- The Short Answer: Certified Business Continuity Auditor
- Who Issues the Credential
- What the "Auditor" Part Really Means
- Course Plus Application: Two Separate Hurdles
- The Examination at a Glance
- Eleven Topics That Define Preparation
- What the Name Costs You
- Where the Title Gets Used
- A Domain-Ordered Preparation Sequence
- Frequently Asked Questions
- CBCA stands for Certified Business Continuity Auditor, a credential governed by DRI International.
- Passing the 100-question, 2 hour 30 minute exam at 75% or higher does not alone confer certification.
- A separate DRI application needs two years of experience, five subject-matter essays, and validating references.
- The published course-plus-application subtotal is $3,350: $2,950 for the course and exam, $400 for the application.
The Short Answer: Certified Business Continuity Auditor
CBCA stands for Certified Business Continuity Auditor. Many acronyms in the credential world are shared by unrelated designations, so it is worth being precise: on this site, and throughout this article, CBCA refers only to the business continuity audit credential offered through DRI International. It is not a finance, valuation, or accounting designation, and facts about other credentials with similar abbreviations do not apply here.
The three words in the title each carry weight. Certified signals that a credentialing body has reviewed both your knowledge and your experience. Business Continuity places the discipline: planning for the continued delivery of an organization's products and services through disruption. Auditor narrows the focus to the person who evaluates a continuity program rather than the person who builds or runs it.
If you are looking for broader orientation, our related explainers cover the basic definition of CBCA, the meaning behind the acronym, and an overview of the CBCA certification. This article concentrates on what the name tells you about the exam and the path to earning it.
Who Issues the Credential
The governing body is DRI International, formerly the Disaster Recovery Institute International. The official designation is Certified Business Continuity Auditor, and DRI administers the audit examination through its own online examination and account process. No external proctoring vendor such as Pearson VUE, PSI, or Prometric has been verified for this particular examination, so candidates should rely on DRI's course-specific booking instructions rather than assuming a third-party test center appointment.
What the "Auditor" Part Really Means
The distinguishing word in the title is Auditor. A continuity planner asks, "How do we recover?" A continuity auditor asks, "Can this organization demonstrate that its program meets a defined standard, and is the evidence sound?" That shift in perspective shapes everything from the course content to the style of questions you should expect.
The current DRI audit course is built around the ISO 22301 standard (the course references the 2019 edition), and a parallel route exists for NFPA 1600 (2019 edition). This site's preparation material targets the ISO 22301 route specifically; the NFPA 1600 route is a separate course and exam, and coverage of it should not be assumed from this article.
What an auditor evaluates
- Whether the organization understands its own context and the needs of interested parties
- Whether leadership commitment, planning, support, and operational controls are documented and actually working
- Whether risk assessment and business impact analysis feed logically into strategy selection
- Whether plans, training, and exercises produce evidence that the program functions
- Whether findings and recommendations are clear enough for management to act on
That list closely mirrors the eleven topics we outline later, and it explains why candidates with a purely hands-on planning background sometimes find the auditing vocabulary and evidence mindset the more unfamiliar part of the material.
Course Plus Application: Two Separate Hurdles
This is the single most misunderstood aspect of the credential. According to DRI, passing the course examination alone does not confer professional certification. There are two distinct components, and you need both.
| Component | What It Involves |
|---|---|
| Audit course and exam | Completion of the Business Continuity Planning for Auditors (BCLE AUD) course, currently four full instructional days awarding 32 Continuing Education Activity Points (CEAPs), followed by a 100-question multiple-choice Audit Examination |
| Certification application | At least two years of significant practical experience in business continuity, emergency/disaster management, and/or audit within the preceding ten years; five subject-matter essays; two validating references per subject area |
A few details deserve emphasis:
- The course may be taken without any previous DRI certification, so it can serve as an entry point.
- The five subject-matter essays belong to the application, not the exam. The 100-question exam itself is multiple choice. The case study and practical auditing activities inside the course are classroom learning exercises, not a performance-based or essay test.
