Document control is a process that ensures that documented information related to the BCMS is

current, accurate, and available to relevant parties. It also ensures that the confidentiality of business

continuity materials is safeguarded from unauthorized access, disclosure, or misuse. Document

control covers the creation, approval, distribution, use, storage, preservation, retrieval, control of

changes, retention, and disposition of documented information. Document control is required by

clause 7.5.3 of ISO 22301:2019. Reference: ISO 22301:2019, clause 7.5.3; ISO 22301 Auditing eBook,

page 56.

Support does not lay out the foundation of planning and managing the BCMS, but rather provides

the necessary resources and arrangements to enable the effective operation of the BCMS. Support

includes aspects such as competence, awareness, communication, documented information, and

organizational knowledge. The foundation of planning and managing the BCMS is laid out by the

leadership and planning clauses of ISO 22301, which define the roles and responsibilities, policies,

objectives, and actions to address risks and opportunities for the BCMS. Reference: ISO 22301

Auditing eBook, page 15 1; ISO 22301:2019, clauses 5, 6, and 7 2

According to the ISO 22301 Auditing eBook, there are three types of personal interview, which differ

in terms of the structure, purpose and depth of information to be elicited. They are:

Fully structured interview: This type of interview follows a predefined set of questions that are asked

in a fixed order. The interviewer does not deviate from the script and does not probe for additional

information. The advantage of this type of interview is that it ensures consistency and comparability

of data across different interviewees. The disadvantage is that it may not capture the nuances and

complexities of the interviewee’s responses, and may miss some important information that is not

covered by the questions.

Semi-structured interview: This type of interview has a general outline of topics or questions to be

covered, but the interviewer has the flexibility to ask follow-up questions, clarify ambiguities, and

explore new areas of interest that emerge during the conversation. The advantage of this type of

interview is that it allows for a deeper and richer understanding of the interviewee’s perspectives,

opinions, and experiences. The disadvantage is that it may introduce some variability and bias in the

data collection and analysis, depending on the interviewer’s skills and style.

Unstructured interview: This type of interview has no predetermined agenda or questions, and the

interviewer relies on the natural flow of the conversation to guide the discussion. The interviewer

may use some open-ended prompts or probes to elicit more information, but the interviewee has

the freedom to express whatever they want. The advantage of this type of interview is that it can

reveal unexpected and insightful information that may not be obtained through other methods. The

disadvantage is that it may be difficult to manage, control, and summarize the data, and it may

require more time and resources to conduct and analyze.

Reference: : ISO 22301 Auditing eBook, Chapter 5: Audit Techniques, Section 5.2: Personal Interview,

Page 63-64.

1of30

A management system is an integrated set of processes and tools that an organization uses to

develop its strategy, transform it into actions, and monitor and evaluate its performance and

effectiveness. A management system helps an organization to achieve its objectives and continually

improve its performance.

Stakeholders are individuals or groups that have an interest in the organization’s performance.

According to the ISO 22301 Auditing eBook, "Stakeholders are persons or organizations that can

affect, be affected by, or perceive themselves to be affected by a decision or activity of the

organization. Stakeholders can be internal or external to the organization. Examples of internal

stakeholders are employees, managers, owners, and board members. Examples of external

stakeholders are customers, suppliers, regulators, investors, competitors, media, and the

public."1 Stakeholders have different needs and expectations regarding the organization’s business

continuity management system (BCMS) and its ability to respond to and recover from disruptive

incidents. Therefore, the organization needs to identify its relevant stakeholders and understand

their requirements and expectations, as well as communicate with them effectively and

appropriately. This is one of the requirements of ISO 22301, the international standard for business

continuity management systems. ISO 22301 requires the organization to determine the interested

parties that are relevant to its BCMS and the requirements of these interested parties2. Interested

parties are a subset of stakeholders that have a direct or indirect influence on the BCMS or a stake in

its outcome3. The organization also needs to monitor and review the information about these

interested parties and their requirements, as they may change over time2. Reference:

ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.1:

Stakeholders1

ISO 22301:2019 - Security and resilience — Business continuity management systems —

Requirements, Clause 4.2: Understanding the needs and expectations of interested parties2

Interested parties in ISO 27001 and ISO 22301 | Who are they?3

A documentary review is a type of review that involves examining documents, records, or other

forms of evidence related to the audit criteria and objectives. It can often be used as a secondary

method to support other forms of information collection methods, such as interviews, observations,

or sampling. A documentary review can help to verify the existence, implementation, and

effectiveness of the audited processes, activities, or controls. It can also provide useful information

about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the

auditees and other relevant parties. Reference: ISO 22301 Auditing eBook, page 611; ISO

