ISO-22301-Lead-Auditor Exam Results

According to ISO 22301:2019, Clause 6.1.2, the organization must establish, implement, and maintain a documented process to manage risks related to the continuity of its critical functions and the achievement of its business continuity objectives. The risk management process should include the identification, analysis, and evaluation of the risks that may cause disruption to the organization’s operations, products, and services. The level of risk for an organization should be determined by combining the consequence and likelihood of the events that may lead to disruption, as well as the organization’s risk criteria, risk appetite, and risk tolerance. The consequence of an event is the impact or effect that it may have on the organization’s objectives, reputation, stakeholders, and resources. The likelihood of an event is the probability or frequency that it may occur, based on historical data, statistical analysis, expert judgment, or other methods. The organization should use appropriate tools and techniques to assess the level of risk, such as risk matrices, risk registers, risk maps, or risk software. The organization should also document the results of the risk assessment and communicate them to relevant interested parties. The purpose of risk management for business continuity is to find out what problems an organization may face, and to take appropriate actions to prevent, mitigate, or transfer the risks, or to accept them if they are within the organization’s riskcriteria. References: ISO 22301:2019, Clause 6.1.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

Reviewing is the stage that helps management to define where focus and resources should be invested. According to ISO 22301, reviewing is the process of evaluating the performance and effectiveness of the business continuity management system (BCMS) and identifying opportunities for improvement. Reviewing can be done through internal audits, management reviews, performance evaluations, and corrective actions. Reviewing can help management to ensure that the BCMS is aligned with the organization’s strategic objectives, meets the needs and expectations of interested parties, complies with the applicable requirements, andcontinually improves its resilience and capability to respond to disruptive incidents. References: ISO 22301 Auditing eBook, page 171; ISO 22301:2019, clause 92

Corporate structure outlines the management hierarchy of the organization, such as the board of directors, the executive management, the business units, the departments, the teams, and the individuals. It defines the roles, responsibilities, authorities, and accountabilities of the organizational members, as well as the reporting and communication lines. Corporate structure also reflects the organization’s culture, values, vision, mission, and strategic objectives. It is importantfor the organization to have a clear and effective corporate structure that supports the implementation and operation of the business continuity management system (BCMS) and ensures the alignment of the business continuity objectives with the strategic direction of the organization. References: ISO 22301 Auditing eBook, Chapter 2: Business Continuity Management System (BCMS), Section 2.1: Scope and Objectives, page 23.

 A control is a measure that is implemented to reduce or eliminate the risk from occurring, or to mitigate the impact of the risk if it occurs. A control can be preventive, corrective, or detective, depending on the stage of the risk management process. A control can also be administrative, technical, or physical, depending on the nature of the risk and the organization. A control can be designed, implemented, monitored, and evaluated based on the risk assessment and the risk treatment plan. A control can be documented in the business continuity policy, objectives, plans, procedures, and other relevant documents. A control can be audited to verify its effectiveness and efficiency in achieving the intended outcomes. References:

• PECB Certified ISO 22301 Lead Auditor eLearning Training Course1, Module 3: Fundamental principles and concepts of a business continuity management system (BCMS), Lesson 3.2: Business continuity management system (BCMS), Slide 15: Risk management
• ISO 22301 Auditing eBook2, Chapter 3: Fundamental principles and concepts of a business continuity management system (BCMS), Section 3.2: Business continuity management system (BCMS), Subsection 3.2.4: Risk management