ISO 22301 ISO-22301-Lead-Auditor Exam Dumps

Policy formulation is the BCMS process that is used to develop a business continuity policy that sets out an operating framework. According to ISO 22301, the organization shall establish a business continuity policy that is appropriate to the purpose and context of the organization and provides a framework for setting business continuity objectives. The policy shall also demonstrate top management’s commitment to the BCMS and its continual improvement1. The policy formulation process involves the following steps2:

• Define the scope and objectives of the policy
• Identify the relevant internal and external issues and requirements
• Analyze the current state of the BCMS and the gaps to be addressed
• Draft the policy statement and the key principles and guidelines
• Review and approve the policy by the top management
• Communicate and distribute the policy to the relevant stakeholders
• Monitor and update the policy as needed References:
• ISO 22301:2019, clause 5.3
• ISO 22301 Auditing eBook, page 24

Business Continuity Management (BCM) is a holistic management process that identifies potential threats to an organization and the impacts to business operations that those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities1. One of the main objectives of BCM is to prepare the entire organization in advance of any major incident, so that it can respond and recover effectively and efficiently. This is achieved by implementing a Business Continuity Management System (BCMS), which is a set of policies, processes, procedures, roles, responsibilities, resources, and plans that enable an organization to manage business continuity2.

According to ISO 22301, the international standard for BCMS, one of the benefits of implementing a BCMS is that it helps an organization to establish a culture of good business practice, which is an initiative that helps in preparing the entire organization in advance of any major incident3. Good business practice means that an organization follows the principles of business continuity, such as customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. By adopting these principles, an organization can enhance its resilience, reduce its risks, improve its performance, and increase its customer satisfaction.

The other options are not correct because they are not initiatives of BCM that help in preparing the entire organization in advance of any major incident. Leadership is a principle of business continuity, but it is not an initiative by itself. It refers to the role of top management in establishing the BCMS, providing direction and support, and ensuring its effectiveness. Governance is a function of the organization that ensures that the BCMS is aligned with the strategic objectives, complies with the legal and regulatory requirements, and meets the expectations of the interested parties. Long range focus is a characteristic of a resilient organization, but it is not an initiative of BCM. It means that an organization anticipates and adapts to the changing environment, and plans for the future.

References: 1: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 3.4 2: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 3.5 3: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, Introduction : ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 0.2 : ISO 22301 Auditing eBook, Chapter 2.2.2 : ISO 22301 Auditing eBook, Chapter 2.1.1

Business continuity objectives are the objectives that take the form of targets to enhance organizational resilience, as defined by ISO 22301. Business continuity objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Business continuity objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Business continuity objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Business continuity objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2

Business Impact Analysis (BIA) is an objective approach that assesses the organisational activities and determines their criticality, dependencies, and recovery priorities. BIA is a key process in developing a business continuity management system (BCMS) according to ISO 22301. BIA helps to identify the potential impacts of disruptions to the organisation’s critical functions and processes, such as financial losses, reputational damage, legal liabilities, regulatory penalties, customer dissatisfaction, etc. BIA also helps to determine the recovery time objectives (RTOs), recovery point objectives (RPOs), and minimum business continuity objectives (MBCOs) for each critical function and process. BIA provides the basis for developing business continuity strategies and plans that ensure the continuity and resilience of the organisation. References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.3: Business Impact Analysis1
• ISO/TS 22317:2021(en), Security and resilience — Business continuity management systems — Guidelines for business impact analysis2