- What CBCA Actually Means
- Two Gates: The Course Exam and the Experience Application
- The Audit Examination at a Glance
- Cost and Registration Mechanics
- What a Candidate Must Master: The Eleven Topic Areas
- The Version and Route Trap
- Who Uses the Credential and What It Signals
- Keeping the Credential Active
- Sequencing Preparation Around the Course
- Frequently Asked Questions
- CBCA means Certified Business Continuity Auditor, issued by DRI International, and it is separate from every other credential sharing the acronym.
- Passing the 100-question audit exam (75% minimum) does not confer certification; DRI also reviews an experience-based application.
- The published course-and-exam price is $2,950, plus a $400 application fee, for a $3,350 subtotal before renewal or taxes.
- Renewal combines a $225 annual fee with 80 CEAPs per two-year period and adherence to DRI's code of ethics.
What CBCA Actually Means
CBCA stands for Certified Business Continuity Auditor. It is a professional designation awarded by DRI International (the Disaster Recovery Institute International), one of the long-established certifying bodies in the resilience and business continuity field. The credential targets people who evaluate continuity programs rather than only build them: professionals who examine whether an organization's business continuity management system (BCMS) is sound, conforming, and effective, and who can express a defensible auditor's opinion about it.
The acronym is shared by several unrelated credentials in other fields, which is a frequent source of confusion in search results. Everything on this page concerns the DRI designation only. If you are searching for variants of this question, our related explainers cover the same ground from different angles, including what CBCA stands for, the meaning of the CBCA designation, and the broader overview at What Is CBCA?.
Two Gates: The Course Exam and the Experience Application
The single most important structural fact about CBCA is that it has two separate gates. Many candidates assume that passing an exam is the whole story. It is not.
Gate one: the audit course and examination
Before sitting the Audit Examination, you complete DRI's Business Continuity Planning for Auditors course (referenced as BCLE AUD). Current US courses run four full instructional days and award 32 Continuing Education Activity Points (CEAPs). The course is offered in two flavors: one built around ISO 22301 and one built around NFPA 1600. You can take the course without holding any previous DRI certification, which makes it a legitimate entry point for people new to DRI.
Gate two: the experience-based application
Passing the course examination alone does not confer professional certification. To actually earn the CBCA designation, DRI reviews an application that requires:
- At least two years of significant practical experience in business continuity, emergency or disaster management, and/or audit within the preceding ten years.
- Five subject-matter essays, with at least two drawn from DRI's specified application areas covering business impact analysis, continuity strategies, plan development and implementation, and exercise, test, assessment and maintenance.
- Two validating references per subject area; the same two people may serve across all five areas.
No degree requirement and no fixed experience-hour threshold were found in the reviewed sources. Certain existing professional designations can earn waivers for the reference or experience sections of the application, but this is not a blanket waiver: the audit course, the exam, and the CBCA experience requirement still apply. For a full walk-through, see CBCA Requirements: Eligibility, Prerequisites & How to Qualify.
The Audit Examination at a Glance
| Attribute | CBCA Audit Examination |
|---|---|
| Issuer / administrator | DRI International, through its own online examination and account process |
| Questions | 100 multiple-choice |
| Time allowed | 2 hours 30 minutes |
| Minimum passing score | At least 75% |
| Delivery | Online, following course registration through your DRI account |
| Prerequisite | Completion of the BCLE AUD audit course |
| Retake fee | $250 |
A few clarifications prevent common misunderstandings:
- The 75% figure is a required individual score, not a statistic. It tells you the bar you must clear; it says nothing about how many candidates clear it. DRI does not publicly disclose a CBCA pass rate, and general business-continuity pass-rate claims from training marketers are not CBCA cohort data. See CBCA Passing Score: Exactly What You Need to Pass and CBCA Pass Rate: What the Data Shows for how to interpret this honestly.
- A scored versus unscored question breakdown is not publicly specified. Do not assume a number of unscored pilot items.
- Rules for open-book status, calculators, remote proctoring, and permitted references could not be verified publicly. Confirm all of these in your DRI account and course instructions rather than assuming conventions from other exams.
