ISO-22301-Lead-Auditor Premium Exam Questions

A time-based objective is an objective that should be attainable within a given timeframe. Time-based objectives help to ensure that the organization is taking timely and realistic actions to achieve its desired outcomes and performance. Time-based objectives also help to monitor and measure the progress and results of the actions, as well as to identify and address any delays or deviations. Time-based objectives are one of the characteristics of the S.M.A.R.T. concept, which stands for Specific, Measurable, Achievable, Relevant, and Time-based. The S.M.A.R.T. concept is a useful tool for setting effective objectives that are clear, realistic, and meaningful. The S.M.A.R.T. concept is applicable to various types of objectives, such as business continuity objectives, recovery time objectives, recovery point objectives, minimum business continuity objectives, etc. According to the ISO 22301 Auditing eBook, "Time-bound: BCOs [Business Continuity Objectives] should be time-bound, with clear deadlines and timelines for achieving the objectives. This ensures that the organization is taking timely action to protect critical business functions during a disruptive incident."1 References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.3: Business Impact Analysis2
• How to set ISO 22301 Business Continuity Objectives - Advisera1
• What is the Plan-Do-Check-Act (PDCA) Cycle?3

 The Do step in the PDCA cycle implements the previous selected controls to meet the control objectives. According to the ISO 22301 Auditing eBook, the Do step involves implementing and operating the business continuity policy, controls, processes, and procedures that have been planned in the previous step. The Do step also includes establishing the necessary resources, competencies, awareness, communication, and documentation to support the effective operation of the business continuity management system (BCMS). The Do step aims to ensure that the organization is prepared to respond to and recover from disruptive incidents in a timely and effective manner. References: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.

A documentary review is a type of review that involves examining documents, records, or other forms of evidence related to the audit criteria and objectives. It can often be used as a secondary method to support other forms of information collection methods, such as interviews, observations, or sampling. A documentary review can help to verify the existence, implementation, and effectiveness of the audited processes, activities, or controls. It can also provide useful information about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the auditees and other relevant parties. References: ISO 22301 Auditing eBook, page 611; ISO 19011:2018, clause 6.3.22

Supporting functions are the functions that provide support to the critical functions of an organization, such as human resources, finance, IT, or facilities management. Supporting functions are essential for the continuity of the critical functions, but they are not directly involved in delivering the products or services to the customers. Supporting functions are also part of the scope of the business continuity management system (BCMS) and need to be identified, analyzed, and protected by the organization. Supporting functions are one of the key concepts of ISO 22301, as they help the organization to determine its business continuity requirements and strategies. References: ISO 22301 Auditing eBook, page 23 1; ISO 22301:2019, clause 8.2.2 2