ISO 22301
What is on the PECB ISO 22301 Lead Implementer exam?

The PECB ISO 22301 Lead Implementer exam is 80 multiple-choice questions in three hours, open book, with a 70% pass mark: 56 correct answers. Its weight sits in the middle of a business continuity management system's life. Planning and implementation carry 18 questions each, and the 40 questions tested at the evaluation level all come from implementing, monitoring and improving the system.
Every fact below comes from PECB's own documents: the ISO 22301 Lead Implementer Candidate Handbook, version 1.5, the course page and the List of PECB Exams, all read on 2 October 2026.
How is the ISO 22301 Lead Implementer exam structured?
PECB lists the English exam as three hours, multiple choice, open book, 80 questions. It is the last day of a five-day course. The four teaching days cover starting a business continuity management system (BCMS), the implementation plan, the implementation itself, and then performance evaluation, continual improvement and preparation for the certification audit. You can sit the exam online through the PECB Exams application, with an invigilator watching through your camera, or on paper through the partner that ran your course.
The paper mixes two kinds of question. Stand-alone questions test one idea on its own. Scenario-based questions come in sets of five, all about one short case. Every question has three options, one correct and two distractors, and every question is worth one point.
PECB Candidate Handbook, ISO 22301 Lead Implementer, v1.5
Which domains carry the most questions?
The handbook publishes the count for each of the seven competency domains, so you can plan from the real weights.
Comprehension, application, analysisEvaluation
| Domain | Questions | Share | Tests |
|---|---|---|---|
| 1. Fundamental principles and concepts of a BCMS | 8 | 10% | Comprehension |
| 2. BCMS requirements | 7 | 8.75% | Comprehension |
| 3. Planning a BCMS implementation based on ISO 22301 | 18 | 22.5% | Comprehension |
| 4. Implementing a BCMS based on ISO 22301 | 18 | 22.5% | Evaluation |
| 5. Monitoring and measurement of a BCMS | 12 | 15% | Evaluation |
| 6. Continual improvement of a BCMS | 10 | 12.5% | Evaluation |
| 7. Preparation for a BCMS certification audit | 7 | 8.75% | Comprehension |
| Total | 80 | 100% | 40 and 40 |
Want it on one page? Our free ISO 22301 Lead Implementer mind map gives the seven domains with a mnemonic, and the 10-question quiz checks your recall in five minutes.
The split at the bottom is even: 40 questions test comprehension, application and analysis, and 40 test evaluation, judging which option is right for the organization in front of you. Look at where the evaluation questions sit. Planning is tested at the comprehension level, so you need to know what a scope, a policy and a gap analysis are for. Implementation, monitoring and improvement are tested at the evaluation level, so you need to choose between plausible actions. That is a different shape from the ISO 42001 Lead Implementer exam, where planning is the heaviest evaluation domain.
PECB's course page names domain 2 "Initiation of a BCMS implementation" and domain 5 "Evaluation of the performance of a BCMS based on ISO 22301." The handbook, which publishes the counts, calls them "Business continuity management system (BCMS) requirements" and "Monitoring and measurement of a BCMS based on ISO 22301." We follow the handbook. If your course materials use the other names, the counts above still apply in the same order.
What does domain 4 actually test?
Domain 4 is the heaviest domain tested at the evaluation level, and its competencies in the handbook read like a business continuity program from the inside: plan and conduct a business impact analysis (BIA) and present its report; run a risk assessment; choose business continuity strategies and solutions; evaluate the business continuity capabilities of suppliers; write the business continuity plan and procedures; set up incident management; draft an emergency response program; develop a crisis management plan; and define, run and evaluate exercises and tests.
The BIA comes first in that list, and the rest depends on it. If you have never run one, practice on paper before the course. Our worksheet uses the time terms from NIST SP 800-34, the US federal contingency planning guide, which notes that the recovery time objective must normally be shorter than the maximum tolerable downtime.
Business impact analysis worksheet
Business impact analysis (BIA) worksheet
A blank worksheet for practicing a business impact analysis, the first competency in domain 4 of PECB's ISO 22301 Lead Implementer exam ("Ability to plan and conduct a business impact analysis (BIA)", Candidate Handbook, version 1.5, read on 2 October 2026). The columns are our suggestion. The time terms follow NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems; your course and ISO 22301 may name them differently, so use the names your course uses. This worksheet does not reproduce ISO 22301.
1. The activity
| Field | Your answer |
|---|---|
| Activity or process | |
| Owner | |
| What it delivers, and to whom | |
| When it matters most (month end, peak season, a deadline) |
2. Impact over time
Rate each impact if the activity stopped completely: 0 none, 1 minor, 2 significant, 3 severe. Write one line on why.
| Time since disruption | Financial | Customers | Legal or regulatory | Reputation | Staff and safety | Why |
|---|---|---|---|---|---|---|
| 4 hours | ||||||
| 1 day | ||||||
| 3 days | ||||||
| 1 week | ||||||
| 2 weeks | ||||||
| 1 month |
Change the time bands to suit the activity. A payments process may need minutes; a quarterly report may need weeks.
