# ISO 22301 Lead Implementer interview scorecard

Candidate: ______  Interviewer: ______  Date: ______

| # | Question | Listen for | Score 1 to 4 |
|---|---|---|---|
| 1 | What is a BCMS, and how is it different from a business continuity plan? | A managed system of policy, roles, analysis, plans, exercises and review that improves over time. The plan is one output of it. | |
| 2 | What does ISO 22301 ask for that a disaster recovery plan alone does not? | Context and leadership, a business impact analysis and risk assessment, exercising, performance evaluation and improvement. | |
| 3 | How would you set the scope of our BCMS? | Products and services, interested parties including regulators, legal duties, sites and suppliers, and what is out and why. | |
| 4 | Walk me through a business impact analysis. | Prioritized activities, impacts over time, recovery time frames, and the resources and dependencies each activity needs. | |
| 5 | How do you choose continuity strategies? | Options for people, sites, technology, information and suppliers, weighed on cost against recovery time, then signed off. | |
| 6 | How do you know the plans will work? | An exercise program with realistic scenarios, measures, an internal audit and a management review. | |
| 7 | An exercise goes badly. What happens next? | Record the findings, find root causes, take corrective action, update the plans and exercise again. | |
| 8 | How would you prepare us for certification? | Documented BCMS for stage 1; evidence it runs, including exercise records, for stage 2; an internal audit and management review done first. | |

Source: https://credentialpress.com/guides/iso-22301-lead-implementer-interview-questions