Free BCI CBCI Practice Exam with Questions & Answers | Set: 2

A post-incident review (PIR) is a comprehensive evaluation conducted after an actual disruption or incident, designed to assess what happened, how the response was managed, and lessons learned. The CBCI 7.0 course details that PIRs often involve gathering qualitative and quantitative data, including interviews with participants, examination of activity logs, media coverage, and visual evidence like photos and videos. This multi-source review provides a holistic understanding of the incident’s impact, the effectiveness of plans, and areas for improvement. It differs from audits or appraisals by its focus on real events rather than planned assessments or individual performance evaluations. PIRs are critical for continuous improvement of the BCMS.

An effective BC policy is a high-level statement of intent and direction, formally expressed and endorsed by top management. Its effectiveness depends on visible leadership commitment—because leadership is responsible for ensuring the policy aligns with the organization’s strategic direction, is communicated, resourced, and kept under review for suitability. In BCI guidance, establishing the business continuity policy specifically requires top management action, support, and commitment, with governance to maintain and improve the policy over time.

Option A best reflects this core characteristic: top management commitment and continual improvement. The other options describe items that are typically handled in plans or supporting documents (e.g., incident management plan details, budget specifics, supplier constraints, or exercise lessons learned). Those elements may inform the BCMS, but they do not define what a BC policy is. The policy sets the framework and expectations; detailed procedures, constraints, and exercise learnings are managed elsewhere within the BCMS lifecycle.

The Process BIA focuses on understanding internal processes, their resource needs, and dependencies that impact the delivery of products and services. The CBCI 7.0 course underlines that this BIA level identifies critical resources, interdependencies among activities, and potential bottlenecks. It complements Product and Service BIAs by providing detailed operational insights necessary for designing effective recovery strategies. Processes outsourced to third parties are typically included to ensure a complete picture. This analysis is a core component of the BIA framework and is not optional.

A Business Continuity policy acts as a foundational document that communicates the organization’s commitment to Business Continuity and sets out its scope, objectives, and principles. The CBCI 7.0 course stresses that the policy fosters a shared understanding across the organization about the importance of the BCMS and ensures that personnel recognize its relevance to their roles. It does not specify operational details or mandate actions but guides governance and culture. The policy supports alignment of efforts and continuous improvement of the BCMS.

The CBCI 7.0 course stresses that embracing Business Continuity adds value primarily by enhancing organizational resilience, which translates into a competitive advantage. Being able to maintain operations during disruptions preserves customer confidence, safeguards revenue, and protects reputation. While improved health and safety and conflict resolution are indirect benefits, they are not the primary value drivers. Delegating responsibilities effectively supports continuity but does not capture the strategic benefit. Communicating resilience as a competitive edge helps secure leadership buy-in and resource allocation for continuity initiatives.

Questionnaires and surveys are widely used and effective techniques for gathering BIA information. They enable the Business Continuity professional to collect standardized data on activity priorities, dependencies, and recovery requirements from a broad range of stakeholders. The CBCI 7.0 course highlights that well-designed questionnaires provide structured insights while being scalable and efficient, especially in larger organizations. While workplace observation and reviews provide useful context, and budget reviews may give financial perspectives, they are not primary tools for capturing the detailed operational data needed for BIAs.

Recovery Point Objective (RPO) defines the maximum acceptable age of data to be recovered following a disruption, effectively setting the point in time to which information must be restored. The CBCI 7.0 course explains that RPOs vary depending on the priority and criticality of activities, requiring consultation with data users to ensure continuity needs are met accurately. RPOs are crucial for developing backup and data recovery strategies and directly influence the selection of technical solutions. While data protection compliance is necessary, it is not the primary function of RPO. Additionally, RPO focuses on data restoration points, not on the duration IT services can be disrupted—that relates to Recovery Time Objective (RTO).

CBCI 7.0 aligns its risk assessment language to ISO/BCI terminology. BCI guidance defines risk assessment as an overall process of risk identification, risk analysis, and risk evaluation. In the wording of your question, “listing risk sources” maps to risk identification, and “performing a risk source analysis” maps to risk analysis (examining likelihood and consequences to understand risk level). The third step, therefore, is risk evaluation—comparing analysed risks against agreed criteria (risk appetite/tolerance) to decide whether further action is needed and to prioritise treatment.

Option C (assessing consequences) is part of risk analysis, not the final step. Options A and B can be helpful techniques, but they are not the standard third step in the three-step risk assessment model used in BC/ISO-aligned frameworks. Therefore, the correct answer is D: Evaluating risks.

The CBCI 7.0 course defines embracing Business Continuity as a cultural commitment by personnel who recognize the importance of Business Continuity in protecting organizational interests. It goes beyond policy mandates or role compliance and reflects genuine belief and ownership. Embracing Business Continuity is integrated with the broader organizational culture rather than existing separately. This deep commitment improves resilience and the effectiveness of continuity efforts at all levels.

The CBCI 7.0 course explains that defining the BCMS scope is a dynamic process, which means that the parameters set are not necessarily permanent and may be reviewed and revised as organizational needs, risks, and priorities evolve. While the scope provides clarity on which parts of the organization, products, services, and activities are included, it must remain flexible to adapt to change. Permanent or fixed parameters risk locking the BCMS into outdated or incomplete coverage, reducing effectiveness. Efficient use of time and resources is a benefit of appropriate scoping, but permanence is not a characteristic of good scope definition.