Pass the PECB ISO 22301 ISO-22301-Lead-Auditor Questions and answers with ExamsMirror

The act step in the PDCA cycle validates improvements by taking actions to address any gaps, nonconformities, or opportunities for improvement identified in the check step. The act step also involves reviewing the effectiveness of the actions taken and determining whether further improvement is possible or necessary. The act step closes the PDCA cycle and leads to a new plan step for the next cycle of continual improvement. The act step is one of the key requirements of ISO 22301, as it demonstrates theorganization’s commitment to enhance its business continuity capability and performance. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

When designing questionnaires for the BIA, the following factors should be considered1:

Concise information: The questionnaires should provide clear and concise information about the purpose, scope, and objectives of the BIA, as well as the instructions on how to complete them. The questionnaires should also avoid unnecessary or redundant questions that could confuse or frustrate the respondents.

Layout: The questionnaires should have a logical and consistent layout that facilitates the readability and comprehension of the questions. The questionnaires should use appropriate fonts, colors, spacing, and numbering to highlight the key points and sections. The questionnaires should also use tables, charts, or graphs to present the data or information in a structured and visual way.

Types of question: The questionnaires should use different types of questions to elicit the required information from the respondents. The questionnaires should use open-ended questions to allow the respondents to provide their own opinions or explanations, closed-ended questions to obtain specific or quantitative data, and rating or ranking questions to measure the relative importance or priority of the factors or criteria.

Level of detail: The questionnaires should provide the appropriate level of detail for the BIA. The questionnaires should not be too general or vague, as this could lead to inaccurate or incomplete results. The questionnaires should not be too specific or technical, as this could overwhelm or intimidate the respondents. The questionnaires should balance the depth and breadth of the information needed for the BIA.

References: 1: ISO 22301 Auditing eBook, Chapter 5: Business Impact Analysis and Risk Assessment, Section 5.2: Business Impact Analysis, Subsection 5.2.3: Data Collection Methods, Page 69.

The step that collates and validates all resource requirements of the selected continuity solutions is the compile step. This step involves gathering all the information about the resources needed to implement and operate the continuity solutions, such as human resources, equipment, facilities, materials, suppliers, partners, etc. The compile step also involves verifying that the resource requirements are realistic, feasible, and consistent with the organization’s objectives, policies, and budget1.

References: 1: ISO 22301 Auditing eBook, Chapter 6: Business Continuity Strategy, Section 6.2: Continuity Solutions, Subsection 6.2.4: Compile, Page 88.

An unambiguous objective is one that is concise and unequivocal, meaning that it is clear, precise, and leaves no room for doubt or confusion. An unambiguous objective is important for business continuity management, as it helps to ensure that the organization and its stakeholders have a common understanding of what is expected and how to measure the progress and achievement of the objective. An unambiguous objective also helps to avoid misunderstandings, conflicts, or disputes that may arise from vague or ambiguous objectives. According to ISO 22301, business continuity objectives should be consistent with the business continuity policy, measurable, monitored, communicated, and updated as appropriate. They should also be SMART: Specific, Measurable, Achievable, Relevant, and Time-based. These criteria help to ensure that the objectives are unambiguous and effective. References: ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.2: Business Continuity Policy, page 25. ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.3: Business Continuity Objectives, page 26.

Business continuity objectives are the objectives that take the form of targets to enhance organizational resilience, as defined by ISO 22301. Business continuity objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Business continuity objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Business continuity objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Business continuity objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2

The Act phase of the PDCA cycle consists of improvement. The Act phase is the fourth and final phase of the PDCA cycle, following the Check phase. In the Act phase, the organization takes action based on what it learned from the Check phase, where it monitored and evaluated the results of the Do phase, where it implemented the plan developed in the Plan phase. The action can be one of the following options1:

If the change was successful, the organization can standardize and stabilize the change, and communicate and document the results and the lessons learned. The organization can also identify opportunities for further improvement and start a new PDCA cycle with a different plan.

If the change was not successful, the organization can identify the root causes of the failure and revise the plan accordingly. The organization can also start a new PDCA cycle with the revised plan or a different plan. The Act phase is the phase where the organization improves its processes and performance by incorporating the learning from the previous phases. The Act phase also helps the organization to sustain the improvement and prevent the recurrence ofproblems. The Act phase is aligned with the clause 10 of ISO 22301, the international standard for business continuity management systems, which requires the organization to improve its business continuity management system by taking corrective actions, addressing nonconformities, and enhancing customer satisfaction2. References:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 10: Improvement2

According to the ISO 22301 Auditing eBook, there are five types of strategies involved in the process-centric approach to business continuity management. They are:

Business continuity strategy: This is the overall approach that provides a framework for ensuring the continuity of an organization’s critical functions in the event of a disruption. It defines the objectives, scope, principles, and policies of the business continuity management system (BCMS).

Recovery strategy: This is the specific approach that defines how an organization will restore its critical functions within a predefined time frame after a disruption. It identifies the resources, actions, and procedures required to recover the critical functions and resume normal operations.

Continuity strategy: This is the specific approach that defines how an organization will maintain its critical functions during a disruption. It identifies the alternative arrangements, methods, and modes of operation that will enable the organization to continue delivering its products or services at an acceptable level of performance.

Mitigation strategy: This is the specific approach that defines how an organization will reduce the likelihood and/or impact of a disruption. It identifies the preventive and protective measures that will minimize the exposure and vulnerability of the organization to potential threats and risks.

Response strategy: This is the specific approach that defines how an organization will react to a disruption. It identifies the roles, responsibilities, and authorities of the incident management team, the communication channels and protocols, and the escalation and notification procedures.

References: ISO 22301 Auditing eBook, pages 40-42

Support does not lay out the foundation of planning and managing the BCMS, but rather provides the necessary resources and arrangements to enable the effective operation of the BCMS. Support includes aspects such as competence, awareness, communication, documented information, and organizational knowledge. The foundation of planning and managing the BCMS is laid out by the leadership and planning clauses of ISO 22301, which define the roles and responsibilities, policies, objectives, and actions to address risks and opportunities for the BCMS. References: ISO 22301 Auditing eBook, page 15 1; ISO 22301:2019, clauses 5, 6, and 7 2

The team that is responsible for determining how the impact of the incident is managed within the policy guidelines set by the strategic team is the tactical team. The tactical team is composed of managers or experts who have the authority and competence to make decisions and allocate resources to implement the business continuity plans and strategies. The tactical team coordinates and communicates with the operational team, which is responsible for executing the recovery and restoration activities, and reports to the strategic team, which is responsible for setting the overall direction and objectives of the incident response1.

References: 1: ISO 22301 Auditing eBook, Chapter 7: Business Continuity Response, Section 7.2: Incident Management Structure, Subsection 7.2.1: Incident Management Teams, Page 103

The key areas of exercise are organisation and plans. According to the ISO 22301 Auditing eBook1, an exercise is a process to train for, assess, practice, and improve performance in an organization. The purpose of an exercise is to evaluate the organization’s capability to respond to a disruptive incident and implement its business continuity plans. Therefore, the key areas of exercise are the organization itself, which includes its structure, roles, responsibilities, resources, and culture, and the plans that define the objectives, scope, scenarios, procedures, and evaluation criteria of the exercise. These two areas are essential to ensure that the exercise is realistic, relevant, effective, and aligned with the organization’s business continuity objectives and expectations. References:

ISO 22301 Auditing eBook, page 71

ISO 22301:2019, clause 8.5