PECB ISO 22301 Foundation Practice Tests

Explanation

The risk assessment process consists of three stages: risk identification, risk analysis, and risk evaluation. After analyzing risks, the organization must evaluate them against risk criteria to prioritize them for treatment. Risk treatment, avoidance, and acceptance are subsequent steps in the risk management process, not part of the assessment phase itself.

Explanation

A disaster is defined as a situation where widespread human, material, economic, or environmental loss exceeds the organization's ability to recover with its own resources. An incident is an event that might lead to disruption, an emergency requires immediate action, and a crisis threatens objectives but does not necessarily exceed recovery capacity.

Explanation

Residual Risk is the amount of risk remaining after risk treatment is completed. Inherent Risk is the risk before controls are applied. Acceptable Risk is a subjective judgment of whether the residual risk is tolerable, and Secondary Risk is a new risk arising from the treatment itself, not the leftover original risk.

Explanation

After internal preparation, the first external step is the Stage 1 Audit, which reviews documentation and design conformity. The Stage 2 Audit follows to check implementation. Surveillance and Recertification audits only occur after the organization has already been certified.

Explanation

The Stage 2 Audit evaluates the implementation and effectiveness of the BCMS, checking if the system is actually working in practice. The Stage 1 Audit primarily reviews documentation and design conformity to determine readiness for Stage 2. Surveillance Audits occur periodically after certification to maintain status, and Recertification Audits happen before certificate expiration to renew the certification.