PECB ISO-22301-Lead-Auditor Practice Test Questions Answers

According to the ISO 22301 Auditing eBook, likelihood is defined as "the chance of something happening, whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or mathematically (such as a probability or a frequency over a given time period)"1. Likelihood is one of the factors that determine the level of risk, along with the impact or consequence of an event. The probability of a threat or risk to occur is therefore equivalent to the likelihood of that event.

References: : ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.2: Terms and definitions, Page 23.

According to ISO 22301 Auditing eBook, Chapter 3.2.1, people-oriented objectives are the objectives that are related to shaping the attitudes, behaviours, and skills of individuals within the organization. These objectives aim to enhance the awareness, competence, and commitment of the personnel involved in the business continuity management system (BCMS). Some examples of people-oriented objectives are:

To increase the level of business continuity awareness among all employees by conducting regular training and awareness sessions.

To ensure that all business continuity roles and responsibilities are clearly defined and communicated to the relevant personnel.

To develop and maintain the necessary skills and knowledge for performing business continuity tasks and activities.

To foster a culture of business continuity within the organization that encourages participation, collaboration, and continuous improvement.

People-oriented objectives are important for ensuring that the organization has the human resources required for implementing and maintaining the BCMS, and for achieving the desired business continuity performance and results. References: ISO 22301 Auditing eBook, Chapter 3.2.1.

According to ISO 22301 Lead Auditor objectives and content, a qualitative approach is a type of approach that has a straightforward process based on informed judgement supported by appropriate guidance. A qualitative approach is used to assess the impacts and risks of a disruption to the organization’s processes, resources, and objectives. A qualitative approach relies on the subjective evaluation of the likelihood and severity of the disruption, as well as the effectiveness of the existing controls and mitigation measures. A qualitative approach can use descriptive scales, such as low, medium, and high, to rank the impacts and risks. A qualitative approach can also use tools, such as matrices, diagrams, and checklists, to facilitate the analysis and communication of the results. A qualitative approach is suitable for organizations that have limited data, resources, or time to conduct a quantitative approach, which requires more complex and objective calculations and measurements. References: ISO 22301 Auditing eBook, page 401; ISO 22301 Clause 8.2.2 Risk assessment2

The resources that are involved in business continuity to continue critical operations at an acceptable level are premises, information, technology, and supplies. These are the four types of resources that are defined by ISO 22301, the international standard for business continuity management systems (BCMS). According to ISO 22301, a resource is anything that can be used to achieve an objective1. The standard specifies the following types of resources and their definitions2:

Premises: The physical location where an organization operates or stores its assets.

Information: The data and knowledge that are necessary for an organization to function or provide its products and services.

Technology: The equipment, software, and systems that are used to process, store, transmit, or receive information, or to support the delivery of products and services.

Supplies: The materials, goods, or services that are required for an organization to operate or produce its products and services.

These resources are essential for business continuity because they enable an organization to perform its critical activities, which are the activities that have to be performed to deliver the key products and services that meet the minimum acceptable level of service and the needs of the interested parties3. Therefore, an organization needs to identify, prioritize, protect, and restore these resources in the event of a disruption, as part of its BCMS.

The other options are not correct because they are not types of resources that are involved in business continuity to continue critical operations at an acceptable level, according to ISO 22301. Data is a subset of information, and it is not a separate type of resource. Knowledge is also a part of information, and it is not a distinct type of resource.

References: 1: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 3.33 2: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 3.34-3.37 3: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 3.7 : ISO 22301 Auditing eBook, Chapter 2.2.2 : ISO 22301 Auditing eBook, Chapter 2.2.3 : ISO 22301 Auditing eBook, Chapter 2.2.4

 Business Impact Analysis (BIA) is a process of identifying and evaluating the potential impacts of disruptions to critical business processes, systems, and resources. One of the objectives of BIA is to validate the dependencies of the organization’s essential functions and operations. Dependencies are the relationships or interconnections between the organization and its internal or external stakeholders, such as suppliers, customers, partners, regulators, etc. Dependencies can affect the organization’s ability to deliver its products and services, and therefore, they need to be considered in the BIA process. According to ISO/TS 22317:2021, there are two types of dependencies that are validated by BIA: internal dependencies and external dependencies1. Internal dependencies are the dependencies within the organization, such as between different functions, processes, activities, resources, or locations. For example, a production function may depend on the supply of raw materials from a warehouse, or a finance function may depend on the availability of an accounting system. Internal dependencies can be identified by analyzing the inputs and outputs of each function or process, and the resources required to support them. External dependencies are the dependencies outside the organization, such as with suppliers, customers, partners, regulators, or other stakeholders. For example, a retail company may depend on the delivery of goods from its suppliers, or a bank may depend on the compliance with regulatory requirements. External dependencies can be identified by analyzing the contracts, agreements, or expectations with the external parties, and the potential impacts of their failure or disruption. References:

ISO/TS 22317:2021, clause 6.3.2