- What This Cheat Sheet Covers
- The Exam at a Glance
- Fees and Registration Mechanics
- The Two Gates: Exam vs. Certification Application
- The Eleven ISO 22301 Audit Topics
- The Auditor Mindset the Questions Reward
- What Is Not Publicly Known
- Renewal and Maintenance
- A Compact Topic-Ordered Review Plan
- Frequently Asked Questions
- The exam is 100 multiple-choice questions in 2 hours 30 minutes, with a required individual score of at least 75%.
- Passing the exam does not confer certification; DRI also reviews an experience-based application with five essays.
- The published course-and-exam price is $2,950, plus a $400 application, for a $3,350 subtotal before renewal.
- No official weighted domain blueprint or pass rate is public, so treat the eleven course topics as preparation themes.
What This Cheat Sheet Covers
This page is a one-page-style review of the facts that matter for the Certified Business Continuity Auditor (CBCA), the audit credential governed by DRI International (Disaster Recovery Institute International). It is written for candidates preparing for the DRI Audit Examination on the ISO 22301 route, and it deliberately separates what DRI publishes from what candidates often assume.
If you are brand new to the credential, start with What Is CBCA Certification? for the big picture, then return here for the compressed facts. When you are ready to build a full plan, the CBCA Study Guide expands on everything below.
The Exam at a Glance
| Item | What DRI Publishes |
|---|---|
| Governing body | DRI International |
| Exam | Audit Examination (ISO 22301 route covered in this sheet) |
| Questions | 100 multiple-choice |
| Time | 2 hours 30 minutes |
| Required score | At least 75% (individual score, not a pass rate) |
| Delivery | Online, through the DRI account/examination process after course registration |
| Prerequisite | Completion of the Business Continuity Planning for Auditors (BCLE AUD) course |
| Standard referenced | ISO 22301:2019 (ISO route) |
A few format points deserve emphasis. The exam is multiple choice only. The course itself includes a hypothetical-company case study and practical auditing activities, but those classroom exercises are not a performance-based or essay examination. The five subject-matter essays belong to the certification application, which is a separate step covered below.
For a deeper look at the score threshold, see CBCA Passing Score, and for a realistic view of effort, How Hard Is the CBCA Exam?
Fees and Registration Mechanics
The CBCA is a course-gated credential, so the money works differently from a standalone exam. DRI publishes a US course-and-exam price of $2,950 for either the BCLE AUD (ISO 22301) or BCLE AUD (NFPA 1600) course, and the first exam attempt is included in that price. It is not an extra $750.
| Fee | Amount | Notes |
|---|---|---|
| Course plus first exam | $2,950 | ISO 22301 or NFPA 1600 route; exam included |
| Certification application | $400 | Separate from the course |
| Published subtotal | $3,350 | Calculated from the two fees above |
| Annual renewal | $225 | Ongoing maintenance |
| Audit-exam retake | $250 | If the first attempt is not passed |
That $3,350 figure is a published-fee subtotal only; it excludes renewal, travel, taxes, and any discounts. DRI's Continuity Audit FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a discounted checkout total, so confirm eligibility and the final amount with DRI before budgeting. No separate member versus nonmember exam-only price is published for this mandatory-course route. The full picture is in CBCA Certification Cost.
The Two Gates: Exam vs. Certification Application
The single most common misunderstanding is treating the exam as the whole credential. Passing the course examination alone does not confer professional certification. DRI also reviews an experience-based application. Think of two gates:
Gate 1: Course and Audit Examination
- Complete the BCLE AUD course (current US courses run four full instructional days and award 32 Continuing Education Activity Points, or CEAPs).
- The course may be taken without any previous DRI certification.
- Sit the 100-question exam and score at least 75%.
Gate 2: Certification Application
- At least two years of significant practical experience in business continuity, emergency/disaster management, and/or audit within the preceding ten years.
- Five subject-matter essays, with at least two drawn from DRI's specified application areas covering business impact analysis, continuity strategies, plan development/implementation, and exercise/test/assessment/maintenance.
- Two validating references per subject area; they can potentially be the same two people across all five areas.
- Certain existing professional designations can waive reference or experience sections, but this is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement.
No degree requirement and no fixed experience-hour threshold were found. For a complete walk-through, read CBCA Requirements.
Key Takeaway
Start gathering essay material and reference contacts while you are still in the course. The application is evaluated on experience, so your exam score cannot compensate for a thin or poorly documented work history.
The Eleven ISO 22301 Audit Topics
DRI does not publish a weighted exam blueprint, so the official domain count, percentages, and largest domain are not verified. What can be said is that the current ISO 22301 audit-course outline contains eleven substantive topics, and they are the sensible spine for preparation. Treat them as issuer-course preparation topics, not an official or exhaustive list of tested content. The course outline's Introduction, Exam preparation, and examination-event items are excluded. Any allocation of practice time across them is editorial judgment on our part, not exam weighting. For a topic-by-topic expansion, see CBCA Exam Domains: Complete Guide to All 11 Content Areas.
1. Auditing basics
The foundation: what an audit is, how an auditor behaves, and how evidence supports a conclusion.
- Know the difference between evidence, observation, and opinion.
- Understand independence, objectivity, and professional conduct expectations.
- Be able to distinguish an audit from a consultation or a review.
2. Understanding ISO 22301
The standard itself. The current course page uses the heading "Understanding ISO 22301," while the linked brochure says "Introduction to ISO22301"; this is a spelling difference, not an extra topic.
- Know the purpose and structure of a business continuity management system (BCMS) under ISO 22301:2019.
- Be comfortable with the standard's vocabulary, since audit questions hinge on precise terms.
