Free Practice Questions for PECB ISO-22301-Lead-Auditor Exam

The plan phase in the PDCA cycle establishes the operating framework for the BCMS by defining the scope, objectives, policy, and processes of the BCMS. The plan phase also involves conducting a business impact analysis (BIA) and a risk assessment (RA) to identify the business continuity requirements and strategies. The plan phase is one of the key requirements of ISO 22301, as it provides the foundation and direction for the BCMS implementation and improvement. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

Succession planning is the type of planning that minimizes impacts due to the unavailability of key staff. Succession planning is a process of identifying and developing potential successors for key positions in an organization. It helps to ensure the continuity of leadership and critical skills in the event of staff turnover, retirement, resignation, illness, death, or any other cause of unavailability. Succession planning is an important component of business continuity management, as it helps to reduce the risk of disruption and loss of performance due to the loss of key staff. Succession planning also helps to retain and motivate high-potential employees, as well as to enhance the organization’s reputation and attractiveness as an employer. Succession planning should be aligned with the organization’sstrategic objectives, culture, and values. It should also be based on a systematic assessment of the current and future needs of the organization, as well as the competencies and potential of the existing and prospective staff. Succession planning should involve the participation and commitment of senior management, human resources, and the relevant staff. It should also be reviewed and updated regularly to reflect the changing circumstances and needs of the organization. References:

ISO/TS 30433:2021 - Human resource management — Succession planning metrics cluster1

ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.4: Business Continuity Strategy2

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 7.2: Competence3

The Statement of Applicability (SOA) is a document that identifies the applicable requirements of ISO 22301 and explains how they are addressed by the organization’s Business Continuity Management System (BCMS). The SOA is prepared during the planning phase of the PDCA cycle, as part of the process of establishing the BCMS scope, objectives, and policy. The SOA is based on the results of the business impact analysis, risk assessment, and risk treatment, and it provides a rationale for the inclusion or exclusion of each requirement. The SOA also helps to demonstrate the conformity of the BCMS with the standard and to communicate the BCMS scope and objectives to interested parties. References: ISO 22301:2019, Clause 6.1.3; ISO 22301 Auditing eBook, Chapter 4.2.2.

 Most government policies have direct influences on how organizations shape their business strategies and plans, as they affect the legal, regulatory, economic, and social environment in which the organizations operate. Government policies can create opportunities or threats for the organizations, depending on their nature and impact. For example, government policies can affect the taxation, trade, security, environmental, and human rights aspects of the organizations’ activities. Therefore, organizations need to monitor and analyze the government policies that are relevant to their business objectives and interests, and adapt their business strategies and plans accordingly. This is also important for the business continuity management system (BCMS), as it helps the organizations to identify and address the risks and opportunities related to the government policies, and to ensure the compliance and resilience of their BCMS. References: ISO 22301 Auditing eBook, page 13 1; ISO 22301:2019, clause 4.1 2

According to the ISO 22301 Auditing eBook, there are five types of strategies involved in the process-centric approach to business continuity management. They are:

Business continuity strategy: This is the overall approach that provides a framework for ensuring the continuity of an organization’s critical functions in the event of a disruption. It defines the objectives, scope, principles, and policies of the business continuity management system (BCMS).

Recovery strategy: This is the specific approach that defines how an organization will restore its critical functions within a predefined time frame after a disruption. It identifies the resources, actions, and procedures required to recover the critical functions and resume normal operations.

Continuity strategy: This is the specific approach that defines how an organization will maintain its critical functions during a disruption. It identifies the alternative arrangements, methods, and modes of operation that will enable the organization to continue delivering its products or services at an acceptable level of performance.

Mitigation strategy: This is the specific approach that defines how an organization will reduce the likelihood and/or impact of a disruption. It identifies the preventive and protective measures that will minimize the exposure and vulnerability of the organization to potential threats and risks.

