DRI Continuous Improvement & Auditing 2 — Questions and Answers
Question 1: Which PDCA cycle phase involves executing the plan on a small scale to test its effectiveness?
- Plan
- Do (Correct answer)
- Check
- Act
Correct answer: Do
The 'Do' phase of the PDCA cycle involves implementing the plan on a small or pilot scale to gather data.
Question 2: During a BC program audit, an auditor discovers that a critical vendor's recovery capability has never been verified. This is best categorized as:
- A minor observation
- A material finding requiring corrective action (Correct answer)
- An acceptable risk acceptance
- A documentation gap only
Correct answer: A material finding requiring corrective action
An unverified critical vendor recovery capability represents a material gap that requires a formal corrective action plan.
Question 3: What does a 'maturity model' measure in the context of a BC program?
- The age of the business continuity plan documents
- The organization's capability and process sophistication over time (Correct answer)
- The number of completed DR tests
- Employee tenure in BC roles
Correct answer: The organization's capability and process sophistication over time
A maturity model assesses the sophistication and capability level of BC processes, from ad hoc to optimized.
Question 4: Which metric is most useful for tracking whether BCP gaps identified in prior audits are being resolved?
- Number of new threats identified
- Corrective action closure rate (Correct answer)
- Annual plan revision count
- Test scenario complexity score
Correct answer: Corrective action closure rate
The corrective action closure rate directly measures whether identified gaps from prior audits are being remediated on schedule.
Question 5: A post-incident review reveals that communication delays were the primary cause of extended recovery time. The continuous improvement action should prioritize:
- Replacing the recovery team
- Revising notification and escalation procedures (Correct answer)
- Increasing IT infrastructure capacity
- Reducing the number of recovery objectives
Correct answer: Revising notification and escalation procedures
When communication delays are the root cause, revising notification and escalation procedures directly addresses the identified problem.
Question 6: An organization uses a 'lessons learned registry.' What is the primary purpose of this document?
- To archive completed exercises for compliance filing
- To capture and track insights from incidents and tests for future improvement (Correct answer)
- To document employee training completions
- To record vendor SLA performance
Correct answer: To capture and track insights from incidents and tests for future improvement
A lessons learned registry systematically captures insights and action items from exercises and incidents to drive continuous improvement.
Question 7: When auditing a BC program, which document best demonstrates that leadership is actively engaged and accountable for the program?
- A detailed BCP with appendices
- Signed executive sponsorship statements and steering committee minutes (Correct answer)
- A list of all staff trained in BC procedures
- The latest business impact analysis report
Correct answer: Signed executive sponsorship statements and steering committee minutes
Signed sponsorship statements and steering committee minutes provide direct evidence of leadership engagement and accountability.
DRI Continuous Improvement & Auditing 2
Which PDCA cycle phase involves executing the plan on a small scale to test its effectiveness?