Free ISO-BCMS-22301 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

A New Product/Service Assessment is the specific evaluation process that enables senior executives to make informed decisions about building resilience into a development programme. This assessment is an application of the Business Impact Analysis (BIA) and risk assessment principles, as mandated by ISO 22301. It proactively identifies the continuity requirements for new offerings, assesses the potential impacts of a disruption on them, and determines the resources needed to achieve the desired level of resilience. The findings from this evaluation provide the necessary strategic information for top management to approve, modify, or reject the programme based on its resilience posture, ensuring that business continuity is embedded from the design phase rather than being retrofitted later.

A. Resources Allocation: This is an outcome or a decision made after an evaluation has been completed, not the evaluation process itself.

C. Process Evaluation: This term is too generic. While a development programme involves processes, this option does not specify the focus on resilience for new products or services.

D. Adaption: This is a capability or characteristic of a resilient organization, representing the ability to adjust to change, not a formal evaluation process for decision-making.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 8.2.2 (Business impact analysis): This clause requires the organization to "identify the activities that support the provision of its products and services" and "assess the impacts over time of not performing these activities." When a new product or service is developed, this clause necessitates an assessment to understand its resilience requirements, which directly informs senior management decisions.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.

Section 8.2.2 (Guidance on Business impact analysis): This guidance document clarifies that the BIA should be used to "quantify and qualify the impacts of a disruption on its products and services" and that this "information is essential for top management when making strategic decisions about priorities for business continuity." This directly links the assessment of products/services to executive decision-making.

3. Herbane, B. (2019). Rethinking organizational resilience and strategic renewal in SMEs. Entrepreneurship & Regional Development, 31(5-6), 476-495.

DOI: https://doi.org/10.1080/08985626.2018.1541594

This academic paper discusses how organizational resilience involves strategic foresight and renewal, which includes evaluating new business opportunities (such as new products/services) for their potential impact on the organization's overall resilience. This supports the concept of a formal assessment process for new developments.

The "Plan" phase of the Plan-Do-Check-Act (PDCA) cycle is where the foundation of the Business Continuity Management System (BCMS) is built. This stage involves understanding the organization and its context, determining the scope of the BCMS, and establishing the business continuity policy, objectives, controls, processes, and procedures. In essence, it is the phase dedicated to designing and establishing the entire operating framework required to deliver results that align with the organization's overall strategic goals, as mandated by ISO 22301.

B. Do: This phase is for implementing and operating the BCMS framework that was established during the "Plan" phase, not for creating the framework itself.

C. Check: This phase involves monitoring, measuring, and reviewing the performance of the implemented BCMS against the established policy and objectives.

D. Act: This phase focuses on maintaining and continually improving the BCMS by taking corrective and preventive actions based on the results of the "Check" phase.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. International Organization for Standardization. Section 0.3, "Plan-Do-Check-Act (PDCA) model", states for "Plan": "establish business continuity policy, objectives, controls, processes and procedures relevant to improving business continuity in order to deliver results that align with the organization’s overall policies and objectives."

2. Heng, G. M. (2021). Business Continuity Management System: A Complete Guide to Organizational Resilience (ISO 22301). IT Governance Publishing. Chapter 3, "The Plan-Do-Check-Act (PDCA) cycle," details how the Plan phase (Clauses 4, 5, 6, and 7) is used to establish the BCMS.

3. Ab-Al-Hameed, H. A., Al-Shargabi, B., & Al-Mekhlafi, A. A. (2021). Implementation of Business Continuity Management System according to ISO 22301: A case study in a university. International Journal of Information Management Data Insights, 1(2), 100041. Section 3.1, "Plan Phase," describes this stage as where "the BCMS policy, objectives, processes, and procedures are established." https://doi.org/10.1016/j.jjimei.2021.100041

A "Management System" is the formal term for the framework of policies, objectives, processes, and procedures that an organization establishes to achieve its goals. As defined by the International Organization for Standardization (ISO), it is a set of interrelated or interacting elements used to direct and control an organization regarding a specific discipline, such as business continuity (ISO 22301), quality (ISO 9001), or information security (ISO 27001). This system provides the structure to translate strategic intent into operational actions and continuous improvement, which directly aligns with the description in the question.

B. Life Cycle Process System: This term is typically associated with product or system development (e.g., SDLC), focusing on stages from inception to retirement, not the overall organizational strategy.

C. Corporate Management System: This is a descriptive but non-standard term. The official and universally accepted terminology within ISO standards is simply "Management System."

D. Enterprise Management System: While a management system operates at an enterprise level, this term often refers to large-scale software (like ERP) and is not the formal ISO definition.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 3.4: Defines a "management system" as a "set of interrelated or interacting elements of an organization to establish policies and objectives and processes to achieve those objectives." This definition directly supports the correct answer.

2. International Organization for Standardization (ISO). (2021). ISO/IEC Directives, Part 1, Consolidated ISO Supplement — Procedures specific to ISO.

Annex SL, Appendix 2: Provides the high-level structure, identical core text, and common terms and core definitions for all management system standards. The definition for "management system" (Clause 3.11) is consistent with the one in ISO 22301, reinforcing it as the standard term for a framework that turns strategy into action.

