- Why No Official CBCA Pass Rate Exists
- The Numbers DRI Does Publish
- Pass-Rate Claims You Should Not Trust
- 75% Is a Score, Not a Pass Rate
- Two Gates: Exam Plus Application
- What Actually Drives Difficulty
- Domain-by-Domain Readiness Check
- A Domain-Ordered Prep Sequence
- Cost and Risk of a Failed Attempt
- Frequently Asked Questions
- DRI International does not publicly disclose a pass rate for the Certified Business Continuity Auditor audit examination.
- The 75% figure is the minimum individual score needed to pass, not a cohort success statistic.
- The exam is 100 multiple-choice questions in 2 hours 30 minutes, taken after the audit course.
- Passing the exam alone does not confer CBCA; DRI also reviews an experience-based application.
Why No Official CBCA Pass Rate Exists
If you searched for the Certified Business Continuity Auditor pass rate, here is the direct answer: there is no verified, publicly disclosed pass rate. DRI International (Disaster Recovery Institute International), the governing body for the credential, does not publish cohort pass or fail percentages in its certification page, its specialty-exam listing, its course descriptions, or its Continuity Audit FAQ. Those are the sources this article is built on, and none of them contains a pass-rate figure.
That matters because pass-rate pages across the exam-prep industry are often filled with confident-sounding numbers that trace back to nothing. For this credential, any specific percentage you see attached to the Certified Business Continuity Auditor audit examination should be treated as unverified unless the source is DRI itself. This article will not invent one, and it will not estimate one.
What we can do is lay out what the data does show: the structure of the exam, the fee mechanics, the score threshold, the course-first pathway, and the design features that tell you where candidates are most likely to struggle. For a broader look at difficulty, see our complete difficulty guide for the CBCA exam.
The Numbers DRI Does Publish
The absence of a pass rate does not mean the exam is opaque. DRI publishes a fair amount of concrete detail. Here is the verified picture of the audit examination target for this article, the DRI Audit Examination for ISO 22301.
| Item | What DRI Publishes |
|---|---|
| Question count | 100 multiple-choice questions |
| Time allowed | 2 hours 30 minutes |
| Passing score | At least 75% (individual score requirement) |
| Course-and-exam price | $2,950 (first exam attempt included) |
| Certification application | $400 (separate) |
| Annual renewal | $225 |
| Audit-exam retake | $250 |
| Course length | Four full instructional days, 32 CEAPs |
| Published pass rate | Not publicly disclosed |
The scored versus unscored question breakdown is also not specified in the official sources reviewed, so do not assume every one of the 100 items counts, or that all of them do. Plan to treat every question as if it matters.
For the full pricing picture, including how the $2,950 and $400 combine into a $3,350 training-plus-application subtotal before renewal, travel, taxes, or discounts, read our CBCA certification cost breakdown.
Pass-Rate Claims You Should Not Trust
When no official rate exists, a vacuum forms, and marketing fills it. Be skeptical of three patterns in particular.
Generic business-continuity pass rates
Some training providers advertise success rates for business-continuity courses in general. Those are marketing statements about a provider's own students on a provider's own programs. They are not a Certified Business Continuity Auditor cohort statistic, and they cannot be used to estimate your odds on the DRI audit examination.
Numbers borrowed from other credentials
The acronym CBCA is shared by several unrelated credentials in other fields. Pass rates, fees, and exam formats for those credentials have nothing to do with the DRI audit certification. If a page mixes finance-exam details, open-book rules, or calculator policies into a discussion of this exam, it is describing a different credential. Open-book or closed-book status, calculator permissions, and detailed remote-proctor rules for this examination could not be verified publicly, so do not rely on secondhand claims about them.
The general DRI qualifying exam
DRI also offers a general qualifying examination that is separate from this audit exam. Statistics, anecdotes, or study advice about that exam do not transfer. Your target is the Audit Examination tied to the audit course route.
If you want the exact identity of the credential before going further, our explainers on what CBCA certification is and what CBCA stands for cover it.
75% Is a Score, Not a Pass Rate
The single most common confusion in this area is mixing up the passing score with the pass rate. They answer different questions.
