- What You Are Actually Studying For
- The Required Route and What It Costs
- Exam Format, Timing, and Passing Score
- The Eleven Preparation Topics, Explained
- Sequencing the Topics Across Your Prep
- Building Practice Questions the Right Way
- After the Exam: The Experience Application
- Frequently Asked Questions
- CBCA is DRI International's Certified Business Continuity Auditor credential; passing the exam alone does not confer certification.
- The exam is 100 multiple-choice questions in 2 hours 30 minutes, with a required score of at least 75%.
- The published course-plus-first-exam price is $2,950, and the separate certification application is $400.
- Your ISO 22301 audit knowledge is tested through course-based topics, so prepare from the DRI course outline.
What You Are Actually Studying For
Before opening any study material, get the target exactly right. The Certified Business Continuity Auditor (CBCA) credential is governed by DRI International (Disaster Recovery Institute International). It is an auditor-focused credential, which means the exam is less about writing a continuity plan and more about judging whether an organization's management system, plans, and evidence meet a standard.
This guide targets the DRI Audit Examination - ISO 22301, taken after the ISO 22301 audit course. It does not cover the separate NFPA 1600 audit route, and it is not the general DRI Qualifying Examination, which is a different exam. If you want the definitional background first, start with What Is CBCA Certification? and then return here.
The Required Route and What It Costs
The CBCA path is course-first. Completing the Business Continuity Planning for Auditors course (BCLE AUD) is required before you can sit the Audit Examination. The ISO 22301 version of the course references ISO 22301:2019, and the current US course runs four full instructional days and awards 32 Continuing Education Activity Points (CEAPs). You do not need a previous DRI certification to enroll.
Here is how the published fees fit together:
| Item | Published Amount | Notes |
|---|---|---|
| BCLE AUD course with first exam (ISO 22301 or NFPA 1600) | $2,950 | The first exam attempt is included, not an extra $750 |
| Certification application | $400 | Paid separately from the course |
| Training plus application subtotal | $3,350 | Before renewal, travel, taxes, or discounts |
| Audit-exam retake | $250 | Only if you need a second attempt |
| Annual renewal | $225 | Ongoing maintenance fee |
DRI's Continuity Audit FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a discounted checkout total. Confirm eligibility with DRI before assuming the discount applies to you. For a fuller breakdown, see our CBCA certification cost guide.
Exam Format, Timing, and Passing Score
The Audit Examination consists of 100 multiple-choice questions, and you have 2 hours 30 minutes to complete it. That works out to roughly 90 seconds per question, which is workable if you do not stall on any single item. The required score is at least 75%, which is a per-candidate threshold rather than an observed pass rate. For the exact mechanics, see CBCA Passing Score 2026.
A few points deserve care because they are easy to get wrong:
- It is multiple choice only. The course includes a hypothetical-company case study and practical auditing activities, but those are classroom exercises, not an essay or performance-based exam.
- The five essays belong to the application. They are part of the professional certification review, not the 100-question exam.
- Scheduling follows the course. Current course descriptions say the exam is taken online after the course at your convenience, although an older FAQ sentence mentions the final course day. Follow the booking instructions for your specific course, and see CBCA exam dates and scheduling for more.
- Unverified rules. Open-book status, calculator permissions, and detailed remote-proctor rules are not publicly confirmed. Read your DRI exam instructions rather than assuming rules from other certifications.
The Eleven Preparation Topics, Explained
The preparation topics below come from the headings in DRI's current ISO 22301 audit-course outline. They are course topics, not an official weighted blueprint, and no official topic percentages have been verified. Because weights are unknown, the sensible strategy is balanced coverage with extra time on topics where your professional background is thinnest. For a deeper walk-through, see CBCA Exam Domains 2026.
Foundations: Auditing and the Standard
Auditing basics
This is where the auditor mindset begins. Expect questions that test how an auditor behaves, not how a planner behaves.
- Distinguish evidence gathering from opinion forming
- Know the auditor's role relative to the audited management system
- Understand objectivity, sampling, and what counts as credible evidence
Understanding ISO 22301
The standard's own structure is the backbone of the exam. Note that the current course page uses the heading "Understanding ISO 22301," while the brochure says "Introduction to ISO22301"; this is the same topic, not two separate ones.
- Learn the clause structure of ISO 22301:2019 and what each requires
- Know the difference between a requirement ("shall") and guidance
- Be able to map an audit observation back to the clause it relates to
Management System Clauses
Context of the organization
Auditors must verify that the organization understands its internal and external environment and its interested parties.
- Interested parties and their requirements
- Scope of the continuity management system and how it is justified
Leadership, planning, support, and operation
This broad topic covers how the management system is governed and run. Candidates often underestimate it because it bundles several clauses.
- Top-management commitment, policy, and assigned responsibilities
- Objectives, resources, competence, awareness, and documented information
- How operational controls are planned and implemented
Continuity Analysis and Design
Risk assessment
Auditors evaluate whether the organization's risk process is systematic and tied to continuity decisions.
