- What the Acronym Stands For
- Who Issues the Credential
- Why Meaning Has Two Layers: Course Plus Application
- The Audit Examination at a Glance
- What the Title Means in Practice
- The ISO 22301 Audit Route and What It Covers
- What the Credential Costs
- Keeping the Designation Active
- Avoiding Acronym Confusion
- Turning the Meaning Into a Preparation Plan
- Frequently Asked Questions
- CBCA means Certified Business Continuity Auditor, a designation issued by DRI International (Disaster Recovery Institute International).
- Passing the 100-question audit exam alone does not confer certification; DRI also reviews an experience-based application.
- The audit exam requires a score of at least 75% and allows 2 hours 30 minutes.
- The published course-plus-application subtotal is $3,350: $2,950 for the course and first exam, plus a $400 application fee.
What the Acronym Stands For
CBCA stands for Certified Business Continuity Auditor. It is a professional designation for people who evaluate whether an organization's business continuity program is sound, documented, and capable of working when a disruption occurs. The word "Auditor" is the key to understanding the credential: a CBCA is not primarily a person who writes recovery plans or runs a crisis team. A CBCA is trained to examine those activities against a standard and report on what was found.
If you have arrived here after searching related phrases, the same definition applies to what CBCA stands for, what CBCA means, and what CBCA is. All of them point to the same credential described on this page. For a broader overview of the designation itself, see our CBCA certification primer.
Who Issues the Credential
The governing body is DRI International, formerly the Disaster Recovery Institute International. DRI is a nonprofit organization focused on business continuity education and certification, and the CBCA is one of its specialty designations. The official designation, Certified Business Continuity Auditor, is awarded by DRI rather than by a university, a software vendor, or a generic testing company.
DRI also administers the Audit Examination itself, through its own online examination and account process. We could not verify that a third-party proctoring provider such as Pearson VUE, PSI, or Prometric is currently used for this examination, so you should not assume that testing-center scheduling applies. Always follow the booking instructions attached to your specific DRI course registration.
Why Meaning Has Two Layers: Course Plus Application
Many candidates assume a certification is simply an exam. The CBCA is different, and understanding the difference is central to understanding what the title means. The designation is built from two linked stages:
- Course and examination. You complete the Business Continuity Planning for Auditors course (the BCLE AUD route) and then take the Audit Examination.
- Experience-based application. DRI reviews your professional background before the designation is granted.
The application requires at least two years of significant practical experience in business continuity, emergency or disaster management, and/or audit within the preceding ten years. You also submit five subject-matter essays, with at least two drawn from DRI's specified application areas covering business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment, and maintenance. Each subject area needs two validating references, and the same two people can serve across all five areas. Certain existing professional designations may qualify for reference or experience-section waivers, but these are not a blanket waiver of the audit course, the exam, or the CBCA experience requirement. No degree requirement and no fixed experience-hour threshold were found. Our CBCA requirements guide walks through eligibility in more detail.
The Audit Examination at a Glance
The examination that sits inside the CBCA pathway is the DRI Audit Examination. For the ISO route, the current specialty-exam catalogue labels it "2023 Audit Exam - ISO 22301." It is a separate exam from DRI's general qualifying examination, and the two should never be conflated.
| Feature | CBCA Audit Examination |
|---|---|
| Issuer / administrator | DRI International |
| Number of questions | 100 multiple-choice questions |
| Time allowed | 2 hours 30 minutes |
| Passing score | At least 75% |
| Delivery | Online, via the DRI account after course registration |
| Retake fee | $250 |
| Pass rate | Not publicly disclosed |
The format is multiple choice. The course includes a hypothetical-company case study and practical auditing activities, but those classroom exercises are not part of the exam and the exam is not a performance-based or essay test. The five essays belong to the certification application, not to the 100-question exam. A separate scored-versus-unscored question breakdown is not publicly specified in the official sources we reviewed.
