CBCI 7.0 Certification Course CBCI Book

A BC policy is a leadership-approved, high-level statement that sets direction for the BCMS and guides how business continuity will be approached across the organization. For it to be effective, it must be understood by the people who will implement it—leaders, plan owners, responders, and those supporting recovery. Writing the policy in a concise, easy-to-read way helps ensure it is communicated, absorbed, and acted upon, rather than being treated as a dense compliance document that few people read. In the GPG 7.0 approach, success depends on collaboration and enabling the organization to implement continuity practices in a way that fits how it operates; clarity supports engagement and consistent application.

Option A is incorrect because conciseness is not about restricting information; it is about improving understanding. Option B is the opposite of good practice—policies should avoid unnecessary jargon so they remain accessible. Option D describes a secondary benefit (a policy can be a useful summary), but the primary reason for conciseness is to make the policy straightforward and engaging for the people who must use it.

In GPG 7.0, Embracing Business Continuity (PP2) is about embedding BC into the organization—moving away from “mandating and enforcing compliance” and instead shaping behaviours, ownership, and understanding so BC becomes part of “how we do things here.” When people genuinely embrace BC, the BCMS is more likely to be implemented in a way that fits the organization’s real operating context, language, and norms. That naturally leads to a BC programme that is bespoke to the organization and its culture (option A) rather than a generic, copied framework.

The other options describe outcomes that may happen in some cases but are not reliable or primary indicators of embracing BC. Strong financial performance (B) is not a direct or guaranteed outcome; BC investments can be cost-neutral or even reduced when smartly targeted. Staff turnover reductions from rewards (C) is speculative and depends on HR policy, not BC culture alone. Reduced need for support from external customers/partners (D) misunderstands continuity: embracing BC typically increases structured engagement with key stakeholders, not removes it.

A BCMS depends on clearly defined organizational roles, responsibilities, and authorities so that continuity tasks are not “assumed” or left to chance. In CBCI 7.0’s BCMS establishment practice, assigning roles and responsibilities ensures every required BCMS activity (e.g., analysis participation, strategy ownership, plan maintenance, exercising, and review) is allocated to named people who are competent and understand what is expected of them. This aligns with ISO 22301’s leadership requirement that responsibilities and authorities for relevant roles are established and communicated, so the management system can be implemented and maintained effectively.

Option B best reflects that intent: allocate essential tasks to identified and competent individuals.

Option A is incorrect because governance does not remove top management accountability; leadership remains responsible for direction and ensuring the BCMS is supported. Option C is too narrow (roles exist for the organization’s capability, not just to “help the BC professional”). Option D may be a benefit of training, but it is not the primary purpose of role assignment—role assignment is about clear accountability and dependable execution across the BCMS.

An internal audit is designed to provide independent, objective assurance by evaluating the effectiveness of governance, risk management, and control processes. In a BCMS context, internal audit can assess whether BCMS processes (policy control, BIA/RA governance, plan management, exercising cadence, document control, corrective action tracking) are being followed and are effective as management controls. Importantly, internal audit’s focus is typically on whether processes are adequate and working as intended—not on guaranteeing that the chosen continuity solutions are “the best possible” in an absolute sense. That matches the question’s description: independent assurance on processes without necessarily confirming the adopted solutions are “correct.”

Performance appraisal is an HR tool, not independent assurance. Post-incident review captures learning from a real event and may include subjective performance insights, but it is not primarily an independent assurance mechanism. Quality assurance checks adherence to standards, but it is often not independent in the same formal way as internal audit. Therefore, A is the best answer.