO 22301, defines the universal requirement to identify "interested parties" and their needs, establishing "stakeholder" as the correct, standardized term.

Adopting a Business Continuity Management System (BCMS) based on ISO 22301 provides a structured framework for managing and improving an organization's business continuity. The standard is built upon the Plan-Do-Check-Act (PDCA) model, which is a methodology for continual improvement. By systematically identifying potential threats, evaluating their impacts, and implementing plans and procedures, the BCMS ensures that the organization's continuity capability is not static. Through regular testing, performance evaluation, management reviews, and corrective actions, the BCMS is continually refined and enhanced. This iterative process inherently drives the optimization of the organization's ability to respond to and recover from disruptive incidents, ensuring its effectiveness and efficiency over time.

B. False: This is incorrect. The fundamental purpose of a management system like ISO 22301 is to move beyond ad-hoc arrangements to a structured, repeatable, and continually improving process, which is the definition of optimization.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 0.3, Plan-Do-Check-Act (PDCA) cycle: This section explicitly states that the PDCA model is applied to the BCMS to achieve continual improvement.

Clause 10, Improvement (specifically 10.1 & 10.2): This clause mandates that "The organization shall continually improve the suitability, adequacy and effectiveness of the business continuity management system." This requirement for continual improvement is the mechanism for optimization.

2. Herbane, B. (2019). Rethinking business continuity management. Continuity & Resilience Review, 1(1), 27-47.

Page 35: The paper discusses how standards like ISO 22301 have professionalized BCM, moving it from a "disparate set of activities" to a "holistic management process" that is integrated and improved over time, leading to a more optimized and resilient state.

3. Järveläinen, J. (2013). IT incidents and business impacts: A classification and the role of business continuity management. International Journal of Information Management, 33(5), 743-750.

Section 4.2: The study highlights that a formal BCM process, such as one aligned with ISO 22301, leads to "improved preparedness and optimized recovery processes" by providing a systematic framework for planning and testing. DOI: https://doi.org/10.1016/j.ijinfomgt.2013.05.003

A New Product/Service Assessment is the specific evaluation process that enables senior executives to make informed decisions about building resilience into a development programme. This assessment is an application of the Business Impact Analysis (BIA) and risk assessment principles, as mandated by ISO 22301. It proactively identifies the continuity requirements for new offerings, assesses the potential impacts of a disruption on them, and determines the resources needed to achieve the desired level of resilience. The findings from this evaluation provide the necessary strategic information for top management to approve, modify, or reject the programme based on its resilience posture, ensuring that business continuity is embedded from the design phase rather than being retrofitted later.

A. Resources Allocation: This is an outcome or a decision made after an evaluation has been completed, not the evaluation process itself.

C. Process Evaluation: This term is too generic. While a development programme involves processes, this option does not specify the focus on resilience for new products or services.

D. Adaption: This is a capability or characteristic of a resilient organization, representing the ability to adjust to change, not a formal evaluation process for decision-making.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 8.2.2 (Business impact analysis): This clause requires the organization to "identify the activities that support the provision of its products and services" and "assess the impacts over time of not performing these activities." When a new product or service is developed, this clause necessitates an assessment to understand its resilience requirements, which directly informs senior management decisions.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.

Section 8.2.2 (Guidance on Business impact analysis): This guidance document clarifies that the BIA should be used to "quantify and qualify the impacts of a disruption on its products and services" and that this "information is essential for top management when making strategic decisions about priorities for business continuity." This directly links the assessment of products/services to executive decision-making.

3. Herbane, B. (2019). Rethinking organizational resilience and strategic renewal in SMEs. Entrepreneurship & Regional Development, 31(5-6), 476-495.

DOI: https://doi.org/10.1080/08985626.2018.1541594

This academic paper discusses how organizational resilience involves strategic foresight and renewal, which includes evaluating new business opportunities (such as new products/services) for their potential impact on the organization's overall resilience. This supports the concept of a formal assessment process for new developments.

