BCI Advanced Professional Practice 2 — Questions and Answers
Question 1: When conducting a post-incident review, which approach best supports a 'blameless' organizational culture?
- Focus on identifying the individual who caused the failure
- Analyze systemic factors and process gaps rather than assigning personal fault (Correct answer)
- Document lessons learned only for senior management review
- Defer the review until all legal claims are resolved
Correct answer: Analyze systemic factors and process gaps rather than assigning personal fault
A blameless culture focuses on systemic causes and process improvements rather than individual fault, enabling honest reporting and continuous improvement.
Question 2: Which metric is MOST appropriate for measuring the effectiveness of a business continuity awareness program?
- Number of training sessions delivered per quarter
- Percentage of staff who can correctly describe their role in a disruption (Correct answer)
- Cost of training materials purchased annually
- Volume of BC policy documents distributed
Correct answer: Percentage of staff who can correctly describe their role in a disruption
Effectiveness is best measured by whether staff can actually perform their roles, not by activity outputs like sessions delivered.
Question 3: A BC professional is reviewing supply chain risk. Which practice best addresses 'concentration risk' among suppliers?
- Negotiating longer contract terms with the primary supplier
- Qualifying multiple alternative suppliers across different geographic regions (Correct answer)
- Increasing inventory safety stock levels at a single warehouse
- Requiring suppliers to obtain ISO 9001 certification
Correct answer: Qualifying multiple alternative suppliers across different geographic regions
Concentration risk is reduced by diversifying the supplier base geographically so that a single event cannot impact all sources simultaneously.
Question 4: Under the BCI Good Practice Guidelines, what distinguishes 'resilience' from 'recovery'?
- Resilience focuses on restoring operations after disruption; recovery focuses on preventing disruption
- Resilience is the ability to absorb and adapt to disruption; recovery is restoring to a prior state (Correct answer)
- Resilience applies only to IT systems; recovery applies to business processes
- Resilience is a short-term measure; recovery is a long-term strategic objective
Correct answer: Resilience is the ability to absorb and adapt to disruption; recovery is restoring to a prior state
Resilience encompasses absorbing shocks and adapting, while recovery specifically refers to returning operations to a defined prior state.
Question 5: When integrating BC into an organization's Enterprise Risk Management (ERM) framework, which activity is MOST critical?
- Replacing the risk register with the BC plan
- Aligning BC risk appetite statements with the organization's overall risk appetite (Correct answer)
- Ensuring BC is led solely by the IT department
- Conducting BIAs quarterly regardless of risk changes
Correct answer: Aligning BC risk appetite statements with the organization's overall risk appetite
Aligning BC risk appetite with ERM ensures consistent decision-making and avoids conflicting tolerances across the organization.
Question 6: A BC manager discovers that the Recovery Time Objective (RTO) for a critical process cannot be met with current resources. What is the FIRST recommended action?
- Extend the RTO to match current recovery capability
- Document the gap and present options with costs and risks to senior management (Correct answer)
- Immediately procure additional resources without leadership approval
- Remove the process from scope of the BC program
Correct answer: Document the gap and present options with costs and risks to senior management
Gaps between required RTOs and current capability must be escalated with options so that informed decisions can be made at the appropriate level.
Question 7: Which of the following BEST describes the purpose of a 'hot site' in business continuity planning?
- A location used for long-term relocation after a catastrophic loss
- A fully equipped alternate facility that can be activated immediately upon declaration (Correct answer)
- A shell building with power and connectivity but no pre-installed equipment
- An off-site data vault for storing backup media
Correct answer: A fully equipped alternate facility that can be activated immediately upon declaration
A hot site is a fully equipped, staffed-ready alternate facility designed for near-immediate activation, minimizing downtime.
BCI Advanced Professional Practice 2
When conducting a post-incident review, which approach best supports a 'blameless' organizational culture?