- At least two essays must come from DRI's specified application areas, which cover business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment, and maintenance.
- The same two people may validate your experience across all five subject areas.
- Certain existing professional designations can qualify for reference or experience-section waivers, but this is not a blanket waiver of the course, the exam, or the CBCA experience requirement. No degree requirement or fixed experience-hour threshold was found.
For a fuller walk-through of eligibility, see our guide to CBCA requirements and how to qualify.
The Examination at a Glance
| Detail | CBCA Audit Examination |
|---|---|
| Format | Multiple choice |
| Number of questions | 100 (scored/unscored breakdown not publicly specified) |
| Time allowed | 2 hours 30 minutes |
| Passing score | At least 75% |
| Delivery | Online through your DRI account after course registration |
| Published pass rate | Not publicly disclosed |
| Retake fee | $250 |
Two clarifications prevent common confusion. First, the 75% figure is the required individual score, not an observed pass rate; DRI has not published how many candidates pass. If you see a pass-rate number attached to CBCA, treat it with suspicion, and read our analysis of what data does and does not exist. Second, scheduling language has varied: current course descriptions say the exam is taken online after the course at the learner's convenience, while an FAQ sentence still references the final course day. Follow the current course-specific booking instructions. Our page on exam dates and scheduling covers the practical side, and the passing score breakdown explains the threshold in more depth.
Eleven Topics That Define Preparation
DRI has not publicly verified an official weighted blueprint for the audit examination, so no domain percentages are published here. What we can offer is a set of eleven substantive headings drawn from DRI's current ISO 22301 audit-course outline. These are issuer-course preparation topics, not an official or exhaustive exam blueprint, and the allocation of practice effort below is editorial. For a topic-by-topic walkthrough, see our guide to all 11 content areas.
1. Auditing basics
The foundation: what an audit is, how evidence is gathered, and how auditor conduct and objectivity shape credible conclusions.
- Audit evidence versus opinion
- Planning and conducting an audit engagement
2. Understanding ISO 22301
The standard itself, the yardstick against which a continuity management system is judged. (The course's HTML heading reads "Understanding ISO 22301," while a linked brochure says "Introduction to ISO22301"; this is a wording difference, not an extra topic.)
- Structure and intent of the standard
- How clauses translate into auditable requirements
3. Context of the organization
How an organization's internal and external environment, interested parties, and scope define what the program must address.
4. Leadership, planning, support, and operation
Management commitment, policy, objectives, resources, competence, and the operational controls that make the system real rather than paper-only.
5. Risk assessment
How threats and vulnerabilities are identified and evaluated, and how an auditor tests whether the method is sound and consistently applied.
6. Business impact analysis (BIA)
Impact over time, prioritized activities, and recovery objectives, along with the dependencies an auditor expects to see traced.
7. Continuity strategies and solutions
Whether chosen strategies logically follow from the BIA and risk results and are proportionate to the organization's needs.
8. Business continuity plans
Plan content, activation, roles, and communication, assessed for completeness and fitness for use during a real disruption.
9. Education and training
Awareness and competence programs, and the records that demonstrate people actually know their roles.
10. Exercise program
Exercise design, frequency, evaluation, and how results feed corrective action and continual improvement.
11. Audit findings, recommendations, and auditor's opinion
Classifying findings, writing actionable recommendations, and forming a supportable overall opinion.
Notice the arc. The first two topics establish how to audit and what to audit against; topics three through ten follow the lifecycle of a continuity program; the last topic is where everything becomes a report. Questions that ask you to connect, for example, a weak BIA to a poorly justified strategy reward candidates who understand this chain rather than memorizing clause numbers. Our CBCA study guide and one-page cheat sheet are useful companions once you have the structure clear.