The Business Impact Analysis (BIA) is a fundamental process within ISO 22301 used to analyze the impact of a disruption on an organization's activities. A core component of this analysis is identifying the resources and dependencies required to deliver products and services. This explicitly includes mapping dependencies between internal processes and activities (Internal Dependencies) as well as dependencies on external entities such as suppliers, utility providers, and outsourced partners (External Dependencies). Validating these dependencies is crucial for understanding the full scope of potential impacts and for establishing realistic recovery time objectives (RTOs).

C. Static Dependencies: This term is not a standard classification within the ISO 22301 BIA framework; the focus is on the organizational source (internal/external) of the dependency.

D. Dynamic Dependencies: Similar to static dependencies, this is not a primary BIA classification. The BIA process categorizes dependencies by their relationship to the organization's boundaries.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, Clause 8.2.2: This clause on Business Impact Analysis requires the organization to "identify dependencies and supporting resources for prioritized activities, including... suppliers and partners...". This directly addresses external dependencies and implies the analysis of inter-process relationships, which are internal dependencies.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301, Clause 8.2.2.3: This guidance document explicitly clarifies the BIA process. It states that an organization should identify "dependencies on other activities (internal or outsourced)" and "dependencies on external organizations (e.g. suppliers, distributors)". This directly supports the validation of both internal and external dependencies.

3. Heng, G. M. (2021). A Manager's Guide to ISO 22301:2019. IT Governance Publishing. Chapter 6, "Operation," Section "Business impact analysis (BIA)": This guide, aligned with the standard, explains that the BIA process involves identifying "the dependencies between business processes, both internal and external, and the resources required to operate the processes." (Paraphrased from concepts in the chapter discussing BIA inputs and outputs).

The Plan-Do-Check-Act (PDCA) cycle is the core methodological paradigm upon which ISO management system standards, including ISO 22301, are built. This iterative, four-stage approach ensures a complete cycle for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving a Business Continuity Management System (BCMS). By following this structure, an organization can systematically manage its processes and ensure that the BCMS achieves its intended outcomes, such as enhanced resilience and the ability to continue operations during a disruption. The standard explicitly maps its clauses to the PDCA cycle to guide implementation and improvement.

B. Kanban Model: This is a workflow management method focused on visualizing work, limiting work in progress, and maximizing flow, not a holistic management system framework.

C. Agile / Scrum Model: These are iterative frameworks used for project management, particularly in software development, and do not represent the overarching cycle of an entire management system.

D. Six Sigma and Lean Process: These are specific process improvement methodologies aimed at reducing defects and eliminating waste, respectively, rather than the foundational structure for a management system.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements. Section 0.3, "Plan-Do-Check-Act (PDCA) cycle," states: "This document applies the Plan-Do-Check-Act (PDCA) cycle to planning, establishing, implementing, operating, monitoring, reviewing, maintaining and continually improving the effectiveness of an organization’s BCMS." It further maps clauses 4, 5, 6, and 7 to 'Plan'; clause 8 to 'Do'; clause 9 to 'Check'; and clause 10 to 'Act'.

2. Hämäläinen, M. (2014). Implementing a Business Continuity Management System based on ISO 22301. Helsinki Metropolia University of Applied Sciences. In Chapter 3.1, "ISO 22301 Standard," the document explains: "The standard is based on the Plan-Do-Check-Act (PDCA) model, which is a four-step management method used for the control and continual improvement of processes and products." (p. 19).

3. Herbane, B. (2019). Rethinking business continuity management. Business Horizons, 62(5), 553-563. This peer-reviewed article discusses the process-oriented approach of modern BCM standards like ISO 22301, noting that they are "based on the ‘plan-do-check-act’ (PDCA) cycle, which is common to other management systems standards" (p. 556). https://doi.org/10.1016/j.bushor.2019.04.005