Establishing governance for a new Business Continuity Management System (BCMS) is an iterative process because:

CBCI 7.0 emphasizes that establishing and operating a BCMS is not static; it is “an iterative journey of continual improvement over time.” Governance—roles, responsibilities, accountabilities, and authorities—must therefore mature as the organization learns what is required to run the BCMS effectively across policy, analysis, solutions, enablement, and validation. Early in development, organizations often start with a high-level governance model and then refine it as scope, priorities, dependencies, and response structures become clearer through BIA/RA outputs, strategy decisions, and early plan development. This is why option B is correct: the organization may not fully understand all governance requirements at the beginning and must revise them over time.

Option A is too narrow: governance refinement does not depend solely on completing a first exercise; it evolves throughout implementation. Option C may be true in some organizations, but “time-consuming approval” is not the fundamental reason governance is iterative. Option D (training) supports competence, but training alone doesn’t explain why governance structures themselves must be revisited and adjusted as the BCMS develops.