QUESTION 52
Which objective should be concise and unequivocal?
Explanation
An unambiguous objective is one that is concise and unequivocal, meaning that it is clear, precise, and leaves no room for doubt or confusion. An unambiguous objective is important for business continuity management, as it helps to ensure that the organization and its stakeholders have a common understanding of what is expected and how to measure the progress and achievement of the objective. An unambiguous objective also helps to avoid misunderstandings, conflicts, or disputes that may arise from vague or ambiguous objectives.
According to ISO 22301, business continuity objectives should be consistent with the business continuity policy, measurable, monitored, communicated, and updated as appropriate. They should also be SMART:
Specific, Measurable, Achievable, Relevant, and Time-based. These criteria help to ensure that the objectives are unambiguous and effective. References: ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.2: Business Continuity Policy, page 25. ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.3: Business Continuity Objectives, page 26.
QUESTION 58
Which system / standard brings together all existing standards and a collection of good practices to develop a universal approach to Business Continuity Management (BMS)?
Explanation
ISO 22301 is the system/standard that brings together all existing standards and a collection of good practices to develop a universal approach to Business Continuity Management (BCM). ISO 22301 is the international standard for Security and resilience – Business continuity management systems – Requirements. It specifies the requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise. ISO 22301 is based on the high-level structure (HLS) that provides a common framework for all management system standards. This helps to ensure consistency and alignment with other standards, such as ISO 9001 (quality management), ISO 14001 (environmental management), ISO 27001 (information security management), etc. ISO 22301 also incorporates the best practices and guidance from other sources, such as ISO 22313 (guidelines for business continuity management systems), ISO 22317 (guidelines for business impact analysis), ISO 22318 (guidelines for supply chain continuity), ISO 22320 (guidelines for incident management), ISO 22398 (guidelines for exercises and testing), etc. ISO 22301 aims to provide a universal approach to BCM that is applicable to all types and sizes of organizations, regardless of their nature, sector, or location. References:
ISO 22301:2019 – Security and resilience – Business continuity management systems – Requirements1 ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.2: ISO 22301 Standard2 ISO 22301 – Business Continuity2
QUESTION 64
The draft report is amended according to the feedback provided by the respondents.
Explanation
The draft report is not amended according to the feedback provided by the respondents, but rather according to the audit team leader’s judgment and discretion. The feedback from the respondents is only one of the inputs that the audit team leader considers when finalizing the audit report. The audit team leader has the ultimate responsibility and authority to decide on the content and conclusions of the audit report, based on the audit evidence and audit criteria. The audit team leader should ensure that the audit report is accurate, objective, clear, concise, constructive, and timely1.
References: 1: ISO 22301 Auditing eBook, Chapter 8: Closing an ISO 22301 Audit, Section 8.2: Finalizing the Audit Report, Page 128.
QUESTION 65
Which of the following refers to a specific task products or outcomes that are required in order to complete the project?
Explanation
Deliverables are the specific tasks, products, or outcomes that are required in order to complete the project.
They are the tangible and measurable results of the project activities, and they should be aligned with the project objectives and scope. Deliverables can be classified into two types: project deliverables and process deliverables. Project deliverables are the outputs that directly contribute to the achievement of the project goals, such as reports, plans, documents, software, hardware, etc. Process deliverables are the outputs that support the management and execution of the project, such as schedules, budgets, risk assessments, audits, etc.
Deliverables should be clearly defined, agreed upon, and accepted by the project stakeholders, and they should be monitored and controlled throughout the project lifecycle. According to ISO 22301, some of the deliverables for implementing a business continuity management system (BCMS) are: business continuity policy, business continuity objectives, business impact analysis, risk assessment and treatment, business continuity strategy, business continuity plans, business continuity procedures, performance indicators, audit reports, corrective actions, etc. References: ISO 22301 Auditing eBook, Chapter 3: Planning the BCMS, Section 3.1: Project Management, page 39. ISO 22301 Auditing eBook, Chapter 3: Planning the BCMS, Section 3.2: Project Deliverables, page 40.
