A. A single method should be applied consistently regardless of roles and responsibilities

B. Measurement methods should be designed into day-to-day operations or Business Continuity (BC) activities

C. Personnel should be advised that performance will be judged and action taken if attitudes are unsatisfactory

D. A separate, independent department should be established to oversee the process and summarise results

A. Clarification that all personnel have the responsibility of keeping social media information up to date and should treat this as a priority activity

B. Instruction that external communications should not take place until after the incident is over

C. Permission for communications personnel to make decisions on how the organization is represented in a crisis without prior agreement with top management

D. Identification of the team, group or individual with the responsibility, authority and technical knowledge to deliver communications via each available method

A. A strong financial performance due to increased investment in Business Continuity (BC)

B. A programme that is bespoke to the organization and its culture

C. Reductions in staff turnover due to additional rewards and recognitions made available for supporting Business Continuity (BC)

D. A reduction in the need for support for Business Continuity (BC) from external customers and partners

A. Changes to the environment in which the organization operates

B. Changes to the performance appraisal process

C. Changes to the external auditor

D. Changes to the structure of a competitor organization

A. Be limited to specific high-value areas of the organization

B. Be limited to information technology disaster recovery plans

C. Include as many of the organization's products and services as possible

D. Focus on crisis management

A. A gap analysis

B. A risk assessment matrix

C. A standardized risk rating table

D. Pre-defined impact thresholds

A. Grouping unacceptable risks and single points of failure by owner and having discussions with each activity and resource owner

B. Conducting a risk assessment

C. Creating a set of approved strategies and solutions to mitigate unacceptable risks and single points of failure

D. Conducting an Activity Business Impact Analysis (BIA)

A. Strategies focus on the methods and procedures for business as usual activities whereas solutions focus on the treatments and actions to minimize risks

B. Strategies are based on the outcomes of the Business Impact Analysis (BIA) whereas solutions are based on the outcomes of the risk assessment

C. Strategies align to the direction set out in the Business Continuity policy whilst solutions address the outlined objectives in the Business Continuity Management System (BCMS)

D. Strategies are high-level approaches for meeting the organization's Business Continuity requirements whereas solutions detail how the strategies will be implemented

A. To align the governance of the BCMS with the structure of the organization's business sector

B. To ensure that different parts of the organization can take independent approaches to reflect their preferences and timelines

C. To monitor and review BC training programmes regularly to ensure that any skills gaps identified by the gap analysis are being addressed

D. To provide the foundation for further development, effective operation, support and continual improvement

A. Establish shared understanding of the importance of a BCMS and its relevance to the organization

B. Enable the Business Continuity professional to issue instructions to all on the changes that they will be required to make

C. Share the outcomes of a Business Impact Analysis with internal and external stakeholders

D. Initiate the development of an effective response structure in case of disruption to products or services within the scope of the Business Continuity Management System (BCMS)

A. Failure to meet business objectives

B. Threats that could cause disruption

C. Damage to reputation

D. Breach of legal or regulatory obligations

A. Enforcing regular BC activities such as attendance at briefings or training

B. Establishing a system where BC is seen only as a corporate mandate driven by policy

C. Establishing BC as a culture underpinned by personal beliefs and corporate behaviours

D. Allocating additional responsibilities and objectives related to BC roles to existing workloads

A. The development of training material including all relevant information and procedures so that this can be made available when required

B. Induction and training by an operational manager at the time when the disruption is underway so that individuals can build understanding and confidence prior to commencing the allocated tasks

C. Recruitment of additional personnel so that the organization always has access to surplus staff in case of an incident occurring

D. Links to social media so the organization can run an extensive recruitment campaign both inside and outside the organization if a disruptive event occurs

A. Interview

B. Hot debrief

C. Formal debrief

D. Survey

A. Contractual requirements, including penalties for failure to deliver products and/or services

B. Objectives and strategic direction of the organization

C. Annual training and performance management arrangements

D. Lessons learned from past disruptions and exercises