Free BCI CBCI Practice Exam with Questions & Answers

CBCI 7.0 treats maintenance and review as part of ensuring the BCMS remains effective and fit for purpose over time. In BCI guidance, maintenance activities are commonly triggered by meaningful change—especially changes that alter risk, dependencies, or the organization’s operating context. A core trigger explicitly referenced in BCI Good Practice material is “changes to the environment in which the organization operates.” This includes shifts such as new geopolitical conditions, supply-chain volatility, technology changes, emerging threats, regulatory changes in the wider environment, or market/infrastructure changes that can invalidate assumptions in the BIA, strategies, plans, and response structures.

Option A therefore represents a direct and widely recognized trigger for BCMS maintenance. By contrast, option B (performance appraisal process) is usually an internal HR mechanism and only indirectly relevant unless it changes competence/accountability expectations for BC roles. Option C (external auditor changes) does not inherently change continuity capability. Option D (competitor organizational structure) is not a BCMS maintenance trigger in itself; benchmarking can inform improvement, but it doesn’t automatically require maintenance updates.

In CBCI 7.0, PP1 – Establishing a BCMS includes defining the BCMS scope and recognizing that BCMS activities are not one-time tasks; they evolve as the organization changes. Scope review is normally triggered by changes that materially affect continuity requirements—such as structural changes, changes to products/services, delivery models, locations, technology, critical resources, or external obligations. A merger (A) can significantly change organizational boundaries, critical activities, and dependency networks, requiring scope reassessment. A change in legal/regulatory requirements (B) can introduce new continuity obligations and thresholds for unacceptable impact, again affecting scope. A change in how products/services are delivered (C)—for example increased outsourcing, new platforms, or new channels—changes dependencies and recovery priorities, often requiring scope review.

Option D is different: appointing a communications manager to run a promotion campaign is not, by itself, a material change to continuity requirements or the operating model of prioritized products and services. Unless it creates a new critical service/dependency (which the option does not state), it would not normally trigger a BCMS scope review.

The CBCI 7.0 course stipulates that appointing deputies or alternates for each BCMS role is a governance best practice ensuring continuity of responsibility and decision-making. Deputies are subject matter experts equipped to act on behalf of the primary role holder during absences, maintaining operational integrity and responsiveness. Relying on the Business Continuity professional or Incident Response Team to cover absent roles without formal deputization risks delays and gaps. Putting responsibilities on hold is unacceptable as it compromises continuity efforts.

GPG 7.0 explains that Analysis (PP3) uses two techniques: BIA and Risk Assessment. The BIA determines the impacts of disruption over time and identifies priorities and resource requirements; then the risk assessment analyses the relevant risks to prioritised activities to find concentrations of risk or potential points of failure. This sequencing is logical: you first decide what matters most and what must be recovered (BIA outputs), and then you assess what could stop those priorities from being delivered (risk assessment focused on prioritised products/services/activities). That is exactly what option B states.

Option A may be a side benefit, but it is not the core methodological reason. Option C is not a BC good-practice rationale. Option D is incorrect because PP3 risk assessment is typically scoped to prioritised activities rather than being a generic “full organizational risk assessment.”

Note on “100% verified from CBCI 7.0 course documents”: I cannot access the paid CBCI courseware directly, but these answers are verified against official BCI GPG 7.0 materials and BCI PP3/PP2 published guidance, which CBCI 7.0 is based on.

CBCI 7.0 places strong emphasis on Embracing Business Continuity (PP2), which is centred on education and awareness to improve BC culture and build voluntary commitment. PP2 explicitly focuses on understanding “the mindset of an organization” and its existing culture before attempting to influence it, because culture affects how people engage with BC activities and how sustainable the programme will be. An effective awareness strategy must therefore be tailored to organizational context: in a large organization, you may need multiple channels and segmented messaging; in a smaller organization, more direct engagement may work better. Likewise, if the culture is siloed, messages may need different champions than in a collegiate culture. Finally, people’s preferred information channels (briefings, intranet, video, manager cascades, social platforms, etc.) determine how awareness can realistically reach and influence the workforce. This is why these factors are most directly linked to developing an awareness strategy rather than to exercise planning, plan writing, or solution design.