- Timing instructions have shifted. Current course descriptions say the exam is taken online after the course at your convenience, while an older FAQ sentence still refers to the final course day. Follow the course-specific booking instructions. For scheduling detail, see CBCA Exam Dates: Testing Windows, Deadlines & Scheduling.
If you want to gauge the difficulty before committing, How Hard Is the CBCA Exam? breaks down what makes the audit-focused question style demanding for planners who have never audited.
Cost and Registration Mechanics
CBCA pricing is unusual because the exam is bundled with a mandatory course instead of being sold as a standalone sitting.
| Item | Published US amount |
|---|---|
| Course plus first exam (BCLE AUD, ISO 22301 or NFPA 1600) | $2,950 |
| Certification application | $400 |
| Training-plus-application subtotal | $3,350 |
| Annual renewal | $225 |
| Audit-exam retake | $250 |
Key points on the money side:
- The first exam attempt is included in the $2,950 course price. It is not an additional $750 or any other separate charge.
- The $3,350 subtotal is simply the course price plus the application fee. It excludes renewal, travel, taxes, and any discounts.
- DRI's continuity-audit FAQ advertises a 10% discount for NFPA and other professional-organization members, but it does not list every qualifying organization or show a discounted checkout total. Treat eligibility and the final amount as something to confirm directly with DRI before you pay.
- No separate member and nonmember exam-only price is published for this mandatory-course route.
A line-by-line view of budgeting, including what to plan for beyond the headline numbers, is in CBCA Certification Cost: Complete Pricing Breakdown.
What a Candidate Must Master: The Eleven Topic Areas
DRI does not publish a weighted exam blueprint for the Audit Examination, so no official percentages exist to memorize. What candidates can do is prepare against the substantive headings of DRI's current ISO 22301 audit-course outline. The eleven areas below are course preparation topics, not an official or exhaustive exam specification, and the order and emphasis on test day may differ. Our CBCA Exam Domains guide expands on each one.
Auditing basics
The foundation: what auditing is, how it differs from consulting or planning, and how an audit is structured.
- Evidence gathering and objective evaluation against criteria
- Auditor independence and professional conduct
- Planning, conducting, and reporting an audit
Understanding ISO 22301
The standard that anchors the ISO route. Candidates need to read it like an auditor: as a set of requirements against which conformity is judged. Note that the current HTML course heading says "Understanding ISO 22301," while the linked brochure says "Introduction to ISO22301"; this is a wording difference, not an extra topic.
- Structure and intent of the standard's requirements
- Distinguishing mandatory requirements from supporting guidance
Context of the organization
How the organization's internal and external environment, stakeholders, and scope shape the management system.
- Interested parties and their requirements
- Defining and justifying the BCMS scope
Leadership, planning, support, and operation
The management-system clauses an auditor tests for evidence of commitment, resourcing, and operational control.
- Top-management commitment and policy
- Roles, resources, competence, awareness, and documented information
- Operational planning and control
Risk assessment
How threats and vulnerabilities to prioritized activities are identified, analyzed, and evaluated, and how an auditor verifies that process is real rather than paper-only.
Business impact analysis (BIA)
The analysis that identifies critical activities and the consequences of disruption over time. Auditors check that BIA outputs are credible and actually drive downstream decisions.
- Prioritized activities and impact over time
- Recovery time objectives and dependencies
Continuity strategies and solutions
How the organization chooses and resources its response options, and whether those choices trace back to BIA and risk results.
Business continuity plans
The plans and procedures themselves: whether they are actionable, current, and aligned to the strategies they are meant to execute.
Education and training
Evidence that people know their roles. Auditors look for awareness and competence records, not just attendance sheets.
Exercise program
Whether the organization tests its capability on a planned basis, records results, and acts on lessons learned.
Audit findings, recommendations, and auditor's opinion
The capstone skill and the one that most distinguishes this credential: converting evidence into classified findings, practical recommendations, and a supportable opinion.
- Distinguishing conformity, nonconformity, and opportunities for improvement
- Linking each finding to specific evidence and criteria
The Version and Route Trap
Candidates frequently study the wrong material because several look-alike DRI examinations exist. Keep these distinctions straight:
- Audit Examination, ISO route: DRI's specialty-exam catalogue labels it "2023 Audit Exam - ISO 22301," and the current course references ISO 22301:2019.