- Passing score (75%): the minimum percentage of correct answers you must achieve on your attempt. It is a bar set by DRI.
- Pass rate: the share of all candidates who clear that bar. DRI has not published it.
With 100 questions, a 75% threshold means you need at least 75 correct answers, assuming all items are scored. Because the scored/unscored split is not publicly specified, treat that as a planning assumption rather than a guarantee. Our guide to the CBCA passing score goes deeper on how to think about the threshold.
Two Gates: Exam Plus Application
Another reason a single pass-rate number would be misleading: earning the Certified Business Continuity Auditor designation involves two separate gates, and a pass rate on the first says nothing about the second.
Gate 1: The Audit Course and Examination
Candidates complete the Business Continuity Planning for Auditors course (the BCLE AUD route, either ISO 22301 or NFPA 1600), then sit the Audit Examination online through their DRI account.
- Four full instructional days, 32 CEAPs
- Course may be taken without a previous DRI certification
- 100 multiple-choice questions, 2 hours 30 minutes, 75% minimum
Gate 2: The Experience-Based Application
Passing the course examination alone does not confer professional certification. DRI separately reviews an application.
- At least two years of significant practical experience in business continuity, emergency/disaster management, and/or audit within the preceding ten years
- Five subject-matter essays, at least two from DRI's specified application areas
- Two validating references per subject area, potentially the same two people across all five
Important nuance: the five essays belong to the application, not to the 100-question exam. The exam itself is multiple choice only. Certain existing professional designations can qualify for reference or experience-section waivers, but that is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement. For the full eligibility picture, see our CBCA requirements guide.
What Actually Drives Difficulty
Without a pass rate, the most useful question is not "what percentage pass?" but "what makes this exam hard for the people who attempt it?" Several structural features stand out.
It tests auditor judgment, not just recall
The course is built around auditing a business continuity management system against ISO 22301, including a hypothetical-company case study and practical auditing exercises. Those classroom exercises are not the exam, but they shape how questions are likely to be framed: as scenarios where you must decide what an auditor would examine, conclude, or report. Memorizing clause numbers without understanding audit logic is a risky approach.
The standard is specific
The ISO route references ISO 22301:2019, and the current specialty-exam catalogue labels the exam "2023 Audit Exam - ISO 22301." Questions will assume you know how the standard structures a continuity management system and what evidence shows conformity.
The pathway front-loads commitment
Because the course is mandatory and the first exam attempt is bundled into the $2,950 price, most candidates arrive having already invested heavily. That investment can create pressure, but it also means you attend four days of instruction before ever sitting the exam. Use that time deliberately.
Scope ambiguity
DRI has not published a weighted blueprint for this exam. No official topic percentages, no named exam domains, and no declared "largest domain" are publicly verified. That uncertainty is itself a difficulty factor: you cannot study to a weighting, so you must be competent across the whole audit lifecycle.
Our complete guide to the eleven CBCA content areas expands on each topic.
Domain-by-Domain Readiness Check
Because the true pass rate is unknown, a more reliable self-assessment is to test yourself against each course topic. Here is what competence looks like in each of the eleven areas drawn from the ISO 22301 audit-course outline.
Auditing Basics
The foundation of everything else. Be able to explain audit purpose, independence, evidence, and how an audit differs from a consultancy engagement.
- Audit evidence versus audit opinion
- Objectivity and professional conduct of the auditor
Understanding ISO 22301
Know the structure and intent of the standard (the 2019 edition for this route). Note the DRI HTML heading reads "Understanding ISO 22301," while the course brochure says "Introduction to ISO22301." It is the same topic, not two.
- How the standard frames a continuity management system
- The vocabulary the standard relies on
Context of the Organization
Auditors must judge whether the organization has understood its internal and external environment and the needs of interested parties.
Leadership, Planning, Support, and Operation
A broad topic covering management commitment, objectives, resources, competence, and operational control. Expect to connect evidence to each requirement.
Risk Assessment
Understand how risks to prioritized activities are identified, analyzed, and evaluated, and what an auditor looks for to confirm the process is credible and repeatable.