Current course descriptions say the examination is taken online after the course, at the learner's convenience, although an older FAQ sentence still refers to the final course day. Use your course-specific booking instructions rather than that stale general line. We discuss scheduling mechanics in our CBCA exam dates guide, and the scoring threshold is covered in CBCA passing score.
What the Title Means in Practice
Reading the designation as a job description helps. A Certified Business Continuity Auditor is expected to take a continuity program and assess it the way a financial or quality auditor would assess their own subject: gather evidence, compare what exists against a requirement, identify gaps, and form a defensible opinion.
The eleven subject areas used to prepare for the ISO route reflect that arc, moving from audit fundamentals through the standard itself and the continuity lifecycle, and ending with the reporting step. The final topic, audit findings, recommendations, and the auditor's opinion, is where the "Auditor" part of the name becomes concrete. Candidates are being trained to produce a finding that a manager can act on, not merely to recite plan components.
Typical settings where this skill set applies include internal audit and risk functions, compliance teams, and consulting practices that assess clients' continuity programs. We cover the career side in our articles on CBCA jobs and the CBCA salary guide, and whether the investment pays off is examined in is the CBCA worth it.
The ISO 22301 Audit Route and What It Covers
DRI offers the audit course in two flavors: BCLE AUD (ISO 22301) and BCLE AUD (NFPA 1600). The ISO course references ISO 22301:2019, while the NFPA route references NFPA 1600, 2019 edition. This article and the preparation guidance on this site are built around the ISO 22301 route. Coverage of the NFPA 1600 route is not established here, so if you are enrolled in that version, confirm the course outline before relying on this material.
The following eleven topics are drawn from DRI's current ISO 22301 audit-course outline. They are issuer-course preparation topics, not an official weighted or exhaustive examination blueprint. DRI has not publicly verified an official weighted exam-domain list, so we do not assign percentages to any of them.
1. Auditing basics
The foundation: what an audit is, how auditors gather and weigh evidence, and the principles that make an audit credible and repeatable.
2. Understanding ISO 22301
The structure and intent of the standard against which the audit is conducted. The current course page uses the heading "Understanding ISO 22301"; the brochure's "Introduction to ISO22301" wording is a spelling difference, not an extra topic.
3. Context of the organization
How the organization's internal and external environment, interested parties, and scope shape its management system.
4. Leadership, planning, support, and operation
Management commitment, resourcing, and the operational controls that make a continuity program run day to day.
5. Risk assessment
How threats and vulnerabilities are identified and evaluated, and what evidence an auditor expects to see that this was done systematically.
6. Business impact analysis (BIA)
How disruption impacts and priorities are established, and how an auditor tests whether the analysis supports downstream decisions.
7. Continuity strategies and solutions
Whether chosen strategies are justified by the analysis and sufficient to meet recovery needs.
8. Business continuity plans
Whether plans exist, are complete, and are usable under pressure.
9. Education and training
Evidence that people know their roles and that awareness efforts are real rather than nominal.
10. Exercise program
Whether testing is planned, performed, and followed by corrective action.
11. Audit findings, recommendations, and auditor's opinion
Turning evidence into findings, recommendations, and a supportable opinion, the culminating skill of the whole discipline.
For a deeper treatment of each area, see our complete guide to all 11 content areas. Note that these topics intentionally exclude the course's introduction, exam-preparation segment, and the examination event itself. DRI's professional-practice areas and application essay subjects are likewise separate and are not a substitute for the audit exam's scope.
What the Credential Costs
Because the CBCA involves both a course and an application, its price is best read as a two-part figure. DRI publishes a US course-and-exam price of $2,950 for either BCLE AUD (ISO 22301) or BCLE AUD (NFPA 1600). The first exam attempt is included in that price rather than being an extra $750. The certification application is a separate $400.
| Item | Published amount |
|---|---|
| Course plus first exam (ISO 22301 or NFPA 1600) | $2,950 |
| Certification application | $400 |
| Training-plus-application subtotal | $3,350 |
| Audit-exam retake | $250 |
| Annual renewal | $225 |
The $3,350 subtotal is calculated from the two published fees, before renewal, travel, taxes, or discounts. DRI's Continuity Audit FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a discounted checkout total, so eligibility and the final amount need to be confirmed with DRI. No separate member or nonmember exam-only price is published for this mandatory-course route. Our CBCA certification cost breakdown expands on budgeting.