3. Asgary, A. (2021). Business Continuity and Disaster Recovery Management. York University.

Module 1: Introduction to BCM: Course materials often explain that a Business Continuity Management System (BCMS) is a specific type of "management system" that provides a systematic approach for organizations to plan, implement, and improve their business continuity capabilities, aligning with the organization's overall strategic objectives.

Process-oriented objectives are foundational to a Business Continuity Management System (BCMS). They focus on the effectiveness, efficiency, and maturity of the BCM activities and procedures themselves. By establishing and achieving objectives related to the core processes—such as business impact analysis, risk assessment, plan development, and exercising—an organization builds the necessary capability and resilience. This process capability is what enables the organization to subsequently meet its higher-level, outcome-focused objectives, which include performance-oriented goals (e.g., meeting Recovery Time Objectives) and people-oriented goals (e.g., ensuring workforce safety and effective communication during a crisis). Therefore, process-oriented objectives govern the activities that support the achievement of people and performance outcomes.

B. Performance-oriented: These are the desired outcomes or results of the BCM activities, not the objectives for the activities themselves. They measure the success of the implemented processes.

C. People-oriented: These are also desired outcomes, focusing specifically on the well-being, safety, and preparedness of personnel, which are achieved through the execution of effective BCM processes.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. Clause 6.2, "Business continuity objectives and planning to achieve them," mandates that an organization must plan what will be done and how the results will be evaluated to achieve its objectives. This focus on the "what" (the activity) and "how" (the method) is the essence of a process-oriented approach, which forms the basis for achieving performance and people-related outcomes.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301. Section 6.2 explains that objectives are set to implement the business continuity policy and improve the overall effectiveness of the BCMS. Improving the BCMS inherently means improving its constituent processes and activities, which in turn supports the achievement of strategic outcomes related to performance and people.

3. Jakovljevic, D. (2013). Model of business continuity management system based on the process approach. International Journal for Quality Research, 7(1), 111-124. This academic paper emphasizes that the process approach is central to the successful implementation of a BCMS. It states, "The process approach is one of the basic principles of the management system... The desired result is achieved more efficiently when activities and related resources are managed as a process" (p. 113). This supports the idea that process-oriented objectives are the mechanism for achieving all other desired results, including those related to people and performance.

According to ISO 22301:2019, Clause 4.3, "Determining the scope of the business continuity management system," the organization must define the boundaries and applicability of the BCMS. This scope must be available as documented information. By defining the boundaries of what is included (e.g., specific locations, processes, products, services), the organization inherently and explicitly documents what is excluded. This clarity is crucial for interested parties to understand the extent and limits of the BCMS's coverage. The justification for these boundaries, and therefore any exclusions, is derived from the analysis of the organization's context and the requirements of its interested parties.

A. The scope must consider both internal and external issues, as well as the needs of interested parties, not just internal needs (ISO 22301:2019, Clauses 4.1 & 4.2).

B. The BCMS can be applied to the entire organization or to specific parts of it; it is not required to always cover the whole organization (ISO 22301:2019, Clause 4.3.1).

D. The scope must be reviewed and can be changed to ensure its continued suitability, especially as part of management reviews and continual improvement processes (ISO 22301:2019, Clause 9.3).

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Clause 4.3.1 General: States, "The organization shall determine the boundaries and applicability of the business continuity management system to establish its scope."

Clause 4.3.2 Scope of the BCMS: Mandates that "The organization shall: a) define the scope by determining the boundaries and applicability of the BCMS... b) document the scope and make it available." This documentation of boundaries serves to clarify inclusions and exclusions.

2. Herbane, B. (2019). Rethinking business continuity management. Business Horizons, 62(5), 553-563.

Section 3, "A strategic perspective on BCM" (p. 556): The paper discusses the strategic alignment of BCM, which necessitates a clearly defined and justified scope. It implies that the rationale for the BCMS's boundaries (including what is not covered) must be understood and communicated, aligning with the principle of documenting and explaining exclusions. DOI: https://doi.org/10.1016/j.bushor.2019.05.003

3. Järveläinen, J. (2013). IT incidents and business impacts: A classification and the role of business continuity management. International Journal of Information Management, 33(5), 742-750.

Section 4.2, "Business continuity management" (p. 746): This article emphasizes that a key activity in BCM is defining the scope, which involves identifying critical business processes. This selection process inherently excludes non-critical processes, and the rationale for this scoping must be clear and documented for the BCMS to be effective. DOI: https://doi.org/10.1016/j.ijinfomgt.2013.05.003

Performance evaluation, audit, and benchmarking are integral components of the "Check" phase within the Plan-Do-Check-Act (PDCA) continual improvement cycle, which is the foundational model for ISO 22301. The primary objective of these activities is to systematically assess the performance and effectiveness of the Business Continuity Management System (BCMS). The findings, non-conformities, and opportunities identified through these evaluations serve as direct inputs for the "Act" phase. This phase is focused on taking corrective actions and making enhancements, which is the essence of process optimization and continual improvement as mandated by the standard.