3. Context of the organization
How an organization's internal and external circumstances shape its BCMS.
- Understand interested parties and their requirements.
- Know how scope of the management system is defined and justified.
4. Leadership, planning, support, and operation
The management-system clauses an auditor tests for conformity.
- Leadership commitment and policy.
- Planning, objectives, resources, competence, awareness, and documented information.
- Operational planning and control of the continuity arrangements.
5. Risk assessment
How the organization identifies and evaluates threats to prioritized activities, and how an auditor verifies the method is sound and applied consistently.
6. Business impact analysis (BIA)
How impacts of disruption are analyzed to prioritize activities and set recovery requirements.
- Audit questions often probe whether BIA outputs actually drive later decisions.
- Look for traceability from BIA results to strategies and plans.
7. Continuity strategies and solutions
Whether chosen strategies are justified by the BIA and risk work and are resourced.
8. Business continuity plans
Plan content, invocation, roles, and whether the documents are usable by the people who must execute them.
9. Education and training
Competence and awareness: evidence that people know their continuity roles.
10. Exercise program
Whether exercises are planned, scoped, performed, and followed up, and whether lessons learned lead to corrective action.
11. Audit findings, recommendations, and auditor's opinion
How findings are classified, written, and supported by evidence, and how an auditor forms and communicates an opinion.
- Know what makes a finding defensible versus a loose observation.
- Understand how recommendations differ from findings.
The Auditor Mindset the Questions Reward
Because the exam is multiple choice and the credential is about auditing, many questions are best answered by asking what a competent auditor would do or conclude, not what a continuity manager would build. Keep these lenses in mind:
- Evidence first. A claim without objective evidence is not a conformity. When two answer options differ, prefer the one grounded in verifiable evidence.
- Traceability. A recurring audit theme is the chain from context, to risk and BIA, to strategy, to plans, to training, to exercises, to improvement. Gaps in the chain are findings.
- Independence and objectivity. The auditor reports what is found, not what is hoped for.
- Standard-specific language. ISO 22301:2019 wording matters. Know the terms rather than relying on everyday synonyms.
What Is Not Publicly Known
A trustworthy cheat sheet states its gaps. In the official certification, specialty-exam, course, and FAQ materials reviewed, the following are not publicly specified:
- Pass rate. DRI does not disclose one. Marketing claims about general business-continuity pass rates are not CBCA cohort statistics, so be skeptical of any specific figure. See CBCA Pass Rate for what can and cannot be said.
- Weighted domain breakdown. No official percentages are published, and a newer weighted blueprint was not found.
- Scored versus unscored questions. No breakdown is specified.
- Exam rules. Open-book or closed-book status, calculator permission, detailed remote-proctoring rules, adaptive delivery, and any permitted-reference list could not be verified publicly. Do not assume rules from other exams; confirm them in your DRI account before test day.
- Proctoring vendor. DRI administers the exam through its own online process; no external testing provider was verified.
- Accommodations timing. An ADA-version listing for the ISO audit exam exists, but the public listing does not establish a different time allowance.
Renewal and Maintenance
Do not describe the CBCA as an unconditional two-year credential. There are two distinct clocks:
- Annual financial maintenance: a $225 annual fee.
- Two-year continuing-education cycle: 80 CEAPs over each two-year period.
- Ethics: compliance with DRI's code of ethics throughout.
The 32 CEAPs awarded by the course itself are a useful early contribution, but confirm with DRI how they are credited to your cycle. For the career side of the equation, including whether the ongoing cost pays off, read Is the CBCA Certification Worth It?, and for compensation context without invented figures, the CBCA Salary Guide.
A Compact Topic-Ordered Review Plan
Because the exam follows a course, most candidates will already have covered the material once. A short, topic-ordered review keeps the standard's logic fresh. The sequence below follows the chain of traceability rather than the order of any official weighting, which does not exist publicly.
Foundations
- Auditing basics and Understanding ISO 22301: lock in vocabulary first, since later topics depend on it.
- Context of the organization: practice defining scope and interested parties.
The analytical core
- Leadership, planning, support, and operation; then Risk assessment and Business impact analysis.
- Practice tracing a BIA result forward into a strategy decision, since this link is a classic audit checkpoint.
Execution and proof
- Continuity strategies and solutions, Business continuity plans, Education and training, Exercise program.
- For each, list what evidence an auditor would request.
Reporting and rehearsal
- Audit findings, recommendations, and auditor's opinion: write sample findings and judge which are defensible.
- Take timed practice sets sized to the real exam: 100 questions in 150 minutes, roughly 90 seconds per question.
Run timed sets on our CBCA practice test site and review every miss by asking which clause or audit principle you misapplied. For a fuller schedule, see the CBCA Study Guide.
Frequently Asked Questions
The DRI Audit Examination has 100 multiple-choice questions and a 2 hour 30 minute time limit. DRI's reviewed public materials do not specify a scored versus unscored split.
You need at least 75%. That is the required individual examination score, not a statistic about how many candidates pass. DRI does not publicly disclose a pass rate.
No. Passing the course examination alone does not confer certification. You must also submit an application showing at least two years of relevant experience within the preceding ten years, five subject-matter essays, and validating references, which DRI reviews.
The published course-and-exam price is $2,950 and the certification application is $400, giving a $3,350 subtotal before renewal ($225 annually), travel, taxes, or discounts. A retake of the audit exam is $250. Confirm any discount eligibility directly with DRI.
No. Completing the Business Continuity Planning for Auditors (BCLE AUD) route is required before the Audit Examination. The course can be taken without any prior DRI certification.