Explanation
The key areas of exercise are organisation and plans. According to the ISO 22301 Auditing eBook1, an exercise is a process to train for, assess, practice, and improve performance in an organization. The purpose of an exercise is to evaluate the organization's capability to respond to a disruptive incident and implement its business continuity plans. Therefore, the key areas of exercise are the organization itself, which includes its structure, roles, responsibilities, resources, and culture, and the plans that define the objectives, scope, scenarios, procedures, and evaluation criteria of the exercise. These two areas are essential to ensure that the exercise is realistic, relevant, effective, and aligned with the organization's business continuity objectives and expectations. References:
ISO 22301 Auditing eBook, page 71
ISO 22301:2019, clause 8.5

Explanation
Support does not lay out the foundation of planning and managing the BCMS, but rather provides the necessary resources and arrangements to enable the effective operation of the BCMS. Support includes aspects such as competence, awareness, communication, documented information, and organizational knowledge. The foundation of planning and managing the BCMS is laid out by the leadership and planning clauses of ISO
22301, which define the roles and responsibilities, policies, objectives, and actions to address risks and opportunities for the BCMS. References: ISO 22301 Auditing eBook, page 15 1; ISO 22301:2019, clauses 5,
6, and 7 2

Explanation
According to ISO 22301 Lead Auditor objectives and content, the communication structure for managing information between various groups of stakeholders in the organization should include both internal and external communication. Internal communication refers to the exchange of information and messages within the organization, such as between employees, managers, and business continuity teams. External communication refers to the exchange of information and messages with parties outside the organization, such as customers, suppliers, regulators, media, and the public. Both types of communication are essential for ensuring the effective operation of the business continuity management system (BCMS) and the successful response and recovery from disruptions. The communication structure should be aligned with the organization's communication strategy, which should identify the communication needs, define the communication channels, and establish the communication procedures for the BCMS. The communication structure should also consider the unique communication requirements that may arise during a disruption, such as timely and accurate information, alternative communication channels, and managing rumours and misinformation. References: ISO 22301 Auditing eBook, page 291; ISO 22301 Clause 7.4 Communication2

Explanation
A management system is an integrated set of processes and tools that an organization uses to develop its strategy, transform it into actions, and monitor and evaluate its performance and effectiveness. A management system helps an organization to achieve its objectives and continually improve its performance.