A. Testing: Testing is a specific validation activity for plans and procedures, not the overarching concept that encompasses performance evaluation, auditing, and benchmarking for improvement purposes.

B. Evaluation: This term is too generic and circular, given that "performance evaluation" is already stated in the question. It fails to describe the ultimate goal of these activities.

D. Organizational Management: This is an excessively broad field. While a BCMS operates within organizational management, this option is not specific to the improvement-focused purpose of the listed activities.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 9, "Performance evaluation": This clause mandates the organization to evaluate the performance and effectiveness of the BCMS through monitoring, measurement, internal audit, and management review.

Clause 10.2, "Continual improvement": This clause explicitly links the outputs of performance evaluation to improvement, stating, "The organization shall continually improve the suitability, adequacy and effectiveness of the business continuity management system." The inputs for this improvement come directly from the results of analysis, evaluation, audits, and management reviews (Clause 9). This demonstrates that the purpose of evaluation is optimization.

2. Zairi, M. (1994). "Benchmarking: the best tool for measuring competitiveness." Benchmarking for Quality Management & Technology, 1(1), 11-24.

Page 12, Section "The process of benchmarking": This academic paper establishes benchmarking as a "continuous process of measuring products, services, and practices against the toughest competitors or those companies recognized as industry leaders." The goal is to identify gaps in performance and implement changes to achieve superiority, which is a form of process optimization.

3. Karabegović, I., & Vugdalić, N. (2013). "The Importance of the Application of PDCA Cycle in the Process of Improving the Quality of a Product." Tehnički vjesnik, 20(2), 309-314.

Page 310: This paper explains the PDCA cycle in the context of ISO standards, stating that the "Check" phase involves "monitoring and measuring processes and products... and reporting the results." The subsequent "Act" phase involves "taking actions to continually improve process performance," directly linking evaluation activities (like audits and performance measurement) to process improvement and optimization.

Communication is the fundamental process that engages both internal staff and external stakeholders throughout all phases of the Business Continuity Management System (BCMS). According to ISO 22301, an organization must establish, implement, and maintain planned communication arrangements. This involves determining what, when, with whom, and how to communicate with all relevant interested parties. This systematic approach ensures that stakeholders are kept informed, their requirements are understood, and they are actively involved in relevant aspects of the BCMS, from initial planning and risk assessment to incident response and continual improvement. This makes communication the core mechanism for comprehensive engagement.

B. Analysis: Analysis (e.g., Business Impact Analysis) is a specific technical activity to identify priorities and requirements; it is not the overarching process for engaging all stakeholders in all BCMS aspects.

C. Coordination: Coordination is a critical function, especially during an incident or exercise, but it is a reactive or operational activity rather than the continuous, all-encompassing process of engagement.

D. Management: Management provides leadership and resources for the BCMS. It is a function of governance that utilizes communication to achieve engagement, but it is not the engagement process itself.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 7.4 "Communication": This clause explicitly requires the organization to "determine the internal and external communications relevant to the BCMS including: a) on what it will communicate; b) when to communicate; c) with whom to communicate; d) how to communicate." This establishes communication as the formal process for engaging all interested parties.

Clause 4.2 "Understanding the needs and expectations of interested parties": This clause requires identifying stakeholders (staff, suppliers, customers, regulators) and their needs, which are then addressed largely through the communication processes defined in Clause 7.4.

2. Wong, W. C. (2020). A Competency-Based Approach to Business Continuity. Routledge.

Chapter 4, Section: "Communication with Stakeholders": This academic text emphasizes that "Effective communication is vital for engaging stakeholders at all levels... A BCMS requires a communication strategy that addresses the needs of internal employees, external partners, customers, and regulatory bodies throughout the business continuity lifecycle." This supports communication as the key engagement mechanism.

3. Bajgoric, N. (2014). Business continuity management: a systemic framework for implementation. Kybernetes, 43(2), 214-231. https://doi.org/10.1108/K-06-2013-0115

The paper discusses BCM as an integrated system where communication flows are essential for linking different components and stakeholders. It highlights that "continuous communication with all stakeholders is a critical success factor for embedding BCM into the organizational culture" (paraphrased from discussion on systemic integration).

Corporate structure, also referred to as organizational structure, formally defines the tasks, reporting relationships, and communication channels that link the work of diverse individuals and groups. It is the framework that outlines the management hierarchy, establishing clear lines of authority and responsibility. Within the context of ISO 22301, understanding the organization's corporate structure is a fundamental requirement (Clause 4.1) for establishing a Business Continuity Management System (BCMS), as it determines how roles, responsibilities, and authorities (Clause 5.3) are assigned and managed.

B. Corporate Service: This term refers to the functions or services provided by a corporation, either internally (e.g., IT, HR) or externally to customers, not its management hierarchy.

C. Corporate Improvement: This describes processes and initiatives, such as those guided by the Plan-Do-Check-Act (PDCA) cycle, aimed at enhancing organizational performance, not its structural framework.

