- What the CBCA Credential Actually Is
- Two Gates: The Course Exam and the Professional Application
- Exam Format at a Glance
- The Published Cost Math
- What You Need to Master for the ISO 22301 Audit Exam
- Allocating Your Practice Questions
- Sequencing the Eleven Topics Across Your Prep
- Keeping the Credential Active
- Who Benefits From This Credential
- What Is Not Publicly Confirmed
- Frequently Asked Questions
- CBCA stands for Certified Business Continuity Auditor, issued by DRI International, not by any other body sharing the acronym.
- Passing the 100-question, 2 hour 30 minute exam at 75% or higher does not by itself confer the certification.
- The published training-plus-application subtotal is $3,350: $2,950 for the course and first exam, plus a $400 application.
- Certification also requires two years of relevant experience, five essays, and two validating references per subject area.
What the CBCA Credential Actually Is
CBCA is the designation for the Certified Business Continuity Auditor, awarded by DRI International (Disaster Recovery Institute International). It is aimed at professionals who evaluate whether an organization's business continuity management system is sound, documented, and actually working, rather than at those who build continuity programs from scratch. If you are still orienting yourself, our explainers What Is CBCA Certification? and What Does CBCA Stand For? cover the basics in more depth.
A word of caution for anyone researching online: several unrelated credentials share the "CBCA" abbreviation. Everything on this page concerns only the DRI auditor credential. Fees, exam length, and requirements from similarly abbreviated finance or other programs do not apply here, so double-check the issuing body on any source you rely on.
Two Gates: The Course Exam and the Professional Application
The most common misunderstanding about this credential is treating the exam as the finish line. It is only one of two gates.
Gate one: course and Audit Examination
Before you can sit the Audit Examination, you complete the Business Continuity Planning for Auditors course (listed as BCLE AUD). DRI offers an ISO 22301 version and an NFPA 1600 version. Current US courses run four full instructional days and award 32 Continuing Education Activity Points (CEAPs). You do not need a prior DRI certification to take the course. The course includes a hypothetical-company case study and practical auditing activities, but those are classroom exercises, not a separate performance-based exam.
Gate two: the professional certification application
Passing the exam alone does not confer professional certification. DRI separately reviews an experience-based application, which requires:
- At least two years of significant practical experience in business continuity, emergency/disaster management, and/or audit within the preceding ten years
- Five subject-matter essays, at least two of which must come from DRI's specified application areas (business impact analysis, continuity strategies, plan development/implementation, and exercise/test/assessment/maintenance)
- Two validating references per subject area, which may be the same two people across all five areas
Certain existing professional designations can qualify for waivers of the reference or experience sections, but this is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement. No degree requirement and no fixed experience-hour threshold was found. For a fuller walkthrough, see CBCA Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Exam Format at a Glance
| Element | What DRI Publishes |
|---|---|
| Exam target for this guide | DRI Audit Examination, ISO 22301 route |
| Questions | 100 multiple choice |
| Time allowed | 2 hours 30 minutes |
| Passing score | At least 75% (an individual score requirement, not a pass rate) |
| Delivery | Online through your DRI account after course registration |
| Testing provider | DRI's own online examination process; no external proctoring vendor verified |
| Retake fee | $250 |
| Scored vs. unscored breakdown | Not publicly specified |
| Official domain weightings | Not publicly verified |
The exam is designed to be taken after the course, and current course descriptions say it is online at your convenience. An older general FAQ sentence still refers to the final course day, so follow the booking instructions attached to your specific course registration. See CBCA Exam Dates 2026 for scheduling context and CBCA Passing Score 2026 for more on the 75% threshold.
Be careful with exam-day assumptions. Open-book versus closed-book status, calculator permissions, remote-proctoring rules, and any permitted reference list could not be verified from public sources. Confirm those details in your DRI account before test day rather than assuming they match another exam you have taken.
