Pass the GAQM: Management CBCP-002 Questions and answers with ExamsMirror

A policy statement is a statement that is authorized at an appropriate level and should codify the company’s attitude to a particular risk. A policy statement is a document that defines the scope, objectives, principles, roles, and responsibilities of a business continuity management program. It should also express the organization’s commitment to managing risks and ensuring continuity of its critical functions and processes. A policy statement should be approved by senior management and communicated to all relevant stakeholders. Verified References: https://www.iso.org/publication/PUB100442.html https://phoenixnap.com/blog/what-is-business-continuity-management

Risks are diverse and arise from both external and internal sources. This is true because risks are uncertainties that can have positive or negative effects on an organization’s objectives. Risks can arise from various sources that are either outside or inside the organization’s control. External sources of risk include natural disasters, cyberattacks, market fluctuations, customer preferences, competition, regulation, or political instability. Internal sources of risk include human error, fraud, system failure, process inefficiency, organizational culture, or strategic decisions. Verified References: https://www.investopedia.com/terms/b/businessrisk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Technical risk is the type of risk that is associated with risk of physical assets failing/being damaged or enhanced. Technical risk is the uncertainty or variability of the performance or reliability of physical assets, such as equipment, systems, infrastructure, or data. Technical risk can result from factors such as design flaws, manufacturing defects, maintenance issues, obsolescence, human error, natural disasters, or cyberattacks. Technical risk can affect an organization’s operational efficiency, quality, safety, security, or profitability. Verified References: https://www.investopedia.com/terms/t/technical-risk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Operational risk is the type of risk that is related to human error or achievement. Operational risk is the uncertainty or variability of the execution or outcome of an organization’s functions or processes. Operational risk can result from factors such as inadequate policies, procedures, systems, controls, skills, training, supervision, or compliance. Operational risk can affect an organization’s operational efficiency, quality, safety, security, reputation, or profitability. Verified References: https://www.investopedia.com/terms/o/operational_risk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

The frequency of BCP testing for critical processes is a fundamental aspect of ensuring a plan remains effective and relevant. Business Continuity Professional standards, such as those from DRI International and ISO 22301, provide guidance on testing frequency based on the criticality of processes and organizational needs.

Annually: Industry standards recommend that critical processes undergo comprehensive BCP testing at least once a year. This ensures that plans are validated, personnel are trained, and any gaps or changes in the business environment are addressed. Annual testing is considered a baseline requirement for maintaining resilience, particularly for critical functions that, if disrupted, could severely impact the organization.

Quarterly: While more frequent testing (e.g., quarterly) may be appropriate for highly dynamic environments or specific high-risk processes, it is not a universal requirement for all critical processes. Quarterly testing is typically reserved for specific scenarios or as part of a progressive testing strategy rather than a standard frequency.

As per calendar planned at beginning of the year: This option implies a flexible schedule, but it lacks specificity and does not align with standardized recommendations. Testing should follow a defined frequency rather than an arbitrary calendar plan unless explicitly tied to a standard (e.g., annual).

Half-yearly: Semi-annual testing (every six months) may be adopted by some organizations for additional assurance, but it exceeds the minimum standard requirement of annual testing for critical processes unless specified by organizational policy or regulatory mandates.

The verified answer,A. Annually, reflects the widely accepted minimum frequency for testing critical processes as per Business Continuity Professional guidelines. However, organizationsmay increase frequency based on risk assessments or regulatory requirements, though this is not the default expectation.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 9: Testing and Exercising – Recommends annual testing as a minimum for critical processes.

ISO 22301:2019, Clause 8.5 – Specifies regular testing and exercising, with annual frequency as a common benchmark for critical functions.