D. Corporate Defences: This term typically relates to strategies used to prevent hostile takeovers or manage major external threats; it does not describe the internal reporting structure of an organization.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Clause 4.1, "Understanding the organization and its context," states that the organization must determine internal issues relevant to its purpose, which can be related to "governance, organizational structure, roles and accountabilities." This directly links organizational structure to the foundational understanding of the organization's hierarchy.

Clause 5.3, "Roles, responsibilities and authorities," requires top management to assign and communicate responsibilities and authorities, which are defined and operationalized through the established corporate structure.

2. Hiles, A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons.

Chapter 4, "Policy and Programme Management," discusses the necessity of defining the organizational structure for business continuity. It emphasizes that a clear structure is essential for assigning roles and responsibilities, ensuring accountability, and establishing the hierarchy for decision-making during a disruption.

3. Robbins, S. P., & Coulter, M. (2018). Management (14th ed.). Pearson.

Chapter 10, "Basic Organizational Design," defines organizing as "arranging and structuring work to accomplish the organization’s goals." It explicitly states that organizational structure is the "formal arrangement of jobs within an organization," which includes the chain of command or management hierarchy.

The statement is correct. According to the ISO 22301:2019 standard, top management's leadership and commitment are fundamental to the success of a Business Continuity Management System (BCMS). This commitment must be active and visible ("outgoing"). Actions such as establishing the BC policy, communicating the importance of business continuity, ensuring resource availability, and promoting continual improvement are direct responsibilities of leadership. These actions set the organizational tone and are essential for embedding business continuity principles into the corporate culture, ensuring that it is understood, valued, and practiced throughout the organization.

B. False: This is incorrect. The ISO 22301 standard explicitly requires top management to demonstrate leadership and commitment. Without this, a BCMS is likely to fail, and a positive business continuity culture cannot be effectively established or sustained.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 5.1, "Leadership and commitment," states: "Top management shall demonstrate leadership and commitment with respect to the business continuity management system by: ... d) communicating the importance of effective business continuity management and of conforming to the BCMS requirements; ... f) directing and supporting persons to contribute to the effectiveness of the BCMS; g) promoting continual improvement." These actions directly foster and embed an organizational culture.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.

Section 5.1, "Leadership and commitment," provides guidance, explaining that top management's visible involvement is critical for creating a culture where business continuity is considered an integral part of how the organization operates. It clarifies that this commitment drives the integration of the BCMS into the organization's culture.

3. Bajgoric, N. (2014). Business Continuity Management: A Systemic View. International Journal of Information Systems and Social Change (IJISSC), 5(3), 1-17.

Page 8, Section "Critical Success Factors for BCM," identifies "Top management support" as a primary critical success factor. The publication emphasizes that this support is crucial for providing vision, allocating resources, and overcoming resistance, which are all necessary components for embedding a BCM culture. DOI: 10.4018/ijissc.2014070101

In the context of ISO 22301, a Business Continuity Management System (BCMS) is established and maintained as a holistic, strategic initiative. This is best described as Programme Management. A BCM programme coordinates a set of related projects, processes, and activities (e.g., business impact analysis, risk assessment, plan development, exercising) to achieve the strategic objective of organizational resilience. This framework operates as a continuous and progressive cycle of planning, implementation, evaluation, and improvement, rather than a single, finite project. It requires sustained support and resources from managerial, operational, administrative, and technical functions across the organization to be effective.

A. Product Management: This framework is incorrect as it focuses on the lifecycle of a specific product or service, not the overarching organizational capability of business continuity.

B. Project Management: This is incorrect because projects are temporary endeavors with a defined start and end. A BCMS is an ongoing, permanent function, not a one-time project.

D. Process Management: While a BCMS consists of many processes that are continuously improved (using the PDCA cycle), Programme Management is the more appropriate term for the high-level coordination of all constituent projects and processes to achieve strategic benefits.

1. Business Continuity Institute (BCI), "Good Practice Guidelines (GPG), 2018 Edition." The GPG, a key industry framework related to ISO 22301, explicitly defines its first professional practice as "PP1: Policy and Programme Management." It states, "BCM programme management is required to direct, implement and maintain the BCM programme... The BCM programme is managed as any other programme in the organization." (Section 4.1, p. 32). This establishes BCM as an ongoing programme.

2. ISO 22301:2019, "Security and resilience — Business continuity management systems — Requirements." The standard requires a holistic and coordinated approach that aligns with the organization's strategic objectives (Clause 5.1, 6.2). The management of the interrelated components of the BCMS (Clause 8) to achieve these objectives is characteristic of programme management, which oversees multiple components to deliver benefits.

3. Elliott, D., Swartz, E., & Herbane, B. (2010). Business Continuity Management: A Crisis Management Approach (2nd ed.). Routledge. This academic text discusses the implementation of business continuity, stating, "The business continuity management process is best managed as a programme of activities... The programme approach allows for the coordination of the various projects that will need to be undertaken." (Chapter 5: Managing the BCM Programme, p. 101).

