ISO-22301-Lead-Auditor Exam Dumps - PECB Certified ISO 22301 Lead Auditor Exam

Policy formulation is the BCMS process that is used to develop a business continuity policy that sets out an operating framework. According to ISO 22301, the organization shall establish a business continuity policy that is appropriate to the purpose and context of the organization and provides a framework for setting business continuity objectives. The policy shall also demonstrate top management’s commitment to the BCMS and its continual improvement1. The policy formulation process involves the following steps2:

• Define the scope and objectives of the policy
• Identify the relevant internal and external issues and requirements
• Analyze the current state of the BCMS and the gaps to be addressed
• Draft the policy statement and the key principles and guidelines
• Review and approve the policy by the top management
• Communicate and distribute the policy to the relevant stakeholders
• Monitor and update the policy as needed References:
• ISO 22301:2019, clause 5.3
• ISO 22301 Auditing eBook, page 24

Process-oriented objectives are the objectives that focus on the BCM activities that support the achievement of people-and performance-oriented objectives, as defined by ISO 22301. Process-oriented objectives are derived from the business continuity policy and the results of the business impact analysis (BIA) and risk assessment (RA). Process-oriented objectives are measurable, consistent, and relevant to the organization’s business continuity requirements and strategies. Process-oriented objectives are also aligned with the organization’s strategic direction and communicated to all relevant parties. Process-oriented objectives are one of the key requirements of ISO 22301, as they provide the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 28 1; ISO 22301:2019, clause 6.2 2

Stakeholders are individuals or groups that have an interest in the organization’s performance. According to the ISO 22301 Auditing eBook, "Stakeholders are persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity of the organization. Stakeholders can be internal or external to the organization. Examples of internal stakeholders are employees, managers, owners, and board members. Examples of external stakeholders are customers, suppliers, regulators, investors, competitors, media, and the public."1 Stakeholders have different needs and expectations regarding the organization’s business continuity management system (BCMS) and its ability to respond to and recover from disruptive incidents. Therefore, the organization needs to identify its relevant stakeholders and understand their requirements and expectations, as well as communicate with them effectively and appropriately. This is one of the requirements of ISO 22301, the international standard for business continuity management systems. ISO 22301 requires the organization to determine the interested parties that are relevant to its BCMS and the requirements of these interested parties2. Interested parties are a subset of stakeholders that have a direct or indirect influence on the BCMS or a stake in its outcome3. The organization also needs to monitor and review the information about these interested parties and their requirements, as they may change over time2. References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.1: Stakeholders1
• ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 4.2: Understanding the needs and expectations of interested parties2
• Interested parties in ISO 27001 and ISO 22301 | Who are they?3

Performance evaluation is the BCMS process that analyzes the adequacy of the business continuity capability using defined targets and performance indicators. It involves monitoring, measuring, analyzing, and evaluating the BCMS performance and effectiveness, as well as conducting internal audits and management reviews. Performance evaluation helps to identify the strengths and weaknesses of the BCMS, as well as the opportunities for improvement and corrective actions. Performance evaluation is one of the key requirements of ISO 22301, as it demonstrates the organization’s commitment to continual improvement and customer satisfaction. References: ISO 22301 Auditing eBook, page 19 1; ISO 22301:2019, clause 9 2

 According to ISO 22301, a business continuity management system (BCMS) is a part of the organization’s overall management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity. A management system is a set of interrelated or interacting elements of an organization that establishes policies and objectives and enables the achievement of those objectives. A management system can address one or more disciplines, such as quality, environment, information security, or business continuity. Therefore, a BCMS is not limited to the IT management system, nor is it always managed by an external service provider. A BCMS is integrated with the organization’s strategic direction, culture, values, and processes, and it involves the participation and commitment of all levels and functions of the organization. References: ISO 22301 Auditing eBook, page 9 1; ISO 22301:2019, clause 3.4 2