The draft report is amended according to the feedback provided by the respondents.

The statement accurately describes a standard and crucial step in the reporting process within a management system framework like ISO 22301. After an internal audit, exercise, or review, a draft report is prepared and distributed to relevant stakeholders (respondents or auditees). This allows for a review of the findings for factual accuracy and provides an opportunity for feedback. The author of the report then amends the draft based on this validated feedback before issuing the final version. This collaborative process ensures the report is accurate, fair, and accepted, which is essential for driving effective corrective actions and continual improvement.

B. False: This is incorrect. Ignoring feedback from respondents would undermine the credibility and collaborative nature of the audit and review process, leading to potentially inaccurate reports and ineffective corrective actions.

1. ISO 19011:2018, Guidelines for auditing management systems, Clause 6.5, "Preparing and distributing the audit report." This international standard, which provides guidance for all management system audits including ISO 22301, outlines the process of reporting. The established best practice derived from these guidelines includes a review cycle with the auditee to ensure the accuracy of findings before the report is finalized and formally issued.

2. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, Clause 9.2, "Internal audit." This clause mandates that audit results are reported to relevant management. To ensure the report is accurate and useful for management review (Clause 9.3), a draft review and amendment cycle is a necessary and universally accepted procedural step in practice.

3. Herath, T., & Abeykoon, A. (2013). A review of the ISO 22301: 2012 business continuity management system standard. International Journal of Computer Applications, 81(13), pp. 33-34. This academic review discusses the Plan-Do-Check-Act (PDCA) cycle inherent in ISO 22301. The "Check" phase, which includes internal audits and reporting, relies on accurate information. The process of amending a draft report based on feedback is a key quality control measure within this phase to ensure the integrity of the information used for corrective actions ("Act" phase).