PECB ISO-22301-Lead-Auditor Exam Dumps

Communication is the process of engaging staff and external stakeholders in all aspects of the BCMS. Communication ensures that the BCMS objectives, policies, procedures, roles and responsibilities are understood and accepted by the relevant parties. Communication also facilitates the exchange of information and feedback between the BCMS and its interested parties, such as customers, suppliers, regulators, media, etc. Communication helps to build trust, awareness and commitment to the BCMS, as well as to enhance its performance and effectiveness.Reference: ISO 22301 Auditing eBook, page 30; ISO 22301:2019, clause 7.4

The PDCA paradigm cycle is widely recognized as a process-centric approach. The PDCA cycle, also known as the Deming cycle or the Shewhart cycle, is a four-step model for carrying out change and improvement in a systematic and consistent way. The PDCA cycle consists of the following phases: Plan, Do, Check, and Act. The Plan phase involves identifying the problem, setting the objectives, and developing the plan for improvement. The Do phase involves implementing the plan and carrying out the actions. The Check phase involves monitoring and measuring the results and comparing them with the objectives. The Act phase involves taking corrective actions, standardizing the improvement, and reviewing the process. The PDCA cycle is a process-centric approach because it focuses on the processes and their interactions that deliver the desired outcomes and performance. The PDCA cycle helps to ensure that the processes are planned, executed, evaluated, and improved in a continuous and consistent manner. The PDCA cycle is also aligned with the process approach principle of ISO 22301, the international standard for business continuity management systems. ISO 22301 requires the organization to apply the PDCA cycle to its business continuity management system, as well as to its individual processes and activities. The PDCA cycle helps the organization to establish, implement, operate, monitor, review, maintain, and continually improve its business continuity management system and its ability to respond to and recover from disruptive incidents.Reference:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems, Section 1.3: PDCA Cycle1

ISO 22301:2019 - Security and resilience --- Business continuity management systems --- Requirements, Clause 0.3: The Plan-Do-Check-Act cycle2

What is the Plan-Do-Check-Act (PDCA) Cycle?3

A documentary review is a type of review that involves examining documents, records, or other forms of evidence related to the audit criteria and objectives. It can often be used as a secondary method to support other forms of information collection methods, such as interviews, observations, or sampling. A documentary review can help to verify the existence, implementation, and effectiveness of the audited processes, activities, or controls.It can also provide useful information about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the auditees and other relevant parties.Reference: ISO 22301 Auditing eBook, page 611; ISO 19011:2018, clause 6.3.22

Process management is the framework that is a continuous and progressive cycle that requires managerial, operational, administrative and technical support. Process management refers to the design, implementation, monitoring, evaluation, and improvement of the processes that deliver value to the organization and its stakeholders. Process management involves the following steps:

Define the process: Identify the purpose, scope, objectives, inputs, outputs, activities, roles, and responsibilities of the process.

Document the process: Create a visual representation of the process flow, such as a flowchart, diagram, or map, that shows the sequence of tasks, decisions, and interactions within the process.

Implement the process: Execute the process according to the defined and documented specifications, using the appropriate resources, tools, and methods.

Monitor the process: Measure and analyze the performance of the process, using key performance indicators (KPIs), metrics, and feedback mechanisms, to ensure that the process meets the expected outcomes and quality standards.

Evaluate the process: Review and assess the effectiveness and efficiency of the process, using audit, review, and evaluation techniques, to identify the strengths, weaknesses, opportunities, and threats of the process.

Improve the process: Implement corrective and preventive actions, based on the results of the evaluation, to enhance the process and eliminate or reduce the causes of nonconformities, errors, or inefficiencies.

Process management is a continuous and progressive cycle that requires managerial, operational, administrative and technical support, as the process is constantly subject to change and improvement, based on the changing needs and expectations of the organization and its stakeholders. Process management also supports the implementation and maintenance of a business continuity management system (BCMS), as it helps the organization to identify, protect, and optimize its critical business processes and resources, and to ensure their continuity and resilience in the event of a disruption.Reference:

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.4: Planning, Page 18

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.6: Performance Evaluation, Page 21

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.7: Improvement, Page 23

ISO 22301 Auditing eBook, Chapter 4: Business Continuity Management System Audit, Section 4.1: Audit Principles, Page 26

ISO 22301 Auditing eBook, Chapter 4: Business Continuity Management System Audit, Section 4.3: Audit Process, Page 28

The Incident Management Structure (IMS) is a framework for organizing and managing the response to a disruptive incident. The IMS defines three levels of management activities: strategic, tactical, and operational. The strategic level is responsible for setting the overall direction and objectives of the response, as well as allocating resources and coordinating with external stakeholders. The tactical level is responsible for implementing the strategic decisions and managing the operational teams. The tactical level also monitors the situation and reports to the strategic level. The operational level is responsible for executing the specific tasks and actions required to achieve the objectives of the response. The operational level also provides feedback to the tactical level on the progress and issues encountered.Reference:

ISO 22301 Auditing eBook, Chapter 4: Incident Response and Recovery, Section 4.2: Incident Management Structure1

ISO 22320:2018(en), Security and resilience --- Emergency management --- Guidelines for incident management2