Pass the PECB ISO 22301 ISO-22301-Lead-Auditor Questions and answers with ExamsMirror

 The Do step in the PDCA cycle implements the previous selected controls to meet the control objectives. According to the ISO 22301 Auditing eBook, the Do step involves implementing and operating the business continuity policy, controls, processes, and procedures that have been planned in the previous step. The Do step also includes establishing the necessary resources, competencies, awareness, communication, and documentation to support the effective operation of the business continuity management system (BCMS). The Do step aims to ensure that the organization is prepared to respond to and recover from disruptive incidents in a timely and effective manner. References: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.

 A risk assessment is a review that uncovers the vulnerability and exposure of the organizational activities to specific types or risk. A risk assessment helps to identify, analyze, and evaluate the potential threats and impacts that could affect the organization’s ability to achieve its objectives and maintain its continuity. A risk assessment also helps to determine the appropriate risk treatment options and controls to reduce the likelihood and/or consequences of the risks. A risk assessment is an essential part of the business continuity management system (BCMS) as it enables the organization to prioritize its business continuity requirements and resources based on the level of risk. References:

ISO 22301 Auditing eBook, page 25

ISO 22301:2019, clause 6.1.2

The Plan-Do-Check-Act (PDCA) paradigm ensures that organizations can effectively complete the full cycle of the management system, thereby achieving its intended outcomes. The PDCA cycle is a four-step iterative process that helps organizations to establish, implement, maintain, and continually improve their management systems. The PDCA cycle consists of the following phases:

Plan: Establish the objectives and processes necessary to deliver the desired results.

Do: Implement the processes as planned.

Check: Monitor and measure the processes and results against the objectives and report the outcomes.

Act: Take actions to improve the performance of the processes, if necessary. The PDCA cycle is also known as the Deming cycle, after its creator, W. Edwards Deming. The PDCA cycle is widely used in various management system standards, including ISO 22301, as it provides a structured approach to achieve continual improvement and customer satisfaction. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

The four phases of the Deming Cycle are Plan, Do, Check, and Act. The Deming Cycle, also known as the PDCA cycle, is a four-step model for continuous improvement of processes, products, or services. The cycle was developed by Dr. W. Edwards Deming, a pioneer of quality management, and is based on the scientific method of problem-solving. The four phases of the Deming Cycle are1:

Plan: Identify the problem or opportunity, analyze the root causes, and establish the objectives and measures for improvement.

Do: Implement the planned solution, test the results, and collect data for evaluation.

Check: Compare the actual results with the expected results, identify the gaps and deviations, and analyze the effectiveness and efficiency of the solution.

Act: Take corrective or preventive actions to close the gaps and prevent recurrence, standardize the solution, and communicate and document the lessons learned. The Deming Cycle is a dynamic and iterative process that can be applied to any type of process, product, or service. The cycle helps to ensure that the improvement is based on facts and data, and that the improvement is monitored and evaluated for further improvement. The Deming Cycle is also aligned with the structure and content of ISO 22301, the international standard for business continuity management systems (BCMS). ISO 22301 follows the Plan-Do-Check-Act approach to establish, implement, maintain, and improve a BCMS that enables an organization to prepare for, respond to, and recover from disruptive incidents2. References:

PDCA (Plan-Do-Check-Act) Cycle in ISO 9001 Requirements - Advisera

ISO 22301:2019 - NQA, page 9

The plan phase in the PDCA cycle establishes the operating framework for the BCMS by defining the scope, objectives, policy, and processes of the BCMS. The plan phase also involves conducting a business impact analysis (BIA) and a risk assessment (RA) to identify the business continuity requirements and strategies. The plan phase is one of the key requirements of ISO 22301, as it provides the foundation and direction for the BCMS implementation and improvement. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

Corporate structure outlines the management hierarchy of the organization, such as the board of directors, the executive management, the business units, the departments, the teams, and the individuals. It defines the roles, responsibilities, authorities, and accountabilities of the organizational members, as well as the reporting and communication lines. Corporate structure also reflects the organization’s culture, values, vision, mission, and strategic objectives. It is importantfor the organization to have a clear and effective corporate structure that supports the implementation and operation of the business continuity management system (BCMS) and ensures the alignment of the business continuity objectives with the strategic direction of the organization. References: ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.1: Scope and Objectives, page 23.

