The CBCI 7.0 course clarifies that strategies for resuming operations are developed primarily based on the analysis of the Maximum Tolerable Period of Disruption (MTPD) and the Recovery Time Objectives (RTO). The MTPD defines the maximum duration an activity can be disrupted before causing intolerable impact, while the RTO sets the target time to restore that activity. These recovery parameters provide clear, measurable goals for strategy development, ensuring continuity efforts focus on minimizing downtime and impact. Although stakeholder input and organizational culture influence strategy implementation, the technical parameters of MTPD and RTO form the foundational basis for solutions.

Plans at different levels (strategic, tactical, operational) typically share common foundational elements: a clear purpose and scope , key assumptions, and objectives (C), so users understand when and how to apply the plan. They also usually include escalation guidance (A) so issues are raised to the right level quickly, and stand-down/transition procedures (D) so teams can safely return to normal operations and capture learning after resolution. These elements support coordinated response across the response structure.

However, risk assessments for each possible scenario (B) would not be included “at all levels” of plans. Risk assessment is a distinct analysis activity, and while plans may reference key threats or assumptions, they are generally not built as scenario-by-scenario risk assessment catalogues—especially not across every plan level. The BCI distinguishes BIA (impact over time) and Risk Assessment (risks to prioritised activities) as analysis techniques; plans then enable execution of the chosen solutions and response arrangements.

So, risk assessments may inform plans, but they are not a universal content component at every plan level. Therefore B is correct.

Automation tools can significantly improve the efficiency of the BIA process: they help store results for reuse, standardize data capture, speed up consolidation, and generate reports quickly and consistently (supporting options A–C). However, they do not eliminate the need for direct engagement with the right people. In CBCI 7.0 / GPG-aligned practice, BIA quality depends on accurate understanding of products/services, activities, dependencies, minimum resources, and time-based impacts—information that typically resides with product owners, activity owners, and resource specialists. Tools can streamline collection and analysis, but they cannot replace the judgment, context, and validation that come from workshops, interviews, and stakeholder review. BCI commentary on using AI/automation for BCM highlights the efficiency gains while warning that human intelligence remains vital for interpreting data and designing effective continuity outcomes—supporting the conclusion that engagement is still required. Therefore, D is the option that is NOT a benefit.

CBCI 7.0 places strong emphasis on Embracing Business Continuity (PP2) , which is centred on education and awareness to improve BC culture and build voluntary commitment. PP2 explicitly focuses on understanding “the mindset of an organization” and its existing culture before attempting to influence it, because culture affects how people engage with BC activities and how sustainable the programme will be. An effective awareness strategy must therefore be tailored to organizational context: in a large organization, you may need multiple channels and segmented messaging; in a smaller organization, more direct engagement may work better. Likewise, if the culture is siloed, messages may need different champions than in a collegiate culture. Finally, people’s preferred information channels (briefings, intranet, video, manager cascades, social platforms, etc.) determine how awareness can realistically reach and influence the workforce. This is why these factors are most directly linked to developing an awareness strategy rather than to exercise planning, plan writing, or solution design.

Defining the initial scope of a BCMS requires a comprehensive understanding of organizational context, risks, and priorities. The CBCI 7.0 course recommends consulting with stakeholders , leveraging internal expertise (e.g., risk management, audit), performing cost-benefit analyses, and horizon scanning to capture potential future threats and opportunities. These methods ensure that the scope is appropriately focused and realistic, considering business objectives, resource availability, and external environment. This thorough approach lays the foundation for a relevant and effective BCMS.

Exercises focus on validating the practical elements of Business Continuity arrangements, including the availability of key information, usability of procedures, and reliability of systems and equipment under simulated conditions. The CBCI 7.0 course clearly distinguishes that the business impact analysis (BIA) process itself is a planning and analysis activity, not a response function, and therefore is not subject to validation through exercises. BIAs are validated through reviews and audits rather than operational testing. Exercises are designed to test response and recovery capabilities, communication flows, and system robustness in real-time or simulated disruptions. Validating the BIA design requires analytical review, stakeholder engagement, and continuous improvement processes, which occur separately from exercises. This differentiation ensures that exercises focus on operational readiness rather than procedural design.

In CBCI 7.0’s PP5 ( Enabling Solutions ), returning to BAU is treated as a managed transition from response/recovery arrangements back to normal operations. Good practice recognises that returning to the “original situation” may not be straightforward—sometimes the original state no longer exists (e.g., premises significantly damaged), so plans must be flexible and guide decisions rather than prescribe one rigid approach.

That is why statements A–C are consistent with good practice: a BAU return plan typically gives a general outline and prompts for how to transition, it demonstrates the organization understands the preparatory steps required (people, facilities, technology, suppliers, communications, handover/stand-down), and it should be maintained through review and exercised/trained so teams can execute it confidently.

Statement D is NOT correct because it implies one set of specific procedures applies in all situations. BC planning guidance emphasises that incidents differ and plans need to be adaptable; BAU transition is highly context-dependent (damage level, regulatory requirements, customer obligations, resource availability, safety constraints). A universal, “one-procedure-fits-all” approach is unlikely to remain valid across different disruptions and would reduce effectiveness.

The CBCI 7.0 course advises that before conducting a BIA, the Business Continuity professional should review organizational documents such as strategic plans, operational procedures, and risk registers to understand the context and determine appropriate parameters like impact categories and assessment criteria. This preparation ensures that the BIA is aligned with organizational objectives and risks, enhancing the accuracy and relevance of findings. While consulting personnel, considering recovery strategies, and communication procedures are important, these typically occur later in the BCMS lifecycle. Proper groundwork through document review is essential for a focused and effective BIA process.

In CBCI 7.0 / GPG 7.0, BIA is a core Analysis technique, but it is not “one size fits all.” The depth, method, and tooling used for BIA are determined primarily by the organization’s size, complexity, and type , because these factors dictate how products/services are delivered, how many activities and dependencies exist, how centralized or distributed operations are, and how much formalization is needed to produce consistent outputs. The BCI GPG Lite explicitly notes that implementation should suit “organizational size and complexity,” which directly applies to how BIA is performed (e.g., workshops vs. questionnaires, single-layer vs. multi-layer BIA, degree of consolidation, number of stakeholder groups involved). ( thebci.org )

Stakeholder consultation (A) provides valuable input but doesn’t “determine the way” BIA is used as strongly as organizational characteristics do. Exercise outcomes (C) inform validation and improvements, not the fundamental BIA approach. Risk management feedback (D) can help align approaches, but BIA design is primarily shaped by organizational structure and complexity. Therefore, B is correct.

Solutions Design (PP4) uses BC requirements from Analysis (PP3)—including RTOs and minimum acceptable capacity—to decide which strategies and solutions must be implemented first and where investment provides the most protection to priority delivery. An urgent/short RTO means the organization has very limited time before impacts become unacceptable; therefore, solutions supporting those activities typically require earlier funding and stronger capability (e.g., automation, replication, standby arrangements, pre-positioned resources). Prioritising spend against the most urgent RTOs is a direct, requirement-led approach and aligns investment to what the organization must recover fastest to survive disruption.

Option B is poor practice: not all strategies carry equal criticality—some protect essential delivery while others are “nice to have.” Option C can create inconsistent priorities across departments and undermine enterprise-wide optimization; owners contribute, but prioritisation must be governed centrally against agreed requirements. Option D focuses on cost rather than necessity; “cheap” solutions may fail to meet recovery requirements. Therefore, the correct approach is A : prioritize solutions for the shortest and most urgent RTOs.