PECB ISO-22301-Lead-Auditor Exam Questions

The media and press have a profound impact on the long-term performance, or in some cases, the survival of an organization, especially in the aftermath of a disruptive incident. The media and press can influence the perception and reputation of the organization, as well as the expectations and satisfaction of its stakeholders, such as customers, suppliers, regulators, employees, and the general public. Therefore, it is important for the organization to establish and maintain a positive relationship with the media and press, and to communicate effectively and transparently during and after a crisis. ISO 22301:2019, Clause 8.4.3, requires the organization to establish, implement, and maintain a documented procedure to manage communications with relevant interested parties during a disruptive incident. The procedure should include the identification of the spokesperson(s) who will communicate with the media and press, the preparation of key messages and statements, the approval and distribution of information, and the monitoring and evaluation of the effectiveness of the communications. The organization should also consider the potential legal and ethical implications of its communications, and ensure that the information provided is accurate, consistent, and timely.Reference: ISO 22301:2019, Clause 8.4.3; ISO 22301 Auditing eBook, Chapter 4.3.3.

According to ISO 22301:2019, Clause 6.1.2, the organization must establish, implement, and maintain a documented process to manage risks related to the continuity of its critical functions and the achievement of its business continuity objectives. The risk management process should include the identification, analysis, and evaluation of the risks that may cause disruption to the organization's operations, products, and services. The level of risk for an organization should be determined by combining the consequence and likelihood of the events that may lead to disruption, as well as the organization's risk criteria, risk appetite, and risk tolerance. The consequence of an event is the impact or effect that it may have on the organization's objectives, reputation, stakeholders, and resources. The likelihood of an event is the probability or frequency that it may occur, based on historical data, statistical analysis, expert judgment, or other methods. The organization should use appropriate tools and techniques to assess the level of risk, such as risk matrices, risk registers, risk maps, or risk software. The organization should also document the results of the risk assessment and communicate them to relevant interested parties. The purpose of risk management for business continuity is to find out what problems an organization may face, and to take appropriate actions to prevent, mitigate, or transfer the risks, or to accept them if they are within the organization's risk criteria.Reference: ISO 22301:2019, Clause 6.1.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

According to ISO 22301 Lead Auditor objectives and content, a qualitative approach is a type of approach that has a straightforward process based on informed judgement supported by appropriate guidance. A qualitative approach is used to assess the impacts and risks of a disruption to the organization's processes, resources, and objectives. A qualitative approach relies on the subjective evaluation of the likelihood and severity of the disruption, as well as the effectiveness of the existing controls and mitigation measures. A qualitative approach can use descriptive scales, such as low, medium, and high, to rank the impacts and risks. A qualitative approach can also use tools, such as matrices, diagrams, and checklists, to facilitate the analysis and communication of the results.A qualitative approach is suitable for organizations that have limited data, resources, or time to conduct a quantitative approach, which requires more complex and objective calculations and measurements.Reference: ISO 22301 Auditing eBook, page 401; ISO 22301 Clause 8.2.2 Risk assessment2

The top management should demonstrate its commitment to the business continuity management system (BCMS) by conducting effective management reviews of the BCMS and ensuring that the business continuity management (BCM) objectives are aligned to the strategic goals of the business.These are two of the requirements of ISO 22301, the international standard for business continuity management systems, under clause 5.1: Leadership and commitment1.

Management reviews are periodic evaluations of the BCMS by the top management to assess its suitability, adequacy, and effectiveness. Management reviews help to ensure that the BCMS is performing as intended and meeting the requirements and expectations of the interested parties. Management reviews also help to identify and address any issues, gaps, or opportunities for improvement in the BCMS. Management reviews should be conducted at planned intervals, based on the organization's needs and context. Management reviews should consider various inputs, such as the performance and results of the BCMS, the feedback and satisfaction of the interested parties, the internal and external audits, the corrective actions, the changes that may affect the BCMS, etc. Management reviews should also produce various outputs, such as the decisions and actions related to the improvement and effectiveness of the BCMS, the allocation of resources, the revision of policies and objectives, the communication of the results and outcomes, etc. Management reviews are an important way for the top management to demonstrate its commitment to the BCMS, as they show that the top management is actively involved in overseeing and supporting the BCMS.

BCM objectives are the specific and measurable outcomes that the organization intends to achieve with its BCMS. BCM objectives help to guide and direct the organization's BCM activities and processes, as well as to evaluate and improve the organization's BCM performance and capability. BCM objectives should be consistent with the organization's business continuity policy and aligned with the organization's strategic goals and vision. BCM objectives should also be relevant and meaningful to the organization's context and needs, as well as the requirements and expectations of the interested parties. BCM objectives should be established and maintained by the top management, in consultation with the relevant stakeholders. BCM objectives should also be communicated and understood within the organization, as well as reviewed and updated regularly to reflect the changing circumstances and needs of the organization. Ensuring that the BCM objectives are aligned to the strategic goals of the business is an important way for the top management to demonstrate its commitment to the BCMS, as it shows that the top management is integrating BCM into the organization's overall strategy and direction.

ISO 22301:2019 - Security and resilience --- Business continuity management systems --- Requirements, Clause 5.1: Leadership and commitment1

ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.6: Business Continuity Objectives2

ISO 22301 Auditing eBook, Chapter 5: Audit Process, Section 5.3: Audit Criteria3

The clarify and confirm step is the first step of the audit planning process, where the auditor clarifies the requirements with the business leads, such as the audit client, the auditee, and the audit team. The purpose of this step is to ensure that the audit objectives, scope, criteria, and deliverables are clearly defined, understood, and agreed upon by all the parties involved. The clarify and confirm step also involves the identification of the audit risks, opportunities, and resources, as well as the establishment of the audit communication channels and protocols. The clarify and confirm step is essential to ensure that the audit is aligned with the expectations and needs of the stakeholders, and that the audit is feasible, effective, and efficient.Reference:

PECB Certified ISO 22301 Lead Auditor eLearning Training Course1, Module 4: Preparation of an ISO 22301 audit, Lesson 4.1: Audit planning, Slide 5: Audit planning process

ISO 22301 Auditing eBook2, Chapter 4: Preparation of an ISO 22301 audit, Section 4.1: Audit planning, Subsection 4.1.1: Clarify and confirm