Strategic management is the type of management that is an often used term, but has so many different connotations to different people that invariably the message of its meaning gets confused. Strategic management is the process of defining and executing the long-term vision, goals, plans, and actions of an organization. Strategic management involves analyzing the internal and external environment, formulating strategies, implementing them, and evaluating their outcomes. Strategic management can be complex and challenging, as it requires alignment and integration of various aspects of the organization, such as culture, structure, resources, capabilities, stakeholders, markets, competitors, or regulations. Verified References: https://www.investopedia.com/terms/s/strategic-management.asp https://phoenixnap.com/blog/what-is-business-continuity-management

Business impact analysis (BIA) is the process of identifying and prioritizing the organization’s functions and processes based on their importance to the organization’s objectives, and assessing the potential impacts of a disruption to those functions and processes over time. The BIA helps to determine the recovery time objectives (RTOs), recovery point objectives (RPOs), and resource requirements for each function and process, as well as the interdependencies and dependencies among them. The BIA provides the basis for developing recovery strategies and plans. Verified References: https://www.ready.gov/business-impact-analysis https://drii.org/resources/professionalpractices/EN

The four T’s of risk guidance produced by the Office of Government Commerce are transfer, tolerate, treat, and terminate. They are:

Transfer: This strategy involves transferring or sharing some or all of the responsibility or impact of a risk to another party, such as an insurer, a supplier, or a partner.

Tolerate: This strategy involves accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified.

Treat: This strategy involves taking steps to reduce the likelihood or impact of a risk to an acceptable level, such as implementing controls, mitigations, or contingency plans.

Terminate: This strategy involves eliminating or avoiding a risk by discontinuing or changing the activity that causes it. Verified References:https://www.investopedia.com/terms/t/the-four-ts.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

A Business Continuity Plan (BCP) is designed to ensure an organization can maintain or resume critical functions during and after a disruption. According to Business Continuity Professional standards, such as those from DRI International and ISO 22301, the BCP typically encompasses three core components that address different phases of response and recovery:

A. Emergency response: This component focuses on the immediate actions taken during a disruption (e.g., evacuation, safety measures, and initial coordination). It is a foundational part of the BCP, ensuring personnel and asset safety as a prerequisite to continuity and recovery efforts.

B. Incident management: While incident management (handling and resolving incidents) is critical in broader crisis management frameworks, it is often considered a distinct process under an Incident Response Plan (IRP) rather than a core BCP component. It overlaps with BCP but is not universally listed as one of the three primary elements.

C. Problem management: This is an IT service management process (e.g., under ITIL) focused on identifying and resolving the root causes of incidents. It is not a standard component of a BCP, which prioritizes continuity and recovery over long-term problem resolution.

D. Business recovery: This involves restoring critical business functions and processes after a disruption, ensuring the organization can resume normal operations. It is a central pillar of the BCP, addressing recovery time objectives (RTOs) and operational continuity.

E. Disaster recovery: This focuses on recovering IT systems, data, and infrastructure following a disaster. Often integrated into the BCP, it ensures technological continuity, making it a key component alongside business recovery and emergency response.

The verified answer isA. Emergency response, D. Business recovery, E. Disaster recovery, as these three components collectively cover the lifecycle of a BCP—immediate response, business function restoration, and IT recovery—per established standards. While incident management is related, it is typically supplementary rather than a core BCP element when narrowed to three components.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 6: Business Continuity Plan Development – Identifies emergency response, business recovery, and disaster recovery as key BCP components.

ISO 22301:2019, Clause 8.4 – Outlines planning for response (emergency), continuity (business recovery), and IT recovery (disaster recovery) as integral to BCP.

Contingency planning is the type of planning that requires the commitment of significant financial and human resources for situations that may never even occur. Contingency planning is the process of developing alternative courses of action in case the preferred plan fails or an unexpected event occurs. Contingency planning aims to reduce the impact and uncertainty of potential disruptions and ensure the continuity of the organization’s functions and processes. Contingency planning can be costly and time-consuming, as it involves identifying risks, analyzing scenarios, developing strategies, testing plans, and maintaining readiness. Verified References: https://www.iso.org/publication/PUB100442.html https://phoenixnap.com/blog/what-is-business-continuity-management