A Business Impact Analysis (BIA) is a systematic and objective process fundamental to an ISO 22301 Business Continuity Management System (BCMS). Its primary purpose is to identify an organization's critical activities and the resources that support them. The BIA analyzes the impacts of a disruption to these activities over time, providing the data needed to set priorities for recovery. This formal assessment of organizational activities and their interdependencies is crucial for determining recovery time objectives (RTOs) and recovery point objectives (RPOs), thereby forming the foundation for the business continuity strategy.

A. Business Security Analysis: Focuses on identifying and mitigating security threats and vulnerabilities to assets, not on the time-sensitive impact of disrupting operational activities.

C. Business Continuity Analysis: This is a broad, non-specific term. A Business Impact Analysis is a specific, formal type of analysis required within a BCMS.

D. Business Strategic Analysis: Evaluates an organization's long-term goals, market position, and competitive environment, rather than its operational resilience and recovery priorities.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 8.2.2, "Business impact analysis and risk assessment," states, "The organization shall establish, implement and maintain a formal and documented process for business impact analysis..." It specifies that the BIA must include "a) identifying activities that support the provision of its products and services;" and "b) assessing the impacts over time of not performing these activities;". This directly defines the BIA as the objective approach for assessing organizational activities.

2. Herbane, B. (2019). Rethinking business continuity management. Continuity & Resilience Review, 1(1), 38-51.

Page 43, Section "Business Impact Analysis (BIA)": The article describes the BIA as a "cornerstone of BCM" that "identifies the organization’s critical activities, the effect that a disruption would have on them and the resources required to resume the activities." This supports the BIA as the formal assessment process. DOI: https://doi.org/10.1108/CRR-03-2019-0003

3. Bajgoric, N. (2014). Business continuity management: A systemic framework for implementation. Kybernetes, 43(2), 156-177.

Page 165, Section "Business Impact Analysis": This paper explains that the BIA is the "process of analyzing business activities and the effect that a business disruption might have upon them." It emphasizes that the BIA provides "a basis for identifying information and processes that are most critical to the organization." This confirms its role as an objective assessment tool. DOI: https://doi.org/10.1108/K-09-2013-0201

The 'Act' phase of the PDCA cycle is centered on continual improvement and taking corrective actions based on the results of the 'Check' phase. This phase ensures the Business Continuity Management System (BCMS) remains effective, adequate, and suitable over time. A critical component of this is communicating the improvements, changes, and outcomes of corrective actions to key stakeholders. This communication closes the feedback loop, demonstrates responsiveness to stakeholder needs and performance data, and thereby actively maintains the integrity of the BCMS and the engagement of stakeholders.

A. Plan: This phase establishes the initial framework, including identifying stakeholders and defining the communication strategy, but it does not encompass the ongoing, active maintenance of communication.

B. Do: This phase involves the operational execution of the BCMS, including carrying out planned communications during exercises or incidents, rather than the strategic maintenance of the system through improvement.

C. Check: This phase focuses on monitoring and reviewing the BCMS's performance, which includes gathering feedback from stakeholders, but it is the subsequent 'Act' phase that responds and communicates the resulting actions.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 10.2 (Continual improvement): This clause, corresponding to the 'Act' phase, states, "The organization shall continually improve the suitability, adequacy and effectiveness of the BCMS." This process of improvement inherently requires communication with stakeholders to report on progress and changes, thus maintaining the system's relevance and stakeholder confidence. The 'Act' phase is where the system is actively sustained.

2. Moeller, R. R. (2017). Executive's Guide to COSO Internal Controls: Understanding and Implementing the New Framework. John Wiley & Sons.

Chapter 4, The COSO Internal Control Framework, PDCA Cycle: While discussing management systems broadly, the text explains that the 'Act' phase involves management taking action to improve processes based on what was learned in the 'Check' phase. This action includes communicating changes and improvements to ensure the system is maintained and stakeholder expectations are managed.

3. Zairi, M. (1997). Business process management: a boundaryless approach to modern competitiveness. Business Process Management Journal, 3(1), 64-80. https://doi.org/10.1108/14637159710161585

This academic paper discusses the PDCA cycle in the context of business process management. It emphasizes that the 'Act' stage is not just about implementing changes but also about standardizing improvements and communicating them throughout the organization and to relevant parties to sustain the gains, which aligns with the concept of "maintaining communication."

Organizational activities encompass the full spectrum of processes, functions, and operations that an entity undertakes to achieve its corporate goals. According to ISO 22301, a Business Continuity Management System (BCMS) must take a holistic view of the organization. It requires identifying potential threats and their impact on the organization's ability to deliver its key products and services. Therefore, it is the broad set of "organizational" activities, not just specific formal or procedural ones, that are exposed to threats which can compromise strategic objectives. The standard's purpose is to build resilience across the entire organization to protect these critical activities.

A. Formal: This is too narrow; threats can impact both formal and informal activities that are essential for achieving corporate goals.

C. Structural: This term is imprecise and focuses on the organizational framework rather than the operational activities that are directly threatened by disruptive incidents.

D. Procedural: This is a subset of organizational activities. Many critical functions may not be strictly procedural, and threats can affect more than just defined processes.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 4.1, "Understanding the organization and its context," requires the organization to determine issues relevant to its purpose and that affect its ability to achieve the intended outcomes of its BCMS. This establishes the scope as the entire organization.

