- The Honest Difficulty Verdict
- What You Actually Face on Exam Day
- Where the Real Difficulty Hides
- Domain-by-Domain Difficulty Map
- Who Finds It Easier and Who Struggles
- The Cost of Getting It Wrong
- A Preparation Sequence Built Around the ISO 22301 Course
- Practicing Without Breaking Confidentiality
- Is the Difficulty Worth the Payoff?
- Frequently Asked Questions
- The Audit Examination has 100 multiple-choice questions in 2 hours 30 minutes, with a required score of at least 75%.
- DRI does not publish a CBCA pass rate, so any specific "percent who pass" figure you see is not a verified CBCA statistic.
- The exam is only the first gate; CBCA also requires an experience-based application with five subject-matter essays.
- You must complete the four-day BCLE AUD course before sitting the exam, and the course is $2,950 with the first exam included.
The Honest Difficulty Verdict
The Certified Business Continuity Auditor credential, issued by DRI International, is best described as moderately demanding rather than punishing. The exam itself is a conventional 100-question multiple-choice test. The difficulty comes from three other places: the 75% threshold, the need to think like an auditor rather than a planner, and the multi-part path that surrounds the exam, which includes a mandatory course and an experience application.
Be wary of anyone who gives you a precise pass rate. DRI does not publicly disclose one in its certification, specialty-exam, course, or FAQ materials. Training marketing that quotes general business-continuity pass rates is not a CBCA cohort statistic. If you want to understand what that gap means for your planning, read our breakdown of what the CBCA pass rate data actually shows.
What You Actually Face on Exam Day
Understanding the format removes a lot of imagined difficulty. Here is what the published facts establish.
| Element | What DRI Publishes |
|---|---|
| Questions | 100 multiple-choice questions |
| Time allowed | 2 hours 30 minutes |
| Passing score | At least 75% individual score |
| Delivery | Online, through your DRI account after course registration |
| Prerequisite | Completion of the four-day BCLE AUD course (32 CEAPs) |
| Retake fee | $250 per audit-exam retake |
Two pacing facts follow from the numbers. At 100 questions in 150 minutes, you have roughly a minute and a half per question, which is comfortable for recall items but tighter for scenario questions that ask you to evaluate a described control or finding. Also, DRI does not publicly break the 100 questions into scored and unscored items, so assume every question matters.
Several details that candidates often ask about could not be verified from public sources: whether the exam is open-book or closed-book, calculator rules, detailed remote-proctoring requirements, and any permitted-reference list. Confirm all of these in your DRI account and course instructions rather than relying on forum posts. For the passing threshold specifically, see our page on exactly what score you need to pass the CBCA.
The case study is not on the exam
The BCLE AUD course includes a hypothetical-company case study and practical auditing activities. Those are classroom exercises. They are not a performance-based or essay component of the 100-question exam. The five essays belong to the professional certification application, which is a separate step. Candidates who confuse the two either over-prepare for essay writing before the exam or under-prepare for it afterward.
Where the Real Difficulty Hides
Hurdle 1: Passing the exam does not make you a CBCA
Passing the course examination alone does not confer certification. DRI separately reviews an experience-based application. To obtain the designation you need at least two years of significant practical experience in business continuity, emergency or disaster management, and/or audit within the preceding ten years, plus five subject-matter essays and two validating references per subject area (potentially the same two people across all five areas). At least two essays must come from DRI's specified application areas covering business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment and maintenance.
For many candidates, drafting five credible essays is a bigger effort than the multiple-choice test. Our guide to CBCA requirements, eligibility and prerequisites walks through the application side in more detail.
Hurdle 2: The auditor's mindset shift
Practitioners who spend their careers writing plans tend to ask, "Is this plan good?" An auditor asks, "Is there evidence this plan meets the requirement, and how would I demonstrate a gap?" The exam rewards the second habit. Expect questions framed around conformity, evidence, and the wording of the ISO 22301:2019 requirements rather than around what you personally would do in a crisis.
Hurdle 3: Version precision
The current DRI specialty-exam catalogue labels the ISO route "2023 Audit Exam - ISO 22301," and the course references ISO 22301:2019. If you study from older material or from a different standard's terminology, you can lose points on wording that looks familiar but differs. Treat the 2019 edition as your reference text.
Domain-by-Domain Difficulty Map
DRI has not publicly verified an official weighted exam blueprint, so there are no official domain percentages to quote, and no confirmed "largest domain." The eleven areas below are drawn from the current ISO 22301 audit-course outline and serve as preparation topics, not an official exam breakdown. The difficulty ratings are editorial judgments based on how the material is typically experienced, not DRI statistics. For a fuller walkthrough, see our complete guide to all 11 CBCA content areas.
Auditing Basics and Understanding ISO 22301
These foundation topics are usually the easiest to start with and the easiest to underestimate.
- Audit terminology, evidence, and the logic of conformity assessment
- How the ISO 22301 standard is structured and what "shall" requirements mean
Context of the Organization; Leadership, Planning, Support, and Operation
Moderately difficult because the questions test whether you can map a described situation to the correct clause area.
- Interested parties, scope, and the business continuity management system
- Management commitment, resources, competence, and documented information
Risk Assessment and Business Impact Analysis (BIA)
Often the most conceptually dense pair, because candidates must separate the two analyses clearly.
- How risk assessment differs from BIA in purpose and output
- Recovery-time thinking, dependencies, and prioritization of activities
- What evidence an auditor would look for to confirm each was done properly
Continuity Strategies and Solutions; Business Continuity Plans
Scenario-heavy territory where several answer choices can look plausible.