19011:2018, clause 6.3.22

Business Continuity Management (BCM) is a holistic management process that identifies potential

threats to an organization and the impacts to business operations that those threats, if realized,

might cause, and which provides a framework for building organizational resilience with the

capability for an effective response that safeguards the interests of its key stakeholders, reputation,

brand and value-creating activities1. One of the main objectives of BCM is to prepare the entire

organization in advance of any major incident, so that it can respond and recover effectively and

efficiently. This is achieved by implementing a Business Continuity Management System (BCMS),

which is a set of policies, processes, procedures, roles, responsibilities, resources, and plans that

enable an organization to manage business continuity2.

According to ISO 22301, the international standard for BCMS, one of the benefits of implementing a

BCMS is that it helps an organization to establish a culture of good business practice, which is an

initiative that helps in preparing the entire organization in advance of any major incident3. Good

business practice means that an organization follows the principles of business continuity, such as

customer focus, leadership, engagement of people, process approach, improvement, evidence-

based decision making, and relationship management. By adopting these principles, an organization

can enhance its resilience, reduce its risks, improve its performance, and increase its customer

satisfaction.

The other options are not correct because they are not initiatives of BCM that help in preparing the

entire organization in advance of any major incident. Leadership is a principle of business continuity,

but it is not an initiative by itself. It refers to the role of top management in establishing the BCMS,

providing direction and support, and ensuring its effectiveness. Governance is a function of the

organization that ensures that the BCMS is aligned with the strategic objectives, complies with the

legal and regulatory requirements, and meets the expectations of the interested parties. Long range

focus is a characteristic of a resilient organization, but it is not an initiative of BCM. It means that an

organization anticipates and adapts to the changing environment, and plans for the future.

Reference: 1: ISO 22301:2019, Security and resilience — Business continuity management systems —

Requirements, 3.4 2: ISO 22301:2019, Security and resilience — Business continuity management

systems — Requirements, 3.5 3: ISO 22301:2019, Security and resilience — Business continuity

management systems — Requirements, Introduction : ISO 22301:2019, Security and resilience —

Business continuity management systems — Requirements, 0.2 : ISO 22301 Auditing eBook, Chapter

2.2.2 : ISO 22301 Auditing eBook, Chapter 2.1.1

Regulatory compliance is the adherence to laws, regulations, guidelines and specifications relevant

to an organization’s business processes. It has always been a challenge to organizations since it has a

significant influence on corporate planning, such as strategic objectives, policies, procedures, risk

management, performance measurement and improvement. Regulatory compliance can also affect

the organization’s reputation, customer satisfaction, stakeholder confidence and legal liability.

Therefore, organizations need to establish, implement, maintain and improve a business continuity

management system (BCMS) that meets the requirements of ISO 22301 and other applicable

regulations. Reference: ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity

Management Systems (BCMS), Section 1.2: Regulatory Compliance, page 9.

According to ISO 22301:2019, Clause 6.2, the organization must establish business continuity

objectives at relevant functions and levels. The business continuity objectives must be consistent

with the business continuity policy, measurable, monitored, communicated, and updated as

appropriate. The organization must also retain documented information on the business continuity

objectives. One of the elements that should be included in the documented information is

the timescale for the task completion. The timescale is the period of time within which the task or

activity must be completed, such as hours, days, weeks, or months. The timescale helps to define the

expected performance and results of the business continuity management system (BCMS), and to

evaluate the progress and effectiveness of the implementation and operation of the

BCMS. Reference: ISO 22301:2019, Clause 6.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

According to ISO 22301 Lead Auditor objectives and content, workshops are one of the methods

that can be used to conduct a business impact analysis (BIA). Workshops bring a group of people

together into a discussion, where they can share their knowledge, opinions, and perspectives on the

organization’s processes, resources, dependencies, and impacts. Workshops can help to identify and

prioritize the critical activities and resources that are essential for the continuity of the organization’s

operations. Workshops can also facilitate the communication and collaboration among different

stakeholders, such as process owners, managers, employees, and customers. Workshops can be

conducted in various formats, such as face-to-face, online, or hybrid, depending on the availability

and p

of the participants. Workshops should be planned and facilitated by a competent

person, who can guide the discussion, ask relevant questions, collect and document the information,

and ensure the validity and consistency of the results. Reference: ISO 22301 Auditing eBook, page

381; ISO 22301 Clause 8.2 Business impact analysis and risk assessment2