Clause 8.2.2, "Business impact analysis (BIA)," mandates the process to "identify the activities that support the provision of its products and services" and prioritize them. This confirms the focus is on the organization's activities.

2. Herbane, B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History, 52(6), 978-1002.

Page 980: The paper describes modern Business Continuity Management (BCM) as an "organization-wide process" that moves beyond simple IT disaster recovery to address a wide range of threats to the entire business operation, aligning with the term "organizational activities." (DOI: https://doi.org/10.1080/00076791.2010.511185)

3. Hiles, A. (Ed.). (2011). The Definitive Handbook of Business Continuity Management (3rd ed.). John Wiley & Sons.

Chapter 1, "An Introduction to Business Continuity Management," page 4: Defines BCM as a "holistic management process that identifies potential threats to an organization and the impacts to business operations." This supports the concept that the entire set of organizational activities is the subject of BCM.

The "Clarify and confirm" step is fundamental to the Business Impact Analysis (BIA) and requirements gathering phase of implementing an ISO 22301 Business Continuity Management System (BCMS). During this stage, continuity planners engage directly with business leads and process owners to review, validate, and refine the initial data collected. This interactive process ensures that critical business processes, their dependencies, and requirements—such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)—are accurately understood and documented. This validation is crucial for building a BCMS that genuinely reflects the organization's operational priorities and resilience needs.

B. Commit: This step typically occurs after requirements have been clarified and agreed upon, where business leads formally approve the plans and commit the necessary resources.

C. Check: This is a general term for verification. While clarification involves checking, "Clarify and confirm" is more specific to the collaborative dialogue with business stakeholders.

D. Compile: This refers to the initial gathering and organization of data from various sources. The clarification and confirmation process happens after or during compilation to validate this data.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 8.2.2, Business impact analysis: This clause mandates a formal process to analyze the impacts of disruption over time. The standard states the organization shall "use the information from the analysis to identify prioritized activities." This identification and prioritization process inherently requires dialogue with business leaders to clarify needs and confirm findings, which is the essence of the "Clarify and confirm" step.

2. Heng, G. M. (2005). A Manager's Guide to ISO 22301. IT Governance Publishing.

In discussions of the Business Impact Analysis (BIA) process, the guide emphasizes the need for workshops and interviews with business managers. It describes a cycle of data collection (Compile), followed by analysis and review sessions (Clarify and confirm) to ensure the accuracy of impact assessments and recovery requirements before seeking formal sign-off (Commit).

3. University of Washington, UW Emergency Management. (n.d.). Continuity Planning Guide.

Page 6, "Step 2: Conduct a Business Impact Analysis (BIA)": The guide outlines the BIA process, which includes steps for gathering information and then explicitly states the need to "Review and validate information with department leadership." This action directly corresponds to the "Clarify and confirm" step, highlighting its importance in a practical BCM framework.

Business Continuity Management (BCM) must be embedded within an organization's culture and practices to be effective. This integration occurs at two primary levels. At the Management level, leadership provides commitment, sets policy, allocates resources, and ensures the Business Continuity Management System (BCMS) aligns with strategic objectives, as mandated by ISO 22301's clauses on Leadership (Clause 5) and Planning (Clause 6). At the Operations level, business continuity is built into the day-to-day activities, procedures, and processes. This includes conducting business impact analyses, developing continuity plans, and training staff, as detailed in ISO 22301's clause on Operation (Clause 8).

B. Structural: BCMS influences organizational structure (e.g., roles and responsibilities), but "structural" is not a primary level of activity for integration itself.

D. Processes: While BC is integrated into individual processes, "Operations" is the broader, more encompassing term used in ISO 22301 (Clause 8) to describe this level of activity.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 5, "Leadership": This section details the requirements for top management's involvement, including establishing the business continuity policy and objectives, ensuring the integration of BCMS requirements into the organization’s business processes, and providing necessary resources. This directly supports option A (Management).

Clause 8, "Operation": This section specifies the need to plan, implement, and control the processes needed to meet BCMS requirements. This includes the business impact analysis, risk assessment, business continuity strategy, and establishing and implementing business continuity procedures. This directly supports option C (Operations).

2. Herbane, B. (2019). Rethinking business continuity management. Continuity & Resilience Review, 1(1), 38-51. https://doi.org/10.1108/CRR-09-2019-002

Section: "The strategic and operational dimensions of BCM" (pp. 42-44): The paper discusses how BCM has evolved to be both a strategic management function, concerned with organizational resilience and governance, and an operational function, focused on the tactical implementation of plans and procedures to respond to disruptions. This distinction supports the integration at both management and operational levels.

3. Wobbe, T. (2015). Implementing an ISO 22301 Business Continuity Management System. IT Governance Publishing.

Chapter 3, "Leadership and Commitment" and Chapter 7, "BCMS Operation": This official guide explicitly structures its implementation advice around the clauses of the ISO 22301 standard, dedicating distinct chapters to the strategic leadership aspects (Management) and the tactical implementation aspects (Operations), reinforcing that integration occurs at these two distinct levels.