- Matching strategies to BIA results rather than to preference
- Plan content, activation, roles, and communications
Education and Training; Exercise Program
Generally manageable, but candidates who skim them lose easy points.
- Awareness versus competence, and how an auditor verifies each
- Exercise types, objectives, post-exercise review, and improvement actions
Audit Findings, Recommendations, and Auditor's Opinion
Where the auditor identity is tested most directly.
- Distinguishing a finding from an observation or recommendation
- Forming a defensible opinion supported by evidence
Who Finds It Easier and Who Struggles
The audit course can be taken without a previous DRI certification, which means the candidate pool is mixed. Roughly speaking, the experience falls into three patterns.
- Internal or external auditors new to continuity: comfortable with evidence, sampling, and findings language, but they must learn BIA, strategies, and exercise concepts from scratch.
- Continuity planners new to auditing: fluent in plans and exercises, but they often miss the evidence-and-conformity framing that drives many questions.
- Risk, compliance, or ISO management-system professionals: familiar with clause-based standards, so ISO 22301 structure comes quickly, though continuity-specific technique may need reinforcement.
Certain existing professional designations can qualify for waivers in the reference or experience sections of the application. That is not a blanket waiver of the audit course, the exam, or the CBCA experience requirement, so verify specifics with DRI before assuming you are exempt.
The Cost of Getting It Wrong
Difficulty is partly a function of stakes. The published figures make the financial picture fairly clear.
| Item | Published Amount (US) |
|---|---|
| BCLE AUD course with first exam included (ISO 22301 or NFPA 1600) | $2,950 |
| CBCA certification application | $400 |
| Training-plus-application subtotal | $3,350 |
| Audit-exam retake | $250 |
| Annual renewal | $225 |
The $3,350 subtotal is calculated from the course and application fees and excludes renewal, travel, taxes, and discounts. DRI's FAQ advertises a 10% discount for NFPA and other professional-organization members but does not identify every qualifying organization or show a discounted checkout total, so confirm eligibility directly. For the full picture, see our CBCA certification cost breakdown.
Key Takeaway
Because the first exam is bundled into the course price and a retake is $250, the financial penalty for a first-attempt miss is modest compared with the cost of the course. The larger cost of failure is time and momentum, so prepare to pass once but do not treat a single miss as catastrophic.
A Preparation Sequence Built Around the ISO 22301 Course
You attend the course first, so your preparation naturally splits into pre-course, in-course, and post-course phases. Here is one sequence that ties each phase to a specific CBCA topic rather than to generic study habits. Scheduling details for the exam itself have shifted in DRI's wording, so confirm your window using our guide to CBCA exam dates and scheduling and your course-specific booking instructions.
Read the standard first
- Skim ISO 22301:2019 so clause language is not new on day one
- Learn audit vocabulary: evidence, nonconformity, observation, opinion
Four instructional days
- Take notes on how the case study ties BIA outputs to strategy choices
- Mark every instance where the instructor distinguishes similar terms
Risk assessment and BIA
- Rebuild the difference between the two analyses from memory
- Study these first because later domains depend on them
Strategies, plans, training, exercises
- Connect each strategy to the BIA result that justifies it
- Review exercise types and what an auditor checks afterward
Findings, opinion, and full review
- Practice classifying findings versus recommendations
- Run timed sets sized to the 100-question, 150-minute format
For a broader roadmap beyond this sequence, our CBCA study guide covers the full approach, and a condensed CBCA cheat sheet is useful for final-week review.
Practicing Without Breaking Confidentiality
Candidates must keep DRI course and exam materials confidential. That has a practical consequence: do not trade remembered exam questions or share course handouts in study groups. Build your practice from independently written questions that test the same concepts, such as asking yourself to justify why a described control would or would not satisfy a particular ISO 22301 requirement.
The CBCA Exam Prep practice test site offers original practice questions written independently rather than reproduced from DRI materials. Timed sets there help you test whether you can hold the 75% line under the same pace you will face on the real exam. If you want to check how you handle mixed-topic questions before booking, you can start with a free practice session.
Is the Difficulty Worth the Payoff?
The CBCA is a niche credential aimed at people who assess business continuity programs rather than only build them. Typical employers include organizations with formal continuity management systems, consultancies that audit against ISO 22301, and internal audit or risk functions that review resilience controls. Specific salary figures are not verified here, so we avoid quoting any; see our CBCA salary guide and CBCA jobs overview for context on roles.
Keep in mind that holding the designation carries ongoing obligations: a $225 annual fee, 80 CEAPs over each two-year continuing-education period, and compliance with DRI's code of ethics. It is not an unconditional two-year credential. Weigh that against your goals using our ROI analysis of whether the CBCA is worth it. If you are still orienting yourself, start with what CBCA certification is.
Frequently Asked Questions
It is moderate in format, with 100 multiple-choice questions and a 75% requirement, but the real difficulty lies in the auditor's evidence-based mindset and the surrounding application. Because DRI publishes no pass rate, any precise difficulty ranking is an opinion rather than a verified statistic.
DRI does not publicly disclose a pass rate for this examination. The 75% figure is the score each candidate must reach, not the share of candidates who pass. Treat any quoted pass percentage with caution unless it cites DRI directly.
Yes. Completing the four-day BCLE AUD course, which awards 32 CEAPs, is required before the Audit Examination. The course price of $2,950 includes the first exam attempt.
An audit-exam retake is listed at $250. Confirm current retake timing and booking steps through your DRI account, since scheduling details can change.
No. Passing the exam alone does not confer certification. You must also submit an application showing at least two years of qualifying experience within the preceding ten years, five subject-matter essays, and validating references, and the application fee is $400.