Free readiness test
ISO 22301:2019 Lead Auditor: 40 free scenario questions
Audit business continuity management systems — BIA, strategies, plans and the exercise programme.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
A pharmaceutical distributor seeks ISO 22301 certification for a scope described as 'business continuity for the Mumbai headquarters'. During stage 1 you learn that the company's critical activity — delivering temperature-controlled vaccines to 4,000 hospitals — depends on two regional warehouses in flood-prone cities, a single cold-chain monitoring vendor, a cloud-hosted order system and a fleet of contracted trucks. None of these is in scope. The context document states that climate change is 'not relevant', although one warehouse lost power for 36 hours during last year's monsoon and vaccines worth ₹4 crore were destroyed. The government health ministry's tender, which the company is bidding for, requires 'ISO 22301 certification covering vaccine distribution'. The CEO argues that headquarters 'controls everything', so a narrow scope is sufficient.
What should the lead auditor conclude at stage 1?
- AThe scope is acceptable because headquarters sets policy for the whole company.
- BCertification should be refused because the warehouses are in flood-prone areas.
- CThe auditor should expand the scope to include the warehouses before stage 2.
- DScope and context omit critical activities; resolve before stage 2.