The ISO 22301 standard specifies that a Business Continuity Management System (BCMS) should be established, implemented, maintained, and continually improved as part of the organization's overall management system. It is not a standalone or isolated activity. Integrating the BCMS into the organization's processes, culture, and overall management structure ensures that business continuity is considered a strategic priority, receives appropriate resources, and is aligned with the organization's objectives. This holistic approach moves beyond a narrow focus, such as IT, to encompass all aspects of the organization's resilience.

A. A part of the organization's IT Management system

This is incorrect because business continuity management is much broader than IT. It includes people, processes, premises, and suppliers, not just technology and data recovery.

D. Always managed by an external service provider

This is incorrect because there is no requirement for a BCMS to be managed externally. While external expertise can be used, the ultimate responsibility remains with the organization's top management.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Section 0.1, General: "The organization should integrate its BCMS with, and into, its related management processes and structures." This statement explicitly confirms that the BCMS is part of the overall management system.

Clause 4.1, Understanding the organization and its context: This clause requires the organization to consider its overall purpose and strategic direction when defining the BCMS, reinforcing its integration with the entire organization.

2. Herbane, B. (2019). Rethinking business continuity management. Continuity & Resilience Review, 1(1), 38-51. https://doi.org/10.1108/CRR-03-2019-0003

Page 40: The paper discusses the evolution of BCM from a technically-focused discipline (like IT disaster recovery) to a "holistic management process" that is integrated into corporate governance and strategic management, supporting the idea that it is part of the overall management system.

3. Järveläinen, J. (2013). IT incidents and business impacts: A classification and the role of business continuity management. International Journal of Information Management, 33(5), 742-750. https://doi.org/10.1016/j.ijinfomgt.2013.05.003

Section 3.2: This article distinguishes between IT-focused disaster recovery and the broader, process-oriented BCM, stating, "BCM is a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause..." This clarifies why limiting BCMS to an IT system (Option A) is incorrect.

The statement is correct. Within the framework of ISO 22301, managing the consequences of a disruptive incident extends beyond operational recovery to include reputational protection. The media and press are critical interested parties whose actions can significantly influence public perception, customer loyalty, and stakeholder confidence. Unmanaged or negative media coverage during a crisis can cause severe, long-lasting damage to an organization's brand and market position, profoundly impacting its long-term performance and, in extreme cases, its very survival. A robust Business Continuity Management System (BCMS) must therefore include strategies for crisis communication and media relations.

B. False: This is incorrect. Ignoring the impact of the media and press is a critical oversight in business continuity planning. Case studies of major corporate crises consistently demonstrate that mishandling media communications can be as damaging as the initial disruptive incident itself.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 4.2, "Understanding the needs and expectations of interested parties": This clause requires the organization to identify interested parties (which include the media) and their requirements. The need to maintain a positive reputation is a key expectation.

Clause 8.4.3, "Warning and communication": This section mandates the establishment of procedures for communicating with interested parties, including the media, during a disruptive incident to manage consequences effectively.

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.

Section 8.4.3.1, "General": This guidance document elaborates on communication, stating that "Communication during an incident is undertaken to... manage the consequences with any interested parties and maintain confidence in the organization." This directly acknowledges the need to manage perceptions, which are heavily influenced by the media.

3. Coombs, W. T. (2014). Ongoing Crisis Communication: Planning, Managing, and Responding (4th ed.). SAGE Publications.

Chapter 2, "Crisis Management: A Process for Strategic Management of Crises": This university-level textbook explains that a crisis poses a reputational threat. It states, "Reputations are an intangible asset, but an asset that has significant value... The actions of the media can have a profound impact on the long-term performance... of an organization." (Paraphrased from concepts throughout the chapter). This source directly links media actions to long-term performance as a core tenet of crisis management.

The design of a Business Impact Analysis (BIA) questionnaire is critical for gathering accurate, consistent, and relevant data. The questionnaire must be designed to be easily understood and completed by business process owners. Key design factors include: ensuring the information requested is concise to maintain focus (A); using a clear and logical layout to guide the respondent (B); selecting appropriate types of questions (e.g., quantitative, qualitative) to elicit specific data on impacts and dependencies (C); and defining the required level of detail to establish recovery objectives without being overly burdensome (D). These factors collectively ensure the quality and utility of the data collected for the BIA.

E. Image and Pictures: While images can be used for clarification, they are not a primary or standard design factor for BIA questionnaires, which focus on textual and numerical data about processes.

F. Virtualization: Virtualization is a technology concept that may be a subject of the BIA (e.g., a resource to be analyzed), not a principle for designing the questionnaire itself.

1. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301, Section 8.2.2, "Business impact analysis." This section details the information that needs to be collected for a BIA, such as impacts over time and dependencies. The successful collection of this data relies on well-structured data collection methods like questionnaires, which implicitly requires attention to detail (D), question types (C), and clarity (A, B).

2. Heng, G. M. (2006). Business Impact Analysis: A Case Study of a University. Communications of the IIMA, 6(3), Article 9. This academic case study discusses the BIA process, including the use of questionnaires for data collection. The methodology highlights the importance of structuring the questionnaire to gather specific details on critical processes and impact levels, supporting the need for a defined level of detail (D) and appropriate question types (C).