The Published Cost Math
DRI's published US pricing is straightforward, but easy to misread. The course-and-exam price is $2,950 for either the ISO 22301 or NFPA 1600 audit course, and the first exam attempt is already included. It is not an extra $750 on top.
| Item | Published Amount |
|---|---|
| Course plus first exam (BCLE AUD, ISO 22301 or NFPA 1600) | $2,950 |
| Certification application | $400 |
| Training-plus-application subtotal | $3,350 |
| Audit exam retake | $250 |
| Annual renewal | $225 |
That $3,350 subtotal is calculated from the two published fees and excludes renewal, travel, taxes, and any discounts. DRI's Continuity Audit FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a discounted checkout total, so treat eligibility and the final amount as something to confirm with DRI. No separate member or nonmember exam-only price is published for this mandatory-course route. For a deeper breakdown, read CBCA Certification Cost 2026.
What You Need to Master for the ISO 22301 Audit Exam
DRI does not publish a weighted exam blueprint for this audit exam. The study framework below is built from eleven substantive headings in DRI's current ISO 22301 audit-course outline. Treat them as preparation topics drawn from the course, not as an official, weighted, or exhaustive list of exam content. The wider context is covered in CBCA Exam Domains 2026: Complete Guide to All 11 Content Areas.
Auditing Basics
The foundation: how an audit is planned, conducted, and reported, and what separates a finding from an observation.
- Audit objectives, scope, and criteria
- Evidence gathering and how to judge its sufficiency
- The auditor's independence and professional conduct
Understanding ISO 22301
You cannot audit against a standard you cannot read. The course heading says "Understanding ISO 22301," while the linked brochure says "Introduction to ISO22301"; this is a spelling difference, not a second topic.
- The structure and intent of ISO 22301:2019, the version the current course references
- The difference between mandatory "shall" requirements and guidance
- How the standard frames a business continuity management system
Context of the Organization
How an organization's environment, stakeholders, and obligations shape the scope of its continuity program.
- Internal and external issues affecting the management system
- Interested parties and their requirements
- Defining and justifying the management-system scope
Leadership, Planning, Support, and Operation
These clauses are where audits often find gaps, because they test whether management commitment is real rather than documented in name only.
- Top-management commitment, policy, and assigned roles
- Objectives and planning to achieve them
- Resources, competence, awareness, and controlled documented information
- Operational planning and control
Risk Assessment
How threats to prioritized activities are identified, analyzed, and treated, and how an auditor verifies that the process is repeatable.
- Risk identification, analysis, and evaluation
- Linking risk treatment to continuity decisions
- Evidence that the process is reviewed and updated
Business Impact Analysis (BIA)
The BIA drives almost everything downstream, so an auditor must be able to test its logic.
- Identifying activities and assessing impacts over time
- Recovery time objectives and minimum service levels
- Dependencies on people, technology, suppliers, and facilities
Continuity Strategies and Solutions
Whether the chosen strategies are justified by the BIA and risk assessment, and whether the needed resources are actually available.
- Selecting strategies that meet recovery objectives
- Resource requirements: people, sites, technology, information, suppliers
- Traceability from analysis to chosen solution
Business Continuity Plans
Auditing a plan means checking that it is usable by someone under pressure, not just that it exists.
- Activation criteria, roles, and communication procedures
- Recovery procedures tied back to the BIA targets
- Document control and currency
Education and Training
Evidence that people know their roles before an incident, not after.
- Competence and awareness programs
- Records showing who was trained and when
- Whether training matches the roles in the plans
Exercise Program
Whether exercises are planned, varied, evaluated, and acted upon.
- Exercise objectives, scenarios, and schedules
- Post-exercise reviews and tracked corrective actions
- Evidence that lessons feed back into plans and strategies
Audit Findings, Recommendations, and Auditor's Opinion
The point where the audit becomes a deliverable. Expect to distinguish well-supported findings from weak ones.
- Writing findings that tie evidence to a specific criterion
- Framing recommendations that address root cause
- Forming and communicating the overall auditor's opinion
Allocating Your Practice Questions
Because no official weighting is published, any split is editorial judgment rather than DRI guidance. A reasonable approach is to give extra practice volume to the topics that cascade into others (BIA, risk assessment, strategies, and the clauses covering leadership through operation) and to the final topic on findings and opinions, since it demands judgment rather than recall. Spread the remaining practice evenly across the other topics. Revisit your allocation after a diagnostic: if you consistently miss questions in one area, shift volume there regardless of where you started.