Response strategy: This is the specific approach that defines how an organization will react to a disruption. It identifies the roles, responsibilities, and authorities of the incident management team, the communication channels and protocols, and the escalation and notification procedures.

References: ISO 22301 Auditing eBook, pages 40-42

The Plan-Do-Check-Act (PDCA) paradigm ensures that organizations can effectively complete the full cycle of the management system, thereby achieving its intended outcomes. The PDCA cycle is a four-step iterative process that helps organizations to establish, implement, maintain, and continually improve their management systems. The PDCA cycle consists of the following phases:

Plan: Establish the objectives and processes necessary to deliver the desired results.

Do: Implement the processes as planned.

Check: Monitor and measure the processes and results against the objectives and report the outcomes.

Act: Take actions to improve the performance of the processes, if necessary. The PDCA cycle is also known as the Deming cycle, after its creator, W. Edwards Deming. The PDCA cycle is widely used in various management system standards, including ISO 22301, as it provides a structured approach to achieve continual improvement and customer satisfaction. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

The PDCA paradigm cycle is widely recognized as a process-centric approach. The PDCA cycle, also known as the Deming cycle or the Shewhart cycle, is a four-step model for carrying out change and improvement in a systematic and consistent way. The PDCA cycle consists of the following phases: Plan, Do, Check, and Act. The Plan phase involves identifying the problem, setting the objectives, and developing the plan for improvement. The Do phase involves implementing the plan and carrying out the actions. The Check phase involves monitoring and measuring the results and comparing them with the objectives. The Act phase involves taking corrective actions, standardizing the improvement, and reviewing the process. The PDCA cycle is a process-centric approach because it focuses on the processes and their interactions that deliver the desired outcomes and performance. The PDCA cycle helps to ensure that the processes are planned, executed, evaluated, and improved in a continuous and consistent manner. The PDCA cycle is also aligned with the process approach principle of ISO 22301, the international standard for business continuity management systems. ISO 22301 requires the organization to apply the PDCA cycle to its business continuity management system, as well as to its individual processes and activities. The PDCA cycle helps the organization to establish, implement, operate, monitor, review, maintain, and continually improve its business continuity management system and its ability to respond to and recover from disruptive incidents. References:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 0.3: The Plan-Do-Check-Act cycle2

What is the Plan-Do-Check-Act (PDCA) Cycle?3

Process-oriented objectives are the objectives that focus on the BCM activities that support the achievement of people-and performance-oriented objectives, as defined by ISO 22301. Process-oriented objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Process-oriented objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Process-oriented objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Process-oriented objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2

 The scope of the business continuity management system (BCMS) is the statement that defines the boundaries and applicability of the BCMS. It specifies which products, services, processes, locations, and organizational units are covered by the BCMS, as well as any exclusions or limitations. The scope should document and explain any exclusions, which are the products, services, or processes that are not within the scope of the BCMS. Exclusions may be justified for various reasons, such as:

The products, services, or processes are not critical to the organization’s operations and objectives.

The products, services, or processes are already covered by other management systems or plans.

The products, services, or processes are outside the organization’s control or influence.

The products, services, or processes are not relevant or applicable to the organization’s context or needs.

However, the exclusions should not affect the organization’s ability to provide products and services that meet the requirements and expectations of its interested parties. The exclusions should also not compromise the conformity of the BCMS with the requirements of ISO 22301, the international standard for business continuity management systems. The scope and the exclusions should be documented in a clear and concise manner, and communicated to all relevant stakeholders. The scope and the exclusions should also be reviewed and updated regularly to reflect the changing circumstances and needs of the organization. References:

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 4.3: Determining the scope of the business continuity management system1

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Integration, Section 3.1: Business Continuity Integration Levels2

ISO 22301 Clause 4.3 Determining the Scope of the Business Continuity Management System3

Business continuity objectives are the objectives that take the form of targets to enhance organizational resilience, as defined by ISO 22301. Business continuity objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Business continuity objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Business continuity objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Business continuity objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2