ISO 22313:2020 - Guidance on Business Continuity Management Systems

Guidance on reacting to nonconformities, evaluating the need for corrective action, and implementing changes.

• Updated process documentation
• Innovation maturity reassessment
• Root cause analysis records

• Feedback loops from operations back to strategy missing
• Lessons learned stored but never reused
• Corrective actions closed without verifying effectiveness
• Root cause analysis stops at symptom level
• Maturity reassessment skipped year over year

Guidance on continually improving the suitability, adequacy, and effectiveness of the BCMS.

• Root cause analysis records
• Retrospective and post-mortem notes
• Lessons learned reports
• Process improvement proposals tracker
• Updated process documentation
• Continual improvement register

• Corrective actions closed without verifying effectiveness
• Root cause analysis stops at symptom level
• Lessons learned stored but never reused
• Improvement register stale, items older than 12 months unactioned

Guidance on reviewing strategic objectives, internal and external issues, and their relevance to business continuity.

• Competitor innovation benchmark
• IMS scope statement signed by leadership
• Market and technology radar

• Internal capability gaps not assessed against strategy
• Stakeholder map omits external innovation partners (universities, startups)
• Context analysis treated as one-off, not refreshed annually
• Trend scanning is ad hoc and undocumented
• Innovation maturity baseline never established

Guidance on identifying stakeholders and understanding their requirements related to business continuity.

• Innovation context register
• PESTEL/SWOT analysis covering innovation landscape
• Trend and foresight scan report
• IMS scope statement signed by leadership

• Stakeholder map omits external innovation partners (universities, startups)
• Innovation maturity baseline never established
• Internal capability gaps not assessed against strategy
• Trend scanning is ad hoc and undocumented
• Strategic intelligence not feeding into innovation decisions

Guidance on defining the boundaries and applicability of the business continuity management system.

• Innovation maturity baseline assessment
• Strategic intelligence brief
• Interested-party requirements log
• Stakeholder map with innovation interests
• PESTEL/SWOT analysis covering innovation landscape

• IMS scope undefined or inconsistent across business units
• Stakeholder map omits external innovation partners (universities, startups)
• Trend scanning is ad hoc and undocumented

Guidance on establishing, implementing, maintaining, and continually improving a BCMS in accordance with ISO 22301.

• Strategic intelligence brief
• IMS scope statement signed by leadership
• Innovation maturity baseline assessment
• PESTEL/SWOT analysis covering innovation landscape
• Market and technology radar

• Stakeholder map omits external innovation partners (universities, startups)
• IMS scope undefined or inconsistent across business units
• Strategic intelligence not feeding into innovation decisions
• Context analysis treated as one-off, not refreshed annually
• Trend scanning is ad hoc and undocumented

Guidance on how top management should demonstrate leadership and commitment to the BCMS.

• Board minutes referencing innovation strategy
• Leadership innovation commitments register
• Strategic alignment matrix linking innovation to business goals
• Innovation council terms of reference
• RACI for innovation roles
• Innovation vision and strategy document

• Innovation strategy disconnected from corporate strategy
• Roles and responsibilities for innovation undefined
• Culture barriers to risk-taking not addressