- What "CBCA Training" Actually Means
- Course Mechanics: Four Days, 32 CEAPs, One Mandatory Route
- What the Training Costs and What Sits Outside It
- The Audit Examination: Format and Rules You Can Verify
- The Eleven Preparation Topics, Mapped to Auditor Work
- Sequencing the Topics Across Your Preparation Weeks
- Practice Material Without Breaching Confidentiality
- After the Exam: Application, Essays, and Renewal
- Where Trained Auditors Are Used
- Frequently Asked Questions
- CBCA training is DRI International's BCLE AUD course: four full days, 32 CEAPs, completed before the Audit Examination.
- The published course-and-exam price is $2,950, and the separate certification application adds $400.
- The exam is 100 multiple-choice questions in 2 hours 30 minutes, with a required score of at least 75%.
- Passing the exam alone does not confer CBCA; DRI also reviews an experience-based application with five essays.
What "CBCA Training" Actually Means
Certified Business Continuity Auditor (CBCA) is a designation from DRI International (Disaster Recovery Institute International). Unlike credentials where you can self-study and book a seat at a third-party testing center, the CBCA path runs through a mandatory training course. The course is called Business Continuity Planning for Auditors, listed by DRI as BCLE AUD, and it comes in two flavors: one built around ISO 22301 and one built around NFPA 1600.
That structure shapes everything about preparation. "Training" here is not an optional add-on to a self-directed study plan. It is the gate you pass through before you are allowed to sit the Audit Examination at all. If you are still orienting yourself on the credential, start with What Is CBCA Certification? for the big picture, then return here for the training specifics.
Course Mechanics: Four Days, 32 CEAPs, One Mandatory Route
Current US offerings of the course run four full instructional days and award 32 Continuing Education Activity Points (CEAPs). Those points matter later, because DRI requires 80 CEAPs over each two-year continuing-education period to maintain certification. A single course delivers a substantial share of one cycle's requirement.
Key mechanics to understand before you register:
- No prior DRI certification is required to take the course. You can enter the training without already holding another DRI credential.
- The course includes a hypothetical-company case study and practical auditing activities. These are classroom exercises that build audit judgment. They are not the examination itself, and they should not be mistaken for a performance-based or essay test.
- The exam follows the course. Current course descriptions say the examination is taken online after the course, at your convenience, through your DRI account. DRI's FAQ still contains an older sentence suggesting the exam occurs on the final course day. Treat the course-specific booking instructions as authoritative and confirm with DRI when you register.
- No external testing vendor was verified. DRI administers the Audit Examination through its own online examination and account process, so do not plan around a Pearson VUE or similar test-center booking.
For timing questions beyond what the course page states, see our guide to CBCA exam dates, windows, and scheduling.
What the Training Costs and What Sits Outside It
DRI publishes a course-and-exam price of $2,950 for either BCLE AUD (ISO 22301) or BCLE AUD (NFPA 1600). The first exam attempt is included in that price, so you should not budget an additional $750 for it. The certification application is billed separately at $400.
| Cost Item | Published Amount | Notes |
|---|---|---|
| Course plus first exam attempt | $2,950 | Same price for ISO 22301 or NFPA 1600 route |
| Certification application | $400 | Separate from the course fee |
| Training-plus-application subtotal | $3,350 | Calculated from the two fees; excludes renewal, travel, taxes, discounts |
| Audit-exam retake | $250 | Applies if a further attempt is needed |
| Annual renewal | $225 | Paid annually, separate from the CEAP cycle |
DRI's Continuity Audit FAQ advertises a 10% discount for NFPA and other professional-organization members. However, DRI does not list every qualifying organization or show a current discounted checkout total, so confirm eligibility and the final amount with DRI before assuming the discount applies. No separate member or nonmember exam-only price is published for this mandatory-course route.
The Audit Examination: Format and Rules You Can Verify
The examination you are training for has a small number of publicly confirmed parameters:
- Length: 100 multiple-choice questions.
- Time: 2 hours 30 minutes.
- Required score: at least 75%. This is the individual score you must earn; it is not an observed pass rate.
- Delivery: online, accessed through your DRI account after course registration.
- Version: DRI's specialty-exam catalogue labels the ISO route "2023 Audit Exam - ISO 22301," and the current course references ISO 22301:2019.
Just as important is what is not publicly established. DRI's reviewed materials do not specify a scored versus unscored question breakdown, open-book or closed-book status, calculator permissions, detailed remote-proctoring rules, or a permitted-reference list. Do not import those rules from other certifications that share a similar acronym. Confirm them with DRI when you book. An ADA-version listing exists for the ISO audit exam, but the public listing does not show a different time allowance.
Two further points deserve emphasis. First, no official weighted domain blueprint was found, so any claim about which topic carries the most exam weight is unverified. Second, DRI does not publicly disclose a cohort pass rate. Our page on the CBCA pass rate explains why general business-continuity training marketing numbers should not be mistaken for CBCA statistics, and CBCA passing score covers the 75% threshold in more depth.
The Eleven Preparation Topics, Mapped to Auditor Work
The eleven topics below come from headings in DRI's current ISO 22301 audit-course outline. They are course-preparation topics, not an official weighted or exhaustive exam blueprint, and the practice allocations discussed later are editorial. For a topic-by-topic deep dive, see CBCA Exam Domains: Complete Guide to All 11 Content Areas.
Foundations: Auditing Basics and the Standard
Auditing Basics
Before you audit a continuity program you must think like an auditor. Expect the course to build the vocabulary and discipline of audit work.
- Distinguish an auditor's independence and objectivity from a consultant's advisory role.
- Know how evidence is gathered, evaluated, and documented to support a conclusion.
- Practice separating observation from interpretation, since findings must be defensible.
Understanding ISO 22301
The audit is measured against a standard, so you need to read it as a set of auditable requirements. DRI's course heading reads "Understanding ISO 22301," while the linked brochure says "Introduction to ISO22301"; this is a spelling difference, not an extra topic.
- Treat each clause as a requirement you could test with evidence.
- Be precise about the edition the course references: ISO 22301:2019.
- Learn the standard's structure well enough to locate any requirement quickly.
Organization and Management System Topics
Context of the Organization
An auditor starts by asking whether the organization has understood its own situation.
- Look for evidence that internal and external issues have been identified.
- Check that interested parties and their requirements are recognized.
- Confirm the scope of the continuity management system is defined and justified.
Leadership, Planning, Support, and Operation
This combined heading covers how management commits to, resources, and runs the continuity program.
- Verify that top management commitment is demonstrable, not merely asserted in a policy.
- Examine objectives, resources, competence, and documented information.
- Trace operational controls from planning through execution.
Analysis and Strategy Topics
Risk Assessment
Auditors test whether risks to prioritized activities are identified, analyzed, and treated in a structured way.
- Look for a repeatable method rather than ad hoc judgment.
- Check that risk outputs actually feed later decisions.
Business Impact Analysis (BIA)
The BIA is a frequent audit focus because so much downstream work depends on it.
- Test whether impacts over time are assessed for activities.
- Check that recovery priorities and dependencies are documented and approved.
- Ask whether BIA results are current and reviewed after change.
Continuity Strategies and Solutions
Here you assess whether chosen strategies are justified by the analysis that came before.
- Trace each strategy back to BIA and risk findings.
- Confirm resource requirements are identified and available.
Implementation and Assurance Topics
Business Continuity Plans
Plans are where intent becomes action, so auditors test usability as well as existence.
- Check that plans define roles, activation criteria, and communication paths.
- Verify that plans align with the strategies they implement.
Education and Training
A plan nobody understands is a finding waiting to happen.
- Look for evidence of awareness and competence for people with continuity roles.
- Check that training records exist and match stated requirements.
Exercise Program
Exercises are the primary evidence that plans work.
- Assess whether the program is planned, varied, and tied to objectives.
- Examine whether exercise outcomes lead to documented corrective action.
Audit Findings, Recommendations, and Auditor's Opinion
This topic closes the loop: turning evidence into conclusions.
- Practice classifying findings and tying each to specific evidence and a requirement.
- Learn how recommendations differ from findings and how an overall opinion is supported.
Sequencing the Topics Across Your Preparation Weeks
You do not need a generic study system here; you need an order that mirrors how the topics build on one another. The standard's logic flows from context to analysis to strategy to plans to proof, so schedule your revision in that order. The sample below assumes you have finished the four-day course and are preparing for the online exam. The time allocations are editorial suggestions, not official weightings.
Standard and Audit Foundations
- Revisit Auditing Basics and Understanding ISO 22301 first, since every later topic assumes them.
- Build a one-page clause map you can scan quickly.
Organization and Management System
- Cover Context of the organization, then Leadership, planning, support, and operation.
- Write independent scenario questions asking what evidence would satisfy each requirement.
Analysis Chain
- Work Risk assessment, Business impact analysis, then Continuity strategies and solutions as one connected chain.
- Practice tracing a strategy back to its BIA and risk basis.
Implementation and Reporting
- Cover Business continuity plans, Education and training, and the Exercise program.
- Finish with Audit findings, recommendations, and auditor's opinion, then take timed mixed sets of 100 questions in 2 hours 30 minutes.
For a broader plan that pairs with this sequence, use the CBCA study guide, and keep the CBCA cheat sheet handy for last-pass review. If you want timed multiple-choice repetition, our CBCA practice tests are built for exactly that kind of drill.
Key Takeaway
Because the audit is evidence-driven, frame every topic as a question: "What would I ask to see, and what would it prove?" That habit fits the course's case-study style and helps on scenario-based multiple-choice items.
Practice Material Without Breaching Confidentiality
DRI requires candidates to keep course and exam materials confidential. That has a practical consequence: you should not seek out, share, or rely on reconstructed "real" exam questions. Build your practice from independently written questions based on the ISO 22301 standard and your own course notes, and treat any resource claiming to reproduce live exam content with suspicion.
Good independent practice items test judgment rather than recall. For example, ask what an auditor should conclude when a BIA exists but has not been updated after a major organizational change, or what evidence best demonstrates that an exercise program drives improvement. Questions like these train the reasoning the exam rewards without touching protected material. When you want a gauge of difficulty before you commit, read How Hard Is the CBCA Exam?
After the Exam: Application, Essays, and Renewal
Passing the examination does not by itself confer professional certification. DRI separately reviews an experience-based application, and that is where many candidates underestimate the workload.
The Application Requirements
- At least two years of significant practical experience in business continuity, emergency or disaster management, and/or audit within the preceding ten years.
- Five subject-matter essays. At least two must come from DRI's specified application areas covering business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment, and maintenance.
- Two validating references per subject area, which may be the same two people across all five areas.
No degree requirement and no fixed experience-hour threshold were found. Certain existing professional designations can qualify for reference or experience-section waivers, but that is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement. Note also that the five essays belong to the application, not to the 100-question exam. The full eligibility picture is in CBCA requirements and how to qualify.
Keeping the Credential Active
Maintenance has two distinct parts that candidates often blur together: an annual fee of $225, and 80 CEAPs earned over each two-year continuing-education period, along with compliance with DRI's code of ethics. It is not an unconditional two-year credential. Since the four-day course carries 32 CEAPs, plan how you will earn the remainder each cycle.
Where Trained Auditors Are Used
The CBCA is aimed at people who evaluate continuity programs rather than only build them. Work that draws on the skillset typically sits in internal audit functions, risk and compliance teams, resilience or continuity program offices, and consulting or assurance engagements that assess an organization's alignment with ISO 22301. Because published salary data for this specific credential is not established here, we avoid quoting figures; see the CBCA salary guide and CBCA jobs for how to think about roles and compensation without relying on unsupported numbers.
Frequently Asked Questions
Yes. Completing the Business Continuity Planning for Auditors course (BCLE AUD) is required before the Audit Examination. The course can be taken without any previous DRI certification.
Current US courses run four full instructional days and award 32 CEAPs. The case study and auditing activities are classroom exercises, separate from the multiple-choice exam.
DRI's published course-and-exam price is $2,950, with the first exam included. The certification application is a separate $400, giving a $3,350 subtotal before renewal, travel, taxes, or any discount. A 10% professional-organization discount is advertised, but eligibility and the discounted amount should be confirmed with DRI.
Not by itself. You must also complete DRI's experience-based application, including five essays and validating references, and meet the two-year experience requirement within the preceding ten years.
No. This guide targets the ISO 22301 Audit Examination. Coverage of the separate NFPA 1600 route is not established here, and DRI's general Qualifying Examination is a different exam entirely.