Pass the PECB ISO 22301 ISO-22301-Lead-Auditor Questions and answers with ValidTests

Supporting functions are the functions that provide support to the critical functions of an organization, such as human resources, finance, IT, or facilities management. Supporting functions are essential for the continuity of the critical functions, but they are not directly involved in delivering the products or services to the customers. Supporting functions are also part of the scope of the business continuity management system (BCMS) and need to be identified, analyzed, and protected by the organization. Supporting functions are one of the key concepts of ISO 22301, as they help the organization to determine its business continuity requirements and strategies. References: ISO 22301 Auditing eBook, page 23 1; ISO 22301:2019, clause 8.2.2 2

Continual improvement is the process that ensures the BCMS operates effectively and remains relevant in its context. Continual improvement is an essential aspect of any management system, as it allows organizations to identify areas for improvement and implement changes to enhance their performance. According to ISO 22301, organizations should establish, implement, maintain, and continually improve a business continuity management system (BCMS) based on the principles of continual improvement. Furthermore, this ongoing process should be embedded into the organization’s culture. The continual improvement involves regularly reviewing the BCMS to identify areas for improvement and taking action to make changes that will enhance the system’s effectiveness. This can be achieved through various methods, such as monitoring and measuring the system’s performance, analyzing data and trends, conducting internal audits and management reviews, and implementing corrective and preventive actions. ISO 22301 also emphasizes the importance of leadership in driving continual improvement. Top management should continually improve the BCMS and provide the necessary resources and support to achieve this. They should also set objectives and targets for improvement and monitor progress. Continual improvement is a systematic and ongoing process that involves identifying opportunities for improvement, making changes, and monitoring the results to ensure practical improvements. References: : ISO 22301 Auditing eBook, page 11 : ISO 22301:2019, clause 10.2 : ISO 22301:2019, clause 3.15 : ISO 22301 Clause 10.2 Continual improvement : ISO 22301 continuous improvement – How to achieve it

Corporate defences are the measures and mechanisms that an organization implements to protect itself from internal and external threats and disruptions. Corporate defences include guidelines, procedures, and physical control systems that aim to prevent, detect, respond to, and recover from incidents that may affect the organization’s assets, operations, performance, reputation, or continuity. Corporate defences are an essential component of business continuity management, as they help to ensure the organization’s resilience and sustainability in the face of uncertainty and volatility. Corporate defences should be aligned with the organization’s objectives, values, and culture, as well as the requirements and expectations of its stakeholders. Corporate defences should also be based on a systematic assessment of the organization’s risks and opportunities, as well as the best practices and standards for business continuity, such as ISO 223011. References:

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements1

ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.5: Corporate Defences2

The act step in the PDCA cycle validates improvements by taking actions to address any gaps, nonconformities, or opportunities for improvement identified in the check step. The act step also involves reviewing the effectiveness of the actions taken and determining whether further improvement is possible or necessary. The act step closes the PDCA cycle and leads to a new plan step for the next cycle of continual improvement. The act step is one of the key requirements of ISO 22301, as it demonstrates theorganization’s commitment to enhance its business continuity capability and performance. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

Communication is the process of engaging staff and external stakeholders in all aspects of the BCMS. Communication ensures that the BCMS objectives, policies, procedures, roles and responsibilities are understood and accepted by the relevant parties. Communication also facilitates the exchange of information and feedback between the BCMS and its interested parties, such as customers, suppliers, regulators, media, etc. Communication helps to build trust, awareness and commitment to the BCMS, as well as to enhance its performance and effectiveness. References: ISO 22301 Auditing eBook, page 30; ISO 22301:2019, clause 7.4

The Act phase of the PDCA cycle consists of improvement. The Act phase is the fourth and final phase of the PDCA cycle, following the Check phase. In the Act phase, the organization takes action based on what it learned from the Check phase, where it monitored and evaluated the results of the Do phase, where it implemented the plan developed in the Plan phase. The action can be one of the following options1:

If the change was successful, the organization can standardize and stabilize the change, and communicate and document the results and the lessons learned. The organization can also identify opportunities for further improvement and start a new PDCA cycle with a different plan.