The CBCI 7.0 course explains that an Activity Business Impact Analysis (BIA) provides detailed identification of dependencies necessary to deliver prioritized products and services. This includes internal dependencies such as departments and resources, and external dependencies such as suppliers and partners. Mapping these dependencies is crucial to understanding potential vulnerabilities and planning continuity solutions that address both internal process interrelations and supply chain considerations. The Product and Services BIA focuses more on outcomes and impacts, while risk assessments identify threats but do not detail operational dependencies. Initial assessments are broader and less detailed.

BC culture is about everyday beliefs and behaviours, so measuring it effectively works best when measurement is embedded into normal ways of working rather than being an occasional, artificial “inspection.” GPG 7.0’s PP2 focus is to improve BC culture by embedding business continuity into the organization—not by enforcing compliance through fear or one-off campaigns. Therefore, option C is the strongest: build culture measurement into routine operations or BC activities (e.g., participation quality in BIA workshops, plan ownership, training completion with evidence of understanding, exercise performance trends, improvement actions closed on time, and staff feedback loops). This creates continuous insight and supports continual improvement rather than sporadic reporting.

Option A is weak because culture varies by role; different groups may need different measurement approaches (leaders, responders, recovery owners, general staff). Option B is unnecessary; oversight can sit within governance structures (e.g., steering group) without creating a whole new department. Option D is counterproductive: threatening consequences typically produces superficial compliance, which PP2 explicitly moves away from.

The CBCI 7.0 course stresses that governance arrangements are key to securing ongoing commitment and support across all levels and functions within an organization. Effective governance structures facilitate leadership involvement, resource allocation, decision-making, and accountability, which are crucial for embedding Business Continuity. While project risk registers and research are valuable tools, and authority is necessary, governance’s primary function is to maintain organization-wide engagement and alignment, ensuring the BCMS is sustained and evolves with business needs.

BCMS governance is about direction, oversight, and control—setting expectations, monitoring whether the BCMS is effective, and ensuring it remains fit for purpose. The BCI GPG 7.0 (Lite) highlights that a BCMS must operate and maintain processes and response structures while monitoring and reviewing performance and effectiveness, and using qualitative/quantitative measures to drive continual improvement. Governance also includes ensuring the BCMS aligns with external obligations such as relevant legal and regulatory requirements, because non-compliance can create unacceptable impacts and can influence priorities and recovery requirements.

What governance does not do is “run the recovery work” itself. Carrying out specific operational activities (e.g., restoring systems, relocating teams, executing step-by-step recovery tasks) is the role of operational teams and plan owners under the response structure, not BCMS governance. Governance ensures those operational capabilities exist, are resourced, and are validated—but it does not execute them day-to-day. Therefore, option A is the activity that is not part of governance, while options B, C, and D are core governance responsibilities.

BCMS governance exists to ensure the organization has clear direction, oversight, accountability, and decision-making for business continuity. In CBCI 7.0’s PP1 focus, governance provides the structure for defining scope, setting policy and objectives, assigning roles, allocating resources, and ensuring the BCMS is operated and improved over time. Governance is therefore the foundation that enables consistent implementation and prevents BC from becoming fragmented or optional.

This aligns with internal audit/assurance concepts: effective governance is what allows an organization to evaluate and improve the effectiveness of risk management, control, and governance processes in a disciplined way—BCMS governance works similarly by ensuring BC processes are defined, owned, monitored, and improved.

Option B is too narrow (training is only one governance output). Option C contradicts BCMS intent—independent, inconsistent approaches create gaps and misalignment. Option D is irrelevant; governance must fit the organization’s structure and objectives, not the “sector structure.” Therefore, A is correct.