Keeping the Designation Active
Holding the title is an ongoing commitment rather than a one-time event. Maintenance has two distinct components that are easy to blur together:
- An annual fee of $225, which is a financial maintenance item paid each year.
- 80 CEAPs (Continuing Education Activity Points) over each two-year period, plus compliance with DRI's code of ethics.
Do not describe the CBCA as an unconditional two-year credential. The annual fee and the two-year CEAP cycle run on different clocks, and both matter. The required audit course itself carries 32 CEAPs across four full instructional days, which gives new holders a head start toward the first CEAP cycle.
Avoiding Acronym Confusion
The letters CBCA are shared by several unrelated credentials in other fields, and search results frequently mix them together. On this site, CBCA refers only to the DRI International Certified Business Continuity Auditor designation. If a source discusses a different certifying body, a different fee schedule, or domain weightings you do not recognize from DRI's audit materials, it is almost certainly describing another credential that happens to share the acronym. Do not carry exam fees, dates, domain weights, pass rates, or salary figures from one to the other.
A few quick checks keep you anchored to the right credential: the certifying body should be DRI International, the exam should be an audit examination tied to a business continuity audit course, and the course should be BCLE AUD under either the ISO 22301 or NFPA 1600 route.
Turning the Meaning Into a Preparation Plan
Because the credential is about auditing a continuity program, preparation should follow the lifecycle of that audit rather than a random order of topics. One sensible pacing, anchored to the course topics above, looks like this. These allocations are editorial suggestions, not official exam weightings.
Audit mindset and the standard
- Auditing basics and Understanding ISO 22301, because every later topic is judged against them
- Context of the organization, to see how scope is set
Program governance and analysis
- Leadership, planning, support, and operation
- Risk assessment and business impact analysis, the evidence trail behind every strategy
Solutions and readiness
- Continuity strategies and solutions, then business continuity plans
- Education and training, then the exercise program
Reporting and timed practice
- Audit findings, recommendations, and auditor's opinion
- Full-length timed sets to rehearse the 2 hours 30 minute window across 100 questions
Keep your practice material original. Candidates must keep DRI course and exam materials confidential, so build or use only independently written practice questions rather than reconstructed exam items. Our CBCA study guide goes deeper on structuring sessions, the CBCA cheat sheet condenses the key facts onto one page, and how hard the CBCA exam is sets expectations on difficulty. If you want to test yourself under realistic conditions, try the CBCA practice tests, and read about CBCA training options before you choose a course.
Key Takeaway
Treat the CBCA as an audit skill first and a test second. For every topic, ask what evidence an auditor would request, what would count as a gap, and how you would word the finding. That habit matches how the credential is meant to be used.
Frequently Asked Questions
CBCA stands for Certified Business Continuity Auditor, a designation issued by DRI International. It identifies professionals trained to audit business continuity programs. For related phrasing, see our pages on what CBCA certification is and what a CBCA is.
No. DRI states that passing the course examination alone does not confer professional certification. You must also submit an experience-based application, including five subject-matter essays and validating references, and have it approved.
The Audit Examination has 100 multiple-choice questions with 2 hours 30 minutes allowed. The required score is at least 75%. A breakdown of scored versus unscored questions is not publicly specified.
The published course-and-exam price is $2,950, with the first exam included, and the certification application is a separate $400, for a $3,350 subtotal before renewal, travel, taxes, or discounts. A 10% professional-organization discount is advertised, but eligibility must be confirmed with DRI.
Maintaining the designation requires a $225 annual fee, 80 CEAPs over each two-year continuing-education period, and compliance with DRI's code of ethics. It is not an unconditional two-year credential.