- Audit Examination, NFPA route: This references NFPA 1600, 2019 edition, and is listed without a separate version year.
- Not the same thing: DRI also offers a general qualifying examination (a 2026 version exists). That is a different exam and must not be substituted for the audit examination.
Preparation guidance on this site is limited to the ISO 22301 route. Coverage of the NFPA 1600 route is not established here, so if you intend to take that version, rely on DRI's own course materials for it. A newer weighted blueprint for CBCA was not found.
Who Uses the Credential and What It Signals
The CBCA is relevant wherever an organization needs independent assurance that its continuity arrangements are credible. Typical holders and users include:
- Business continuity and resilience managers who want to move from building programs to assessing them.
- Internal auditors adding continuity expertise to an assurance portfolio.
- Risk, compliance, and governance professionals who review third-party or internal BCMS conformity.
- Consultants and assessors who evaluate clients against ISO 22301 or NFPA 1600.
- Emergency and disaster management practitioners whose experience qualifies under the application's experience pathway.
The credential signals two things at once: that you completed a structured audit-methodology course tied to a recognized standard, and that DRI has independently reviewed your practical experience and essays. Because those are separate verifications, employers can treat it as stronger evidence than a course certificate alone. Specific salary figures are not published in the sources behind this article, so we avoid quoting any; for qualitative discussion of earning potential and role mix, see CBCA Salary Guide, CBCA Jobs, and Is the CBCA Certification Worth It?.
Keeping the Credential Active
CBCA is not a one-time achievement. Maintenance has distinct parts that are easy to conflate:
- Annual fee: $225 per year.
- Continuing education: 80 CEAPs across each two-year continuing-education period.
- Ethics: Ongoing compliance with DRI's code of ethics.
Do not describe it as an unconditional two-year credential. The two-year window applies to the CEAP requirement, while the financial maintenance is annual. The 32 CEAPs earned from the four-day audit course are a useful early contribution to that cycle.
Sequencing Preparation Around the Course
Because the exam follows a four-day instructor-led course, preparation naturally splits into before, during, and after. One simple structure, tied to the eleven topic areas above, keeps you from treating the material as an undifferentiated block. Adjust the timing to your own exam-booking window.
Read the standard first
- Skim ISO 22301:2019 so "Understanding ISO 22301" and "Context of the organization" are not new vocabulary
- Refresh BIA and risk concepts if you have not used them recently
Capture audit logic, not just content
- Note how each case-study activity turns evidence into a finding
- Keep DRI course and exam materials confidential; do not copy or share them
Drill the back half hardest
- Revisit BIA, strategies, plans, training, and exercise as a connected chain
- Finish with findings, recommendations, and auditor's opinion, since it depends on everything before it
Write your own practice questions from your own notes rather than seeking leaked items. A full preparation approach is laid out in the CBCA Study Guide, and the CBCA Cheat Sheet condenses the facts above into a single review page. When you are ready to test recall under realistic conditions, the CBCA practice tests on our main site let you rehearse scenario-based items on every topic area, and our CBCA training overview explains how the course component fits into your plan.
Key Takeaway
Treat the exam and the application as two projects. Start gathering your experience examples, essay subjects, and reference contacts early, because the application is where many otherwise-qualified candidates stall.
Frequently Asked Questions
It stands for Certified Business Continuity Auditor, a designation from DRI International. It is unrelated to other credentials that happen to share the same abbreviation.
No. Passing the audit examination alone does not confer certification. DRI also reviews an experience-based application, including at least two years of relevant experience within ten years, five essays, and validating references.
The published US course-and-exam price is $2,950, which includes the first exam attempt, and the application is $400, for a $3,350 subtotal. Renewal is $225 annually and a retake is $250. Taxes, travel, and any discount are extra or unconfirmed.
The Audit Examination has 100 multiple-choice questions in 2 hours 30 minutes, and you need at least 75%. DRI does not publish a pass rate or a weighted domain blueprint.
No. The audit course may be taken without a previous DRI certification, although earning the CBCA designation itself still requires meeting the application's experience, essay, and reference requirements.
For a deeper look at how this credential is defined and described across the site, you can also read CBCA Certification and What Is CBCA Certification?.