What the Name Costs You
The published US pricing is straightforward, though several items sit outside the headline numbers.
| Item | Published Amount |
|---|---|
| Course and first exam (BCLE AUD, ISO 22301 or NFPA 1600) | $2,950 |
| Certification application | $400 |
| Training-plus-application subtotal | $3,350 |
| Audit-exam retake | $250 |
| Annual renewal | $225 |
The first exam attempt is included in the course price, so there is no additional $750 exam charge. The $3,350 subtotal is simply the course and application fees added together, before renewal, travel, taxes, or any discounts. DRI's Continuity Audit FAQ mentions a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a current discounted checkout total, so eligibility and the final amount need confirmation with DRI. No separate member or nonmember exam-only price is published for this mandatory-course route. Our complete pricing breakdown goes deeper.
Keeping the credential current
Maintenance has two distinct layers that are easy to blur together: an annual fee of $225, and a requirement of 80 CEAPs over each two-year continuing-education period, along with compliance with DRI's code of ethics. It is not an unconditional two-year credential, so budget for both the yearly fee and ongoing professional development.
Where the Title Gets Used
The word "Auditor" in the title points to the roles where it carries the most weight: positions that review, assess, or assure continuity programs rather than only operate them. Typical settings include internal audit and risk functions, compliance and governance teams, consulting practices that perform continuity program assessments, and business continuity or resilience offices that must demonstrate conformity to a standard such as ISO 22301.
We do not cite salary figures here because no verified earnings data for this specific credential is available to us. If you are weighing the return on the roughly $3,350 published outlay, read our discussions of whether the certification is worth it, the earnings picture, and the kinds of CBCA jobs where the credential appears.
Key Takeaway
Because the credential bundles a mandatory course, an exam, and an experience-based application, its value is strongest for professionals who already have continuity or audit experience and want formal recognition of audit capability, not for those hoping the exam alone will open doors.
A Domain-Ordered Preparation Sequence
Rather than generic scheduling, sequence your effort by the logic of the audit lifecycle. This sample plan assumes you have already completed the DRI course, which is a prerequisite for the exam, and are consolidating before your attempt. Adjust the pacing to your own calendar.
Frame the audit
- Auditing basics and Understanding ISO 22301
- Practice distinguishing evidence from opinion
Context and governance
- Context of the organization
- Leadership, planning, support, and operation
The analytical core
- Risk assessment and business impact analysis
- Trace how BIA outputs justify continuity strategies and solutions
Readiness and reporting
- Business continuity plans, education and training, exercise program
- Audit findings, recommendations, and auditor's opinion; full-length timed practice
The reasoning: the analytical core in week three is where chained questions are most likely to appear, so it gets a dedicated block after the framing material is solid. Finishing with findings and opinion mirrors how a real audit ends. Use independently written practice questions only; DRI course and exam materials are confidential, and reproducing them would be inappropriate. You can work through original items on our CBCA practice test site, and for a realistic sense of effort, see how hard the exam is.
Frequently Asked Questions
CBCA stands for Certified Business Continuity Auditor, a credential associated with DRI International. For more phrasing variations, see our pages on what CBCA stands for and what CBCA means.
No. DRI states that passing the course examination alone does not confer professional certification. You must also submit an experience-based application with essays and validating references. Details are in our guide to what CBCA certification involves.
The Audit Examination has 100 multiple-choice questions to be completed in 2 hours 30 minutes, and a score of at least 75% is required. A scored/unscored breakdown is not publicly specified.
Yes. Completion of the Business Continuity Planning for Auditors (BCLE AUD) route is required before the Audit Examination. The current US course runs four full instructional days and awards 32 CEAPs, and it can be taken without a prior DRI certification. See our overview of CBCA training for more.
No. Several unrelated credentials share the CBCA letters. This article and this site refer solely to the Certified Business Continuity Auditor credential, so fees, requirements, and exam details here should not be compared with any other designation.
Knowing exactly what the letters stand for is the first step toward judging whether the credential fits your career. If it does, begin with the course, confirm current details directly with DRI, and build your preparation around the audit lifecycle covered above.