Business Impact Analysis (BIA)
Know how impacts over time drive priorities and recovery objectives, and how an auditor tests whether BIA outputs are actually used downstream.
Continuity Strategies and Solutions
Be ready to evaluate whether chosen strategies are proportionate to BIA and risk results, and whether resourcing is realistic.
Business Continuity Plans
Understand what plans must contain, how they are activated, and what makes a plan auditable versus merely written.
Education and Training
Know how awareness, competence, and training records serve as audit evidence that people can execute the plans.
Exercise Program
Be able to assess whether exercises are planned, varied, and followed by documented lessons and corrective action.
Audit Findings, Recommendations, and Auditor's Opinion
The capstone. Practice distinguishing a nonconformity from an observation, writing a clear finding, and forming an opinion supported by evidence.
A Domain-Ordered Prep Sequence
Rather than generic scheduling, anchor your preparation to the way these topics build on one another. The logic follows the continuity lifecycle: you cannot audit a BIA you do not understand, and you cannot write defensible findings until you know what good looks like in every earlier area. The timeline below is an editorial suggestion, not an official DRI plan, and the weeks are flexible depending on when you sit the exam relative to the course.
Foundations
- Auditing basics and the structure of ISO 22301
- Context of the organization
Management System Requirements
- Leadership, planning, support, and operation
- Risk assessment concepts and evidence
Analysis to Action
- Business impact analysis
- Continuity strategies and solutions
- Business continuity plans
Proof and Reporting
- Education and training; exercise program
- Audit findings, recommendations, and the auditor's opinion
- Timed full-length practice under 2 hours 30 minutes
Two cautions. First, DRI course and exam materials are confidential, so build only independently written practice questions rather than reconstructing exam items from memory. Second, spend your final days on timed, mixed-topic sets so you get used to the pace of 100 questions in 150 minutes, roughly a minute and a half per item. Our CBCA study guide walks through approach in more detail, and the CBCA cheat sheet condenses the must-know facts.
For timed, scenario-style drills, the CBCA practice test site offers independently written questions that mirror the audit-judgment style of the exam without reproducing confidential DRI material.
Cost and Risk of a Failed Attempt
Since you cannot lean on a published pass rate to estimate your risk, plan around the financial downside instead. The first exam attempt is included in the $2,950 course-and-exam price. If you do not reach 75%, an audit-exam retake is $250. That is far cheaper than the course itself, but it still adds cost and delays your path to the application stage.
A few practical points about the money side:
- The $400 certification application is separate and comes after you have the exam result and your experience documentation in order.
- Annual renewal is $225, alongside 80 CEAPs over each two-year continuing-education period and compliance with DRI's code of ethics. Do not confuse the annual fee with the two-year CEAP cycle.
- DRI's FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list all qualifying organizations or show a discounted checkout total, so confirm eligibility and the amount before relying on it.
Scheduling also deserves a note. Current course descriptions say the online exam is taken after the course at the learner's convenience, though the FAQ still refers to the final course day. Follow the booking instructions for your specific course rather than the older general sentence. Our CBCA exam dates guide covers scheduling, and if you are weighing the overall investment, the CBCA ROI analysis and CBCA jobs overview are useful next reads.
Key Takeaway
Replace "what is the pass rate?" with "am I ready across all eleven course topics?" Use timed, independently written practice to decide when to sit the exam, and treat the $250 retake as a safety net, not a plan.
Frequently Asked Questions
DRI International has not publicly disclosed a pass rate for the Certified Business Continuity Auditor audit examination in the official certification, specialty-exam, course, and FAQ materials reviewed. Any specific percentage you encounter without a DRI source should be treated as unverified.
No. The 75% figure is the minimum score an individual candidate must achieve to pass. The pass rate would be the share of all candidates who succeed, and that number is not published.
Not by itself. Passing the course examination does not confer professional certification. DRI also reviews an experience-based application with at least two years of relevant experience, five essays, and validating references.
The audit examination has 100 multiple-choice questions and allows 2 hours 30 minutes. The breakdown between scored and unscored questions is not publicly specified.
An audit-exam retake is $250 according to the published fee information. The first attempt is already included in the $2,950 course-and-exam price.