If the change was not successful, the organization can identify the root causes of the failure and revise the plan accordingly. The organization can also start a new PDCA cycle with the revised plan or a different plan. The Act phase is the phase where the organization improves its processes and performance by incorporating the learning from the previous phases. The Act phase also helps the organization to sustain the improvement and prevent the recurrence ofproblems. The Act phase is aligned with the clause 10 of ISO 22301, the international standard for business continuity management systems, which requires the organization to improve its business continuity management system by taking corrective actions, addressing nonconformities, and enhancing customer satisfaction2. References:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 10: Improvement2

The PDCA paradigm cycle is widely recognized as a process-centric approach. The PDCA cycle, also known as the Deming cycle or the Shewhart cycle, is a four-step model for carrying out change and improvement in a systematic and consistent way. The PDCA cycle consists of the following phases: Plan, Do, Check, and Act. The Plan phase involves identifying the problem, setting the objectives, and developing the plan for improvement. The Do phase involves implementing the plan and carrying out the actions. The Check phase involves monitoring and measuring the results and comparing them with the objectives. The Act phase involves taking corrective actions, standardizing the improvement, and reviewing the process. The PDCA cycle is a process-centric approach because it focuses on the processes and their interactions that deliver the desired outcomes and performance. The PDCA cycle helps to ensure that the processes are planned, executed, evaluated, and improved in a continuous and consistent manner. The PDCA cycle is also aligned with the process approach principle of ISO 22301, the international standard for business continuity management systems. ISO 22301 requires the organization to apply the PDCA cycle to its business continuity management system, as well as to its individual processes and activities. The PDCA cycle helps the organization to establish, implement, operate, monitor, review, maintain, and continually improve its business continuity management system and its ability to respond to and recover from disruptive incidents. References:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 0.3: The Plan-Do-Check-Act cycle2

What is the Plan-Do-Check-Act (PDCA) Cycle?3

Crisis communication is the process of managing the flow of information during and after a crisis situation that threatens the reputation, operations, or survival of an organization. It aims to protect the organization’s shareholder value and long-term reputation by maintaining trust and confidence among its stakeholders. According to the ISO 22301 Auditing eBook, crisis communication is one of the key elements of a business continuity management system, as it enables the organization to communicate effectively with its internal and external parties, such as employees, customers, suppliers, media, regulators, and the public. Effective crisis communication can help the organization to minimize the negative impacts of a crisis, restore normal operations as soon as possible, and enhance its resilience and reputation in the long run. References: ISO 22301 Auditing eBook, pages 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, and 27.

According to the ISO 22301 Auditing eBook, there are five types of strategies involved in the process-centric approach to business continuity management. They are:

Business continuity strategy: This is the overall approach that provides a framework for ensuring the continuity of an organization’s critical functions in the event of a disruption. It defines the objectives, scope, principles, and policies of the business continuity management system (BCMS).

Recovery strategy: This is the specific approach that defines how an organization will restore its critical functions within a predefined time frame after a disruption. It identifies the resources, actions, and procedures required to recover the critical functions and resume normal operations.

Continuity strategy: This is the specific approach that defines how an organization will maintain its critical functions during a disruption. It identifies the alternative arrangements, methods, and modes of operation that will enable the organization to continue delivering its products or services at an acceptable level of performance.

Mitigation strategy: This is the specific approach that defines how an organization will reduce the likelihood and/or impact of a disruption. It identifies the preventive and protective measures that will minimize the exposure and vulnerability of the organization to potential threats and risks.

Response strategy: This is the specific approach that defines how an organization will react to a disruption. It identifies the roles, responsibilities, and authorities of the incident management team, the communication channels and protocols, and the escalation and notification procedures.

References: ISO 22301 Auditing eBook, pages 40-42

The knowledge of BCM and its methodology is not related to technical expertise, but to domain expertise. Technical expertise refers to the knowledge and skills related to the audit process, such as audit principles, procedures, techniques, and tools. Domain expertise refers to the knowledge and skills related to the specific field of the audit, such as BCM concepts, terms, definitions, requirements, and best practices. References: ISO 22301 Auditing eBook, page 11; ISO 19011:2018, clause 7.2.2