GAQM CBCP-002 Certified Business Continuity Professional (CBCP) Exam Practice Test

A risk register is a register that maintains information on all the identified risks relating to an organization. A risk register is a document or a tool that records and tracks the details of each risk, such as its description, source, impact, likelihood, rating, owner, status, response strategy, action plan, and monitoring method. A risk register is a useful tool for managing risks and communicating them to stakeholders. Verified References: https://www.investopedia.com/terms/r/risk-register.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Tolerating risk is where no action is taken to mitigate or reduce a risk. This is true because tolerating risk is one of the possible strategies for managing risk. Tolerating risk means accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified. Tolerating risk may be appropriate for low-priority or low-impact risks that do not pose a significant threat to the organization’s objectives. Verified References: https://www.investopedia.com/terms/t/the-four-ts.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

A Business Continuity Plan (BCP) is designed to ensure an organization can maintain or resume critical functions during and after a disruption. According to Business Continuity Professional standards, such as those from DRI International and ISO 22301, the BCP typically encompasses three core components that address different phases of response and recovery:

A. Emergency response: This component focuses on the immediate actions taken during a disruption (e.g., evacuation, safety measures, and initial coordination). It is a foundational part of the BCP, ensuring personnel and asset safety as a prerequisite to continuity and recovery efforts.

B. Incident management: While incident management (handling and resolving incidents) is critical in broader crisis management frameworks, it is often considered a distinct process under an Incident Response Plan (IRP) rather than a core BCP component. It overlaps with BCP but is not universally listed as one of the three primary elements.

C. Problem management: This is an IT service management process (e.g., under ITIL) focused on identifying and resolving the root causes of incidents. It is not a standard component of a BCP, which prioritizes continuity and recovery over long-term problem resolution.

D. Business recovery: This involves restoring critical business functions and processes after a disruption, ensuring the organization can resume normal operations. It is a central pillar of the BCP, addressing recovery time objectives (RTOs) and operational continuity.

E. Disaster recovery: This focuses on recovering IT systems, data, and infrastructure following a disaster. Often integrated into the BCP, it ensures technological continuity, making it a key component alongside business recovery and emergency response.

The verified answer isA. Emergency response, D. Business recovery, E. Disaster recovery, as these three components collectively cover the lifecycle of a BCP—immediate response, business function restoration, and IT recovery—per established standards. While incident management is related, it is typically supplementary rather than a core BCP element when narrowed to three components.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 6: Business Continuity Plan Development – Identifies emergency response, business recovery, and disaster recovery as key BCP components.

ISO 22301:2019, Clause 8.4 – Outlines planning for response (emergency), continuity (business recovery), and IT recovery (disaster recovery) as integral to BCP.

Contingency planning is the type of planning that requires the commitment of significant financial and human resources for situations that may never even occur. Contingency planning is the process of developing alternative courses of action in case the preferred plan fails or an unexpected event occurs. Contingency planning aims to reduce the impact and uncertainty of potential disruptions and ensure the continuity of the organization’s functions and processes. Contingency planning can be costly and time-consuming, as it involves identifying risks, analyzing scenarios, developing strategies, testing plans, and maintaining readiness. Verified References: https://www.iso.org/publication/PUB100442.html https://phoenixnap.com/blog/what-is-business-continuity-management

Strategic management is the type of management that is an often used term, but has so many different connotations to different people that invariably the message of its meaning gets confused. Strategic management is the process of defining and executing the long-term vision, goals, plans, and actions of an organization. Strategic management involves analyzing the internal and external environment, formulating strategies, implementing them, and evaluating their outcomes. Strategic management can be complex and challenging, as it requires alignment and integration of various aspects of the organization, such as culture, structure, resources, capabilities, stakeholders, markets, competitors, or regulations. Verified References: https://www.investopedia.com/terms/s/strategic-management.asp https://phoenixnap.com/blog/what-is-business-continuity-management

A disaster can also be declared for an illness pandemic where a significant portion of employees are sick. This is true because an illness pandemic is a type of natural disaster that can affect an organization’s ability to continue its normal operations. An illness pandemic can cause absenteeism, reduced productivity, increased costs, supply chain disruptions, customer dissatisfaction, or regulatory compliance issues. Therefore, an organization may need to declare a disaster and activate its business continuity and disaster recovery plan if an illness pandemic impacts its critical functions and processes beyond an acceptable level. Verified References: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

In the event of a disaster that destroys the physical office site operations will be relocated to a temporary site. This is true because one of the recovery strategies for a disaster is to have an alternate site where the critical functions and processes can be resumed until the primary site is restored or replaced. The alternate site can be a pre-arranged location, such as a rented office space, a hotel, or another branch of the same organization, or a mobile facility, such as a trailer or a container. The alternate site should have the necessary equipment, systems, data, and resources to support the continuity of the business. Verified References: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization’s facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References: https://www.fema.gov/pdf/emergency/nims/Damage_Assessment.pdf https://drii.org/resources/professionalpractices/EN

A consultant is a person who borrows your watch to tell you the time, charges you for doing so and then sells you back your watch. This is false because it is a cynical and unfair description of a consultant’s role and value. A consultant is a person who provides professional or expert advice in a specific field or domain. A consultant can help an organization to identify problems, analyze situations, develop solutions, implement changes, improve performance, or achieve goals. A consultant can also provide knowledge, skills, tools, or resources that the organization may not have or need temporarily. Verified References: https://www.investopedia.com/terms/c/consultant.asp https://phoenixnap.com/blog/what-is-business-continuity-management

A disaster lasting longer than seventy-two (72) hours requires implementation of a business continuity and disaster recovery plan. A business continuity and disaster recovery plan is a comprehensive document that outlines how an organization will respond to and recover from adisaster that disrupts its normal operations. It covers both the IT aspects (disaster recovery) and the business aspects (business continuity) of restoring the critical functions and processes within an acceptable time frame. A disaster lasting longer than seventy-two (72) hours is likely to have significant impacts on the organization’s performance, reputation, assets, and stakeholders, and therefore requires a coordinated and structured approach to ensure its survival and resilience. Verified References: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

Operational risk is the type of risk that is related to human error or achievement. Operational risk is the uncertainty or variability of the execution or outcome of an organization’s functions or processes. Operational risk can result from factors such as inadequate policies, procedures, systems, controls, skills, training, supervision, or compliance. Operational risk can affect an organization’s operational efficiency, quality, safety, security, reputation, or profitability. Verified References: https://www.investopedia.com/terms/o/operational_risk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

BIA helps to identify all of the above aspects of an organization’s functions and processes. It helps to identify the critical services and products that the organization delivers to its customers and stakeholders, and the functions and processes that support them. It also helps to identify the critical interdependencies and interested parties that are involved in or affected by the organization’s functions and processes, such as suppliers, partners, regulators, or employees. Moreover, it helps to identify the tangible and intangible impacts of a disruption to the organization’s functions and processes over a period of time, such as financial losses, reputational damage, legal liabilities, or customer dissatisfaction. Verified References: https://www.ready.gov/business-impact-analysis https://drii.org/resources/professionalpractices/EN