3. Elliott, D., Swartz, E., & Herbane, B. (2010). Business Continuity Management: A Crisis Management Approach (2nd ed.). Routledge. In Chapter 5, "Business Impact Analysis," the authors discuss data collection techniques. They emphasize that questionnaires must be carefully designed for clarity, ease of use, and the ability to capture both quantitative and qualitative data, which directly relates to conciseness (A), layout (B), and question types (C).

The preparation of a document analogous to a Statement of Applicability (SOA) is a fundamental activity within the Plan phase of the PDCA cycle. Although the term "SOA" is formally a requirement of ISO/IEC 27001, the underlying concept in ISO 22301 involves determining and justifying the selection of business continuity strategies and solutions. This process of identification, selection, and planning is explicitly covered under Clause 6 "Planning" and Clause 8.3 "Business continuity strategies and solutions" of the ISO 22301 standard. The 'Plan' phase is where the organization establishes its objectives and the processes necessary to deliver results in accordance with its business continuity policy, making it the correct stage for this activity.

B. Do: This phase is for implementing the business continuity strategies and plans that were selected and defined during the 'Plan' phase.

C. Check: This phase involves monitoring, measuring, and reviewing the performance and effectiveness of the implemented BCMS against objectives, not the initial preparation.

D. Act: This phase focuses on taking corrective actions and making improvements to the BCMS based on the results of the 'Check' phase.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 0.4, "Plan-Do-Check-Act (PDCA) cycle": This section explicitly maps the clauses of the standard to the PDCA cycle. It states, "This International Standard applies the Plan-Do-Check-Act (PDCA) cycle... Plan (clauses 4, 5, 6, 7): establish business continuity policy, objectives, controls, processes and procedures relevant to improving business continuity..." This directly places the planning activities, which include determining applicable strategies, within the 'Plan' phase.

2. Hermawan, A., & Rahaningsih, N. (2020). Design of Business Continuity Management System (BCMS) based on ISO 22301: 2012. IOP Conference Series: Materials Science and Engineering, 830(3), 032043.

Section 3, "Research Methodology": In the description of the PDCA cycle application (Figure 1), the authors map the "Planning" stage to activities such as defining the scope, policy, objectives, and identifying requirements. The selection of appropriate strategies is an inherent part of this planning process before implementation ('Do') can begin. DOI: https://doi.org/10.1088/1757-899X/830/3/032043

3. Rittinghouse, J. W., & Ransome, J. F. (2017). Business Continuity and Disaster Recovery for InfoSec Managers. Syngress, Elsevier.

Chapter 4, "Business Continuity Management," Section "ISO 22301 and the PDCA Cycle": This academic text explains that the 'Plan' phase involves all the preparatory work, including "determining the business continuity strategy." This confirms that strategic decisions about applicability are made during planning.

ISO 22301 requires an organization to establish a clear incident response structure with defined roles, responsibilities, and authorities. The internationally recognized best-practice model for this structure, often referred to as the Gold-Silver-Bronze command structure, comprises three distinct management levels. These are:

1. Strategic (Gold): The highest level, consisting of senior management who set the overall strategy, manage corporate reputation, and handle the long-term business implications of the incident.

2. Tactical (Silver): The intermediate level that coordinates the response, manages resources, and implements the strategy defined by the strategic level across various operational teams.

3. Operational (Bronze): The hands-on level where teams execute specific response and recovery tasks at the site of the disruption.

C. Continual: This refers to the principle of continual improvement, a core component of the entire management system (as per ISO 22301, Clause 10), not a specific management level within an incident.

E. Executional: While response activities are executed at the operational level, "Operational" is the standard and formal terminology used in incident management frameworks, making "Executional" an imprecise and non-standard term.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. Clause 8.4.3, "Incident response structure," mandates the establishment of a structure to ensure an effective response, stating the organization shall "establish a structure, appointing person(s) with the necessary responsibility, authority and competence to manage an incident." The three-tiered model (Strategic, Tactical, Operational) is the globally accepted framework for fulfilling this requirement.

2. British Standards Institution (BSI). (2014). BS 11200:2014 Crisis management — Guidance and good practice. Section 4.4.2, "Structure, roles, responsibilities and authorities," explicitly details the three-tiered structure for crisis response: "The structure should be based on three levels: strategic, tactical and operational." This standard is designed to complement ISO 22301.

3. Hiles, A. (Ed.). (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. In Chapter 23, "Developing and Implementing the Incident and Emergency Management Plans," the text describes the common command and control structure, stating, "The most common structure is a three-tier model... The three tiers are commonly referred to as Strategic, Tactical and Operational." This is a foundational text often used in university-level business continuity courses.

4. Business Continuity Institute (BCI). (2018). Good Practice Guidelines (GPG) 2018 Edition. Section 5.5.2, "Structure," outlines the need for a hierarchical incident management structure, detailing the roles and responsibilities at the Strategic (Gold), Tactical (Silver), and Operational (Bronze) levels as essential for effective incident response.