Write your own practice questions or use independently produced ones. DRI course and exam materials are confidential, so avoid sharing or reproducing them. For difficulty context, see How Hard Is the CBCA Exam?, and note that DRI does not disclose a pass rate; the data situation is explained in CBCA Pass Rate 2026. When you want timed, scenario-style repetition, the CBCA practice test site is built for exactly that.
Sequencing the Eleven Topics Across Your Prep
This is the one place for scheduling advice, and it is tied to how the standard builds on itself. Because the course precedes the exam, plan your review for the period right after the four instructional days, while the case study is fresh.
Foundations
- Auditing basics and Understanding ISO 22301
- Read the standard's clause structure end to end
- Context of the organization
The analytical chain
- Leadership, planning, support, and operation
- Risk assessment, then BIA, in that order
- Trace how each output feeds the next
Solutions and readiness
- Continuity strategies and solutions
- Business continuity plans
- Education and training, then the exercise program
Judgment and timed practice
- Audit findings, recommendations, and auditor's opinion
- Full 100-question timed sets against the 2 hours 30 minutes limit
- Review misses by topic and return to weak areas
A condensed version of this plan fits in the CBCA Study Guide 2026, and the CBCA Cheat Sheet works well as a final-day review of key facts.
Keeping the Credential Active
Earning CBCA is not a one-time event. Maintenance has two distinct components that people often blur together:
- Annual financial maintenance: $225 per year.
- Continuing education: 80 CEAPs over each two-year period, along with compliance with DRI's code of ethics.
Do not describe it as an unconditional two-year credential. The annual fee and the two-year CEAP cycle run side by side. The 32 CEAPs awarded by the course are a useful head start toward the first cycle.
Who Benefits From This Credential
The credential fits professionals whose work involves evaluating continuity programs: internal auditors, risk and compliance specialists, business continuity managers who review third parties or other business units, and consultants who assess conformity to ISO 22301. It also suits practitioners moving from planning roles into assurance work. If you are weighing it against your career goals, Is the CBCA Certification Worth It? and CBCA Jobs discuss the role landscape, and CBCA Salary Guide addresses compensation. No specific salary figure is published by DRI for this credential, so be skeptical of any source that quotes a precise number without citing a verifiable survey.
What Is Not Publicly Confirmed
A trustworthy prep plan separates what is known from what is not. As of the September 27, 2026 review of DRI's course, specialty-exam, and certification pages, the following are not publicly specified:
- Official weighted exam domains, their percentages, and the largest domain
- The scored versus unscored question breakdown
- A cohort pass rate (general business-continuity pass-rate claims from training marketers are not CBCA statistics)
- Open-book or closed-book status, calculator rules, and detailed remote-proctoring requirements
- Coverage of the separate NFPA 1600 route in this guide; the preparation topics above apply to the ISO 22301 route only
Also keep the exams distinct: the DRI general Qualifying Examination is a separate exam and should not be substituted for the Audit Examination. For the broad overview of the credential and its terminology, see What Is CBCA? and CBCA Training.
Key Takeaway
Plan for both gates from day one. Book the course, prepare for 100 multiple-choice questions against a 75% bar, and start drafting your five essays and lining up references in parallel so the application does not become the bottleneck after you pass.
Frequently Asked Questions
No. The exam is one requirement. DRI also reviews an experience-based application with two years of relevant experience, five subject-matter essays, and two validating references per subject area before the CBCA designation is conferred.
The Audit Examination has 100 multiple-choice questions and a 2 hour 30 minute time limit. You need at least 75% to pass. A scored versus unscored breakdown is not publicly specified.
The published US course-and-exam price is $2,950, with the first exam included, and the certification application is $400, for a $3,350 subtotal. Renewal is $225 per year and a retake is $250. Possible member discounts should be confirmed with DRI.
No. The course may be taken without a previous DRI certification. However, certification itself requires meeting the experience, essay, and reference requirements of the application.
DRI does not publicly disclose one. The 75% figure is the required individual score, not a statistic about how many candidates pass. Treat any quoted pass rate with caution unless it names a verifiable source.