ISO-22301-Lead-Auditor Exam Questions Tutorials

A time-based objective is an objective that should be attainable within a given timeframe. Time-based objectives help to ensure that the organization is taking timely and realistic actions to achieve its desired outcomes and performance. Time-based objectives also help to monitor and measure the progress and results of the actions, as well as to identify and address any delays or deviations. Time-based objectives are one of the characteristics of the S.M.A.R.T. concept, which stands for Specific, Measurable, Achievable, Relevant, and Time-based. The S.M.A.R.T. concept is a useful tool for setting effective objectives that are clear, realistic, and meaningful. The S.M.A.R.T. concept is applicable to various types of objectives, such as business continuity objectives, recovery time objectives, recovery point objectives, minimum business continuity objectives, etc. According to the ISO 22301 Auditing eBook, "Time-bound: BCOs [Business Continuity Objectives] should be time-bound, with clear deadlines and timelines for achieving the objectives. This ensures that the organization is taking timely action to protect critical business functions during a disruptive incident."1 References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.3: Business Impact Analysis2
• How to set ISO 22301 Business Continuity Objectives - Advisera1
• What is the Plan-Do-Check-Act (PDCA) Cycle?3

The collection of corporate information provides evidence on the state of organizational preparedness, as it allows the organization to assess its currentcapabilities, resources, and performance in relation to its business continuity objectives and requirements. Corporate information includes documents, records, data, and other types of information that are relevant to the organization’s business continuity management system (BCMS). By collecting and analyzing corporate information, the organization can identify its strengths, weaknesses, opportunities, and threats, and determine the gaps and areas for improvement in its BCMS. Corporate information also helps the organization to monitor and measure the effectiveness and efficiency of its BCMS, and to demonstrate its compliance with the ISO 22301 standard and other applicable regulations and standards. References: ISO 22301 Auditing eBook, page 34; ISO 22301:2019 standard, clause 9.1

Adopting the BCMS optimizes the organization’s business continuity capability by enabling it to identify, prevent, prepare for, respond to, and recover from disruptive events. The BCMS provides a systematic approach to plan, implement, operate, monitor, review, maintain, and improve the organization’s ability to protect its critical functions and deliver its products and services at an acceptable level of performance during and after a disruption. The BCMS also helps the organization to enhance its resilience, reduce its risks, improve its reputation, and increase its customer satisfaction. References: ISO 22301:2019, Clause 1; ISO 22301 Auditing eBook, Chapter 1.1.

The Do phase in the PDCA cycle consists of operation, which means implementing and operating the business continuity policy, controls, processes, and procedures that have been planned in the previous phase. The Do phase also involves establishing the necessary resources, competencies, awareness, communication, and documentation to support the effective operation of the business continuity management system (BCMS). The Do phase aims to ensure that the organization is prepared to respond to and recover from disruptive incidents in a timely and effective manner. References: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.