Question 1

Which of these is not an example of a crisis?

Accepted Answer

Since a crisis must risk adversely impacting the company and/or its stakeholders, the newly hired employee threatening to quit is not considered a crisis.
Key Takeaway: Each company can define a crisis in their own terms as they make sense for the company, however, to prevent excessive effort for minimal return, a crisis should be defined as something that could have moderate to significant impact on the company.

Question 2

What is the definition of a critical function?

Accepted Answer

A critical function cannot be out of service for more than a few business days, without it having a negative impact to the business or organization.
Key Takeaway: Critical processes should be prioritized in the Business Continuity Plan and should have backup processes in place to ensure their continued operation in the event of a crisis.

Question 3

What are considered "critical records"? (Select all that apply.)

Accepted Answer

Critical records are records that if lost or destroyed due to a crisis would be very expensive and inconvenient to replace. While it is never ideal to lose records with personal information or secure information, unless these records are expensive or inconvenient to replace, they are not considered critical records.
Key Takeaway: Critical records should be protected from the impacts of a crisis or threat as much as possible, as they are inconvenient or expensive to replace. It is ideal to store duplicates of these records in a secure facility that is not connected to the primary worksite.

Question 4

What is the term used to describe the process of assessing the number of injuries and amount of property destruction?

Accepted Answer

Damage assessment is the process used to determine the extent of injuries, property damage, and other losses after a crisis has occurred.
Key Takeaway: Damage assessment allows the Business Continuity team and the Crisis Management team to determine the extent of the damages and make plans based on those assessments. Damage assessment should be completed shortly after the crisis has occurred.

Question 5

An evacuation must be orderly, phased, and structured.

Accepted Answer

True. In order to be considered an evacuation, it must be conducted in an orderly and structured fashion.
Key Takeaway: Evacuations should maintain order within a crowd while still allowing the people to remove themselves from the dangerous area. Without order and structure, an evacuation will quickly degenerate into chaos and will actually increase the amount of time needed to remove the people from the building or area.

Question 6

Which term is best describes the process used to lessen or reduce the impact of a crisis?

Accepted Answer

Mitigation is the process used to reduce or lessen the impact of a crisis or threat.
Key Takeaway: Crisis mitigation should be used whenever the crisis cannot be prevented entirely
such as in the case of a tornado or fire. Mitigation plans should be included in the Business Continuity Plan and trained to employees throughout the organization.

Question 7

Assigning accountability for the Business Continuity Plan is part of which step?

Accepted Answer

One of the first steps in the Readiness phase is to assign accountability for the Business Continuity Plan. This will ensure that the BCP has an owner who is dedicated to managing its creation and implementation.
Key Takeaway: By assigning accountability early (in the Readiness step), senior management can ensure that the project of creating and maintaining a Business Continuity Plan will be likely to succeed.

Question 8

What is a secondary risk?

Accepted Answer

Secondary risk is a new risk caused by the response to another risk. For instance, ejecting your warp core to avoid a breach may leave you immobile and unable to escape attack. Or for a more realistic example, shifting employees to cover for sick ones may leave you stretched thin in other divisions.
Key Takeaway: Many firms try to avoid paying for protection against risks by believing they can shift resources in the short term. A thorough analysis of the impact of those actions must be conducted.

Question 9

Which term is used to describe the process of returning an organization to its normal state after a crisis?

Accepted Answer

The process of recovery will help the organization move past the crisis, while the process of resumption will return the organization to its normal pre-crisis state.
Key Takeaway: While it is usually ideal to return to the pre-crisis state, sometimes it is not possible. At this point in the resumption process, it is necessary to declare a new normal state so that the organization can continue to move forward.

Question 10

An organization has identified that the recovery time objective (RTO) criteria as the most critical criteria for its risk management strategy. The company might consider investing in which of the following?

Accepted Answer

A hot site is a contracted commercial disaster recovery service that provides all of the equipment needed for an enterprise to continue operation, which includes office space, furniture, communications equipment and computers. The setup also has all of the working data necessary to continue operators.
Key takeaway: Having a hot site comes with a high financial cost, but in some cases is absolutely necessary. The BCP planner must determine whether it is worth the cost by consulting with stakeholders and performing an analysis.

Question 11

A mitigation plan for which of the following risks is not possible:

Accepted Answer

A mitigation plan for any of these events is possible. Whether the potential threat is great enough is at the discretion of the planner.
Key takeaway: A risk manager must use his or her best discretion. For instance, it may be that all the members of the board live locally and fly to a golf off-site at the end of every quarter on a small jet. The death of all board members is a possibility.

Question 12

Which of these terms describes the process of securing people in an area where the crisis has occurred?

Accepted Answer

Shelter in place is the process of setting up and securing people in a facility or area where a crisis has occurred. This is used primarily when the people cannot be safely transported to an alternative location due to safety reasons.
Key Takeaway: While not ideal, shelter in place can provide for the basic human needs during a crisis situation where people are unable to leave the crisis area. Plans should be made ahead of time and be incorporated into the Business Continuity Plan, to provide adequate resources should a crisis occur and shelter in place become necessary.

Question 13

Which of the following exercise types is the closest example to a case study?