- Whether threats and vulnerabilities are identified and evaluated consistently
- How risk results connect to treatment and to the rest of the program
Business impact analysis (BIA)
The BIA anchors prioritization, so auditors check whether it is credible and used.
- Time-based impact, recovery priorities, and dependencies
- Whether BIA outputs actually drive strategy selection
Continuity strategies and solutions
Here you judge whether chosen strategies are justified by the analysis that precedes them.
- Fit between strategy and recovery requirements
- Resource, supplier, and dependency considerations
Capability, Proof, and Reporting
Business continuity plans
Auditors test plans for completeness, usability, and alignment with strategy rather than for elegance.
- Activation criteria, roles, and communication content
- Whether plans are current, controlled, and consistent with the BIA and strategies
Education and training
People capability is auditable. Expect questions about evidence that staff know their roles.
- Awareness versus role-specific training
- Records that demonstrate competence
Exercise program
Exercises generate the strongest audit evidence about whether the program works.
- Whether exercises are planned, varied, and tied to objectives
- How results and lessons learned feed corrective action
Audit findings, recommendations, and auditor's opinion
The closing topic is where evidence becomes a conclusion. It rewards precise reasoning.
- Writing findings that are factual, evidence-based, and traceable to a requirement
- Separating a finding from a recommendation, and both from the overall opinion
Key Takeaway
The topics form a chain: context feeds risk and BIA, BIA feeds strategies, strategies feed plans, plans are trained and exercised, and the auditor judges the whole chain. Study the links between topics, not only each topic in isolation.
Sequencing the Topics Across Your Prep
Because the topics build on one another, order matters more than raw hours. The plan below follows the dependency chain. Adjust the number of weeks to your course date and your background, and keep your DRI course notes close.
Standard and auditor mindset
- Auditing basics and Understanding ISO 22301
- Build a clause map you can recite from memory
Management system clauses
- Context of the organization
- Leadership, planning, support, and operation
Analysis and design chain
- Risk assessment, then BIA, then continuity strategies and solutions
- Practice tracing a BIA result into a strategy decision
Capability and reporting
- Business continuity plans, education and training, exercise program
- Audit findings, recommendations, and auditor's opinion
- Timed run of 100 questions in 2 hours 30 minutes
For a compact reference to keep beside you while reviewing, our CBCA cheat sheet condenses the facts you will want at hand.
Building Practice Questions the Right Way
Candidates must keep DRI course and exam materials confidential. That means you should never seek out or share recalled exam content. Instead, write your own practice questions from the standard and your course understanding, and use independent practice material such as the CBCA practice tests on our main site.
Good self-written questions for this exam share a pattern. Give a short audit scenario, then ask what the auditor should conclude, which evidence is most convincing, or which clause a gap relates to. Since the weighting is unknown, the allocation below is editorial guidance only, not an official breakdown:
- Spend slightly more practice effort on the analysis-to-strategy chain (risk, BIA, strategies), because errors there cascade into later topics.
- Write at least a few questions on the difference between a finding, a recommendation, and an opinion, since auditors lose points on definitions they assume they know.
- Rotate through all eleven topics at least twice before your timed run so no topic stays cold.
After the Exam: The Experience Application
Clearing the 100-question exam does not make you a CBCA. DRI's application requires at least two years of significant practical experience in business continuity, emergency/disaster management, and/or audit within the preceding ten years. You also submit five subject-matter essays and two validating references per subject area, and the same two people may serve across all five areas. At least two essays must come from DRI's specified application areas covering business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment, and maintenance.
No degree requirement or fixed experience-hour threshold was found. Certain existing professional designations can waive parts of the reference or experience sections, but this is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement. Review the full eligibility picture in CBCA requirements.
Maintaining the credential involves a $225 annual fee, 80 CEAPs over each two-year continuing-education period, and adherence to DRI's code of ethics. Note the distinction between the annual financial maintenance and the two-year CEAP cycle; the credential is not unconditionally valid for two years. If you are weighing the investment, our ROI analysis and salary guide discuss the career side, and CBCA jobs covers the kinds of roles where audit credentials appear.
Frequently Asked Questions
No. The exam is one requirement. DRI also reviews an experience-based application that includes practical experience, five essays, and validating references before the CBCA designation is conferred.
The Audit Examination has 100 multiple-choice questions with a time limit of 2 hours 30 minutes. A scored versus unscored question breakdown is not publicly specified.
You need at least 75%. This is the individual required score, not a published pass rate, and DRI does not disclose a cohort pass rate in the sources reviewed.
No. Completing the BCLE AUD course route is required before the Audit Examination, and exam access follows course registration through your DRI account.
The first exam attempt is included in the $2,950 course price. A published audit-exam retake fee of $250 applies to a subsequent attempt, so confirm retake rules with DRI when you register.
Pair your course notes with focused practice on all eleven topics, and use the CBCA practice test site to rehearse the timed 100-question format before your attempt. For a broader orientation, return to this CBCA study guide as you refine your plan.