PECB Updated ISO-22301-Lead-Auditor Exam Questions and Answers by alaina

ISO 22301 is the system/standard that brings together all existing standards and a collection of good practices to develop a universal approach to Business Continuity Management (BCM). ISO 22301 is the international standard for Security and resilience — Business continuity management systems — Requirements. It specifies the requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise. ISO 22301 is based on the high-level structure (HLS) that provides a common framework for all management system standards. This helps to ensure consistency and alignment with other standards, such as ISO 9001 (quality management), ISO 14001 (environmental management), ISO 27001 (information security management), etc. ISO 22301 also incorporates the best practices and guidance from other sources, such as ISO 22313 (guidelines for business continuity management systems), ISO 22317 (guidelines for business impact analysis), ISO 22318 (guidelines for supply chain continuity), ISO 22320 (guidelines for incident management), ISO 22398 (guidelines for exercises and testing), etc. ISO 22301 aims to provide a universal approach to BCM that is applicable to all types and sizes of organizations, regardless of their nature, sector, or location. References:

• ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements1
• ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.2: ISO 22301 Standard2
• ISO 22301 - Business Continuity2

According to the ISO 22301 Auditing eBook, likelihood is defined as "the chance of something happening, whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or mathematically (such as a probability or a frequency over a given time period)"1. Likelihood is one of the factors that determine the level of risk, along with the impact or consequence of an event. The probability of a threat or risk to occur is therefore equivalent to the likelihood of that event.

References: : ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.2: Terms and definitions, Page 23.

According to ISO 22301:2019, Clause 6.2, the organization must establish business continuity objectives at relevant functions and levels. The business continuity objectives must be consistent with the business continuity policy, measurable, monitored, communicated, and updated as appropriate. The organization must also retain documented information on the business continuity objectives. One of the elements that should be included in the documented information is the timescale for the task completion. The timescale is the period of time within which the task or activity must be completed, such as hours, days, weeks, or months. The timescale helps to define the expected performance and results of the business continuity management system (BCMS), and to evaluate the progress and effectiveness of the implementation and operation of the BCMS. References: ISO 22301:2019, Clause 6.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

A multidisciplinary function encompasses the knowledge and skills of a diverse group of professionals to manage the corporate Business Continuity Management programme.According to the ISO 22301 Auditing eBook, "Business continuity is a multidisciplinary function that involves several different departments and business units, such as IT, human resources, finance, legal, public relations, etc. Each of these departments and units has a role and responsibility in ensuring the continuity of the organization’s critical activities and processes in the event of a disruption. Therefore, a business continuity auditor needs to have a broad understanding of the various aspects and functions of the organization, as well as the specific requirements and expectations of each stakeholder group."1 References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.2: Business Continuity Auditor Competencies1