Accepted Answer

Tabletop exercises are conducted often in case study format where a narrative explaining the situation is presented and the group discusses different possible responses to the situation.
Key Takeaway: Tabletop exercises are a lower stress environment for learning about the Business Continuity Plan and provides an opportunity to identify some of the inefficiencies and potential problems with the plan.

Question 14

Mr. Newbie receives a call from the local newspaper asking him details about a recent crisis that occurred at his organization, the Sugarfoot company. What should he do?

Accepted Answer

Mr. Newbie should immediately refer the media to the designated spokesperson for the crisis instead of attempting to answer their questions on his own.
Key Takeaway: Having a single point of contact with the media regarding a crisis event will help keep the correct information available to the media and present a united front from the organization. Additionally, it will prevent contradictory information from being unintentionally released to the press.

Question 15

Risk management should include legal risks as well as other types.

Accepted Answer

True. Risk management and the risk assessment process should look at all types of risks, including legal risks.
Key Takeaway: By considering all types of risks, including legal risks, the Risk Assessment can be a great source of information and is useful for building the basis of the Business Continuity Plan. If a risk is not identified in the Risk Assessment, then proper prevention and mitigation plans cannot be put in place.

Question 16

Strategic planning can help __________ the risks to the organization.

Accepted Answer

Strategic planning can help mitigate the risks to the organization.
Key Takeaway: With strategic planning, mitigation plans can be put into place that will reduce the impact of a potential crisis. Plans should be based on risks identified in the Risk Assessment prior to the strategic planning portion of the Business Continuity Plan.

Question 17

Human resources department is responsible for driving accountability for the Business Continuity Plan.

Accepted Answer

False. Accountability for the Business Continuity Plan should come directly from the organization's senior management and/or Board of Directors.
Key Takeaway: If the accountability and importance of the Business Continuity Plan are not driven from the top down, then the Business Continuity Plan is likely to fail. While Human Resources plays an important part in the creation and management of the Business Continuity Plan, the accountability for the work needs to come from the senior management and/or Board of Directors.

Question 18

Jerry was in the midst of assessing risk for his project at a well-known real estate firm, when the stock market collapsed that sent shockwaves through his company and his project. The market crashing can be classified as what type of risk:

Accepted Answer

Factors affecting the stock market would be considered external risk factors to this and most other companies.
Internal risk factors allude to those factors relating directly to the project within the company such as staffing, resources, etc. Technical risk factors refer to those having to do with technology. Since the stock market crashing was not foreseeable, this wouldn't be a possible answer.
Key Take Away: Because Project Managers cannot possible prepare for all unforeseen risks (just by virtue of their nature), it's imperative that they prepare for as many scenarios as possible to leave as little room as possible for procedural gaps.

Question 19

Julie has decided to gather opinions from a group of external consultants, via a short questionnaire, who are experienced with these types of projects within the publishing industry. She'll then show them an aggregated list of the whole group's answers, and ask them if they want to change theirs.
What best describes the technique Julie is utilizing to gather valuable information for her project?

Accepted Answer

The Delphi method leverages a panel of independent experts. These experts answer questionnaires anonymously, and then the answers are shared amongst the entire group. Once the experts have reviewed the opinions of others, there is another questionnaire that encourages them to change their answers that is based on having read the opinions of their peers. These experts should begin to converge on an answer that serves as a nice approximation.
Root cause analysis is a technique that looks at all factors closely to try to uncover the primary cause of an issue.
Proper interviewing involves questioning participants to get pertinent project information, while brainstorming is an off-the-cuff process that relies on people gathering together to throw out random ideas.
Key Takeaway: The Delphi technique is a very effective way to estimate an expert consensus. However, the Delphi technique tends to be time-consuming, so it is generally used for very important estimates on projects that tend to be larger in size.

Question 20

What is Pareto's Law?

Accepted Answer

Pareto's Law says that 80% of the effects come from 20% of the causes. Vilfredo Pareto, an Italian Economist, observed that twenty percent of the people owned eighty percent of the wealth. The poor were lucky then
today it's more like 10/85. Management thinker Joseph Juran (1904
2008!) was the one who actually came up with this concept as it applies to business and named it after Pareto.
We'll go through the other options since they're kind of fun to know:
B, "Work expands so as to fill the time available for its completion" is Parkinson's Law. That's another good one to know.
C. This is Murphy's Law. Sometimes it may seem like "Anything that can go wrong will", but it isn't necessarily a good philosophy to have!
D, "Never attribute to malice that which can be adequately explained by stupidity." This is Hanlon's Razor. It isn't in the project manager's handbook for good reason. It's easier to work with a team when you have a healthy respect for them. Nevertheless, you can keep this in the hip pocket for an opportune time.
Key Takeaway: This is a handy heuristic to help you focus your attention on the most important things a project entails, allowing him/her to manage key risks and satisfy the most important stakeholders. Other examples: 20% of your customers will cause 80% of you problems, 20% of items in inventory represent 80% in sales, and so on.
One application I'm sure you'll find interesting is that 80% of beer is drunk by 20% of consumers. That's why most beer commercials are concentrated on football and tawdry men's magazines. It just makes sense for those companies to focus on their heavy consumers.

Quiz 1: Certified Business Continuity Professional