3. The three numbers
| Term (NIST SP 800-34) | What it means | Your figure |
|---|---|---|
| Maximum tolerable downtime (MTD) | The total time the business will accept the activity being disrupted, all impacts considered | |
| Recovery time objective (RTO) | The longest a resource can stay unavailable before the impact on the activity, and on the MTD, becomes unacceptable | |
| Recovery point objective (RPO) | The point in time before the disruption to which data can be recovered; it measures how much data loss the activity can tolerate |
Check: NIST notes that the RTO must normally be shorter than the MTD. If yours is not, the recovery plan cannot meet the business need.
4. What the activity depends on
| Dependency | Type (people, site, IT system, data, supplier, partner) | Workaround if it fails | Workaround lasts how long |
|---|---|---|---|
5. Minimum to keep going
| Field | Your answer |
|---|---|
| Lowest level of output the business could accept during a disruption | |
| Staff needed at that level | |
| Systems and data needed at that level | |
| Who must be told, and how fast (customers, regulators, partners) |
6. Sign-off
| Field | Your answer |
|---|---|
| Reviewed by the activity owner | |
| Date | |
| Next review |
Credential Press is independent of PECB and ISO. This worksheet is a study aid, not a substitute for your organization's BIA method.
What does a 70% pass mark mean in practice?
70% of 80 one-point questions is 56. You can get 24 wrong and still pass, so a scenario set that goes badly costs at most five and does not decide the result.
180 minutes over 80 questions averages 2 minutes 15 seconds each, and scenario sets eat into that because you read the case before you answer anything. If English is not your first language, ask on the day: PECB allows 30 extra minutes on Lead exams.
What can you take into the exam?
PECB allows three things: a hard copy of the ISO 22301 standard, your training course materials, and the personal notes you took during the course, in the PECB Exams app or printed. Online, phones, tablets and any second device are banned; on paper, you get the paper and a pen. Bring a national ID card, driver's license or passport, and be there 30 minutes early, because late arrivals get no extra time.
PECB Candidate Handbook, ISO 22301 Lead Implementer, v1.5
Domain 2 covers the requirements in clauses 4 to 10, and the standard is on your desk, so tab those clauses and practice finding them. Our guide to PECB's open-book exam rules shows how to tab the standard and your course notes.
PECB ISO 22301 Lead Implementer exam-day checklist
PECB ISO 22301 Lead Implementer: exam-day checklist
Rules come from PECB's ISO 22301 Lead Implementer Candidate Handbook, version 1.5 (2026), read on 2 October 2026. Suggestions are marked as ours. Check PECB's Exam Rules and Policies page before your exam in case anything has changed.
The week before
- Book the exam: online through the PECB Exams application, or on paper through the PECB partner that ran your course (PECB rule)
- Need special arrangements (dyslexia, ADHD, vision impairment, pregnancy, recent surgery)? Apply through the myPECB dashboard before the day (PECB rule)
- Print or download your course materials and notes so you can reach them quickly in the exam
- Tab your hard copy of ISO 22301 by clause, 4 to 10 (our suggestion)
What you may use in the exam (open book)
- A hard copy of the ISO 22301 standard
- Your training course materials, through the PECB Exams app or printed
- Any personal notes you took during the training course, through the app or printed
On the day
- Be there, or logged in, at least 30 minutes before the start. Late arrivals get no extra time and may not be allowed to sit (PECB rule)
- Bring a valid ID: national ID card, driver's license or passport (PECB rule)
- Online: no phones, tablets or other second devices; a PECB invigilator watches through your camera (PECB rule)
- Paper: only the exam paper and a pen; no electronic devices (PECB rule)
- Sitting in a language that is not your first? Ask on the day for 30 extra minutes, which PECB allows on Lead exams (PECB rule)
Pace
| What | Figure |
|---|---|
| Questions | 80, multiple choice, three options each |
| Time | 3 hours (180 minutes) |
| Average per question | 2 minutes 15 seconds |
| Pass mark | 70%, which is 56 correct answers |
| Scenario sets | one scenario, five questions |
| Heaviest domains | Planning and implementing a BCMS, 18 questions each |
After
- Online exam: your result arrives straight away. Paper multiple choice: two to four weeks (PECB)
- If you do not pass, the email lists the domains where you scored poorly (PECB)
- Disagree with the result? Ask for a re-evaluation within 30 days of receiving it (PECB)
Where does the law come into a business continuity exam?
In domain 1. Its first knowledge statement is the business continuity "laws, regulations, international and industry standards, contracts, market practices, internal policies, etc., an organization must comply with." The handbook names no particular law. It asks you to know the kinds of obligation a BCMS has to answer to.
