Free PECB Certified ISO 22301 Lead Auditor Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO 22301 Lead Auditor practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What is the purpose of a business impact analysis (BIA) process in determining continuity priorities?

   1. A.Assess disruption effects over time to justify continuity prioritiesCorrect answer: A
   2. B.Rank threats by likelihood to set continuity priorities
   3. C.Choose recovery solutions before establishing continuity priorities
   4. D.Judge control effectiveness to determine continuity priorities

   Explanation: ISO/TS 22317 says: "The BIA process analyses the effects of a disruption on the organization." Its outcome justifies continuity priorities and requirements. Threat likelihood, controls and choosing solutions are related activities, but they do not define the BIA's stated purpose.

   Reference: ISO/TS 22317:2021 Guidelines for business impact analysis — Introduction

2. 2In the BCMS Plan-Do-Check-Act cycle described by ISO 22301:2019, what is the focus of the Check phase?

   1. A.Establishing the system
   2. B.Implementing and operating the system
   3. C.Monitoring and reviewing the systemCorrect answer: C
   4. D.Maintaining and improving the system

   Explanation: The introduction identifies "Check (monitor and review)". Establishing belongs to Plan, implementation and operation to Do, and maintenance and improvement to Act.

   Reference: ISO 22301:2019 Business continuity management systems — Requirements — Introduction, 0.3 Plan-Do-Check-Act cycle

3. 3A customer audits a supplier's BCMS because the customer relies on the supplier's services. What type of audit is this?

   1. A.First-party audit
   2. B.Second-party auditCorrect answer: B
   3. C.Third-party certification audit
   4. D.Internal self-assessment

   Explanation: ISO 19011 explains that "Second-party audits are conducted by parties having an interest in the organization, such as customers". The customer has an interest in the supplier, while a first-party audit is conducted by or on behalf of the organization itself.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.1, audit, note 2

4. 4A BCMS audit team specifies the locations, processes and period it will examine. Which element is it defining?

   1. A.Audit scopeCorrect answer: A
   2. B.Audit criteria
   3. C.Audit findings
   4. D.Audit conclusion

   Explanation: ISO 19011 defines the scope as the "extent and boundaries of an audit" and notes that it generally includes locations, functions, processes and time period. Criteria are the requirements used for comparison.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.6, Audit scope

5. 5What is a principal purpose of stage 1 in a two-stage initial certification audit?

   1. A.Determine whether the system is ready and plan the next audit stageCorrect answer: A
   2. B.Determine the effectiveness of implemented controls for certification
   3. C.Verify that corrective actions from the certification audit are effective
   4. D.Decide whether certification should be granted on the audit results

   Explanation: The guidance describes stage 1 as "primarily for scoping and planning the subsequent part of the certification audit" and says it allows the auditor "to evaluate if that organization is ready for certification". These are preparatory purposes; implementation effectiveness is evaluated in the later audit stage.

   Reference: ISO 9001 Auditing Practices Group: Two Stage Initial Certification Audit — p. 1, purpose of stage 1

6. 6Under ISO 19011:2026, what is an audit conclusion based on?

   1. A.The audit objectives and all audit findingsCorrect answer: A
   2. B.The audit plan before evidence is gathered
   3. C.Only the first finding reported by the team
   4. D.Only the auditee's preferred corrective actions

   Explanation: ISO 19011 defines the conclusion as the audit result "after consideration of the audit objectives and all audit findings". It is not determined from the plan or a single finding alone.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.12, Audit conclusion

7. 7How does an audit programme differ from an audit plan under ISO 19011?

   1. A.A programme schedules one audit's activities; a plan sets the overall audit purpose over time
   2. B.A programme arranges audits over a time frame for a purpose; a plan describes activities for an auditCorrect answer: B
   3. C.A programme defines an audit's evidence; a plan defines its findings
   4. D.A programme defines an audit's boundaries; a plan defines its criteria

   Explanation: ISO 19011 defines an audit programme as "arrangements for a set of one or more audits" planned over a time frame for a purpose, and an audit plan as a "description of the activities and arrangements for an audit". They operate at different levels.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — Clauses 3.5 audit programme and 3.7 audit plan

8. 8In a business impact analysis, what does the maximum tolerable period of disruption estimate?

   1. A.The target time for resuming a prioritized activity
   2. B.The time until adverse impacts on products and services become unacceptableCorrect answer: B
   3. C.The point to which disrupted data must be recovered
   4. D.The time needed to implement a chosen recovery strategy

   Explanation: ISO/TS 22317 describes MTPD as the "time it would take for adverse impacts to products and services to become unacceptable" following a disruption. A recovery target, data recovery point and implementation duration describe different concepts.

   Reference: ISO/TS 22317:2021 Guidelines for business impact analysis — Introduction, BIA process outcomes, item d

9. 9A BCMS team is maintaining and improving its system after examining performance results. Which PDCA phase describes that work?

   1. A.Plan
   2. B.Do
   3. C.Check
   4. D.ActCorrect answer: D

   Explanation: ISO 22301 associates the Act phase with "maintain and improve". Plan establishes, Do implements and operates, and Check monitors and reviews.

   Reference: ISO 22301:2019 Business continuity management systems — Requirements — Introduction, 0.3 Plan-Do-Check-Act cycle

10. 10A company uses an external contractor to perform its own internal BCMS audit on its behalf. How is that audit classified?

    1. A.A first-party auditCorrect answer: A
    2. B.A second-party audit
    3. C.A third-party certification audit
    4. D.A surveillance audit by a certification body

    Explanation: ISO 19011 states that "Internal audits, sometimes called first-party audits, are conducted by, or on behalf of, the organization itself." Using a contractor does not by itself turn the audit into a second- or third-party audit.

    Reference: ISO 19011:2026 Guidelines for auditing management systems — Clause 3.1, audit, note 1