A documentary review is a type of review that involves examining documents, records, or other forms of evidence related to the audit criteria and objectives. It can often be used as a secondary method to support other forms of information collection methods, such as interviews, observations, or sampling. A documentary review can help to verify the existence, implementation, and effectiveness of the audited processes, activities, or controls. It can also provide useful information about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the auditees and other relevant parties. References: ISO 22301 Auditing eBook, page 611; ISO 19011:2018, clause 6.3.22

 The document that is owned by executive management and sets the purpose of BCM in an organization is the Business Continuity Policy. The Business Continuity Policy is a high-level document that defines the scope, objectives, principles, and roles and responsibilities for business continuity management within the organization. It also demonstrates the commitment of top management to support and continually improve the BCMS. The Business Continuity Policy is one of the mandatory documents required by ISO 22301, the international standard for BCMS12.

The other options are not correct because they are not documents that are owned by executive management and set the purpose of BCM in an organization. A Business Process Policy is a document that describes the procedures and rules for performing a specific business process, such as procurement, sales, or accounting. A Register is a document that records and tracks the status of certain items, such as risks, incidents, or assets. A Worksheet is a document that contains data and calculations, such as a spreadsheet or a form.

References: 1: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 5.3 2: ISO 22301 Auditing eBook, Chapter 2.2.2

A personal interview is a type of interview that employs verbal questioning as its principal technique of data collection. It is a face-to-face conversation between the interviewer and the interviewee, where the interviewer asks open-ended or closed-ended questions to obtain information from the interviewee. A personal interview can be conducted in various settings, such as at the interviewee’s workplace, home, or a neutral location. A personal interview can be structured, semi-structured, or unstructured, depending on the level of flexibility and standardization of the questions. A personal interview can be used for different purposes, such as to assess the interviewee’s competence, motivation, attitude, or opinion on a certain topic. A personal interview can also be used to establish rapport, trust, and credibility between the interviewer and the interviewee. A personal interview can have various advantages and disadvantages, such as:

Advantages:

It allows the interviewer to observe the interviewee’s body language, facial expressions, and tone of voice, which can provide additional insights into the interviewee’s feelings, emotions, and reactions.

It enables the interviewer to probe deeper into the interviewee’s responses, clarify ambiguities, and ask follow-up questions to obtain more detailed and comprehensive information.

It gives the interviewer the opportunity to adapt the questions and the pace of the interview according to the interviewee’s level of knowledge, interest, and responsiveness.

It can increase the interviewee’s willingness to participate, cooperate, and disclose information, as the interviewer can establish a personal connection and a positive atmosphere with the interviewee.

It can reduce the possibility of misunderstanding, misinterpretation, or distortion of the information, as the interviewer can verify and confirm the interviewee’s answers immediately.

Disadvantages:

It can be time-consuming, costly, and labor-intensive, as it requires the interviewer to travel to the interviewee’s location, schedule the interview, and conduct the interview.

It can be influenced by various biases, such as the interviewer’s expectations, preferences, stereotypes, or prejudices, which can affect the interviewer’s choice of questions, interpretation of answers, and evaluation of the interviewee.

It can be affected by various factors, such as the interviewer’s skills, personality, appearance, or mood, which can influence the interviewer’s performance, behavior, and interaction with the interviewee.

It can be subject to various errors, such as the interviewer’s memory, recall, or transcription errors, which can result in the loss, omission, or alteration of the information.

It can pose various challenges, such as the interviewer’s difficulty in maintaining control, neutrality, or objectivity, or the interviewee’s reluctance, resistance, or dishonesty, which can hinder the quality and validity of the information.

References:

PECB Certified ISO 22301 Lead Auditor eLearning Training Course1, Module 5: Conducting an ISO 22301 audit, Lesson 5.2: Communication during the audit, Slide 8: Types of interviews

ISO 22301 Auditing eBook2, Chapter 5: Conducting an ISO 22301 audit, Section 5.2: Communication during the audit, Subsection 5.2.1: Types of interviews

 The step in the PDCA cycle that formulates and implements a management plan with actions is the Do step. The Do step is the second phase of the PDCA cycle, following the Plan step. In the Do step, the organization executes the plan that was developed in the Plan step, based on the objectives, policies, and procedures of the business continuity management system (BCMS). The Do step involves implementing the new or improved processes,controls, activities, and measures that are designed to achieve the desired outcomes and performance of the BCMS. The Do step also involves documenting the results and outcomes of the implementation, as well as any problems or deviations that occurred. The Do step provides the basis for the Check step, where the organization monitors and evaluates the effectiveness and efficiency of the implemented plan. References:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 8: Operation2