A UK example shows the kind of duty it means. Section 2 of the Civil Contingencies Act 2004 requires the bodies it lists to maintain plans so that "if an emergency occurs the person or body is able to continue to perform his or its functions." The government's Emergency Preparedness guidance gives business continuity management a chapter of its own. Certification belongs to organizations: the University of Surrey announced in 2018 that it had been certified to ISO 22301 for all areas of service provision. A Lead Implementer credential certifies you, the person who can build such a system.
How should you split your revision?
Start from the weights. Planning (18) and implementation (18) are 36 questions, 45% of the paper. Give planning the hours its count earns, and spend them on knowing each planning output and why it comes in that order: the context, the scope, top management's role, the policy, objectives, resources, competence, the communication plan, documented information and the gap analysis. Give implementation the same hours, spent mostly on practice questions, because it is tested at the evaluation level.
Monitoring and measurement (12) and continual improvement (10) are the other two evaluation domains: 22 questions on internal audit, nonconformities, management review, root causes and corrective action. Domain 1 (8), domain 2 (7) and audit preparation (7) close the paper. For audit preparation, know the difference between stage 1 and stage 2 audits, surveillance and recertification, and a certification recommendation and the certification decision.
Our ISO 22301 study plan turns those counts into hours. The ISO 22301 exam study guide maps every chapter to one of the same seven domains and is written for the 80-question multiple-choice format. For practice, the 212 ISO 22301 practice questions come with full rationales, weighted to the published counts.
What happens after you pass?
The exam opens the door; your experience decides which credential you get. PECB issues four implementer credentials from the same exam:
| Credential | Professional experience | BCMS project activities |
|---|---|---|
| Provisional Implementer | None | None |
| Implementer | 2 years, 1 in business continuity management | 200 hours |
| Lead Implementer | 5 years, 2 in business continuity management | 300 hours |
| Senior Lead Implementer | 10 years, 7 in business continuity management | 1,000 hours |
Each one also requires you to sign the PECB Code of Ethics. PECB's course page gives examples of the project activities that count: drafting a BCMS plan, initiating, implementing, monitoring and managing a BCMS implementation, and continually improving a BCMS.
What if you do not pass?
Online, the result is instant; on paper it takes two to four weeks. If you fail, the email names the domains where you scored poorly, and you can ask for a re-evaluation within 30 days. There is no limit on retakes, though PECB sets minimum gaps between attempts, and the course page says candidates who completed the course but failed can retake once for free within 12 months of the first attempt. Our guide to PECB results and retakes has the detail.
What should you do this week?
Print the checklist, work one BIA on the worksheet, and sit one timed set of questions before day five so the pace is not a surprise. Credential Press is independent of PECB and ISO. Nothing here comes from inside the exam, and PECB's handbook is clear that disclosing exam content breaks its Code of Ethics.
Frequently asked questions
How many questions are on the PECB ISO 22301 Lead Implementer exam?
80 multiple-choice questions in three hours. Each question has three options and one correct answer, and some come in sets of five that share a scenario.
What is the pass mark for the ISO 22301 Lead Implementer exam?
70%. Each question is worth one point, so you need 56 of the 80 right and can miss 24.
Is the PECB ISO 22301 exam open book?
Yes. PECB allows a hard copy of the ISO 22301 standard, your training course materials and the notes you took during the course, either in the PECB Exams app or printed.
Which domains carry the most questions?
Planning a BCMS implementation and implementing a BCMS, with 18 questions each. Together they are 36 of the 80, 45% of the paper. Implementation is tested at the evaluation level; planning is not.
Do I need business continuity experience to sit the exam?
No. PECB's Provisional Implementer credential needs the exam and no experience. The Lead Implementer credential needs five years of professional experience, two of them in business continuity management, and 300 hours of BCMS project activities.
What happens if I fail?
The results email lists the domains where you scored poorly, and you can ask for a re-evaluation within 30 days. PECB's course page says candidates who completed the course but failed can retake once for free within 12 months of the first attempt.
ISO 22301 Lead Implementer: test yourself in five minutes
Which books prepare you for this exam?

ISO 22301 Lead Implementer Exam Guide
A study companion for the PECB Certified ISO 22301 Lead Implementer examination. 13 chapters, 345 pages.

ISO 22301 Lead Implementer Practice Questions
Practice questions with full rationales, weighted to the published domains. 228 pages.
Sources
Every figure above was read from the document itself on 2 October 2026.
- PECB, ISO 22301 Lead Implementer Candidate Handbook, version 1.5, 2026
- PECB, ISO 22301 Lead Implementer course, agenda and credential requirements
- PECB Help Center, List of PECB Exams
- NIST, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
- Civil Contingencies Act 2004, legislation.gov.uk
- GOV.UK, Emergency Preparedness, chapter 6: business continuity management
Credential Press is not affiliated with, endorsed by or authorized by PECB or ISO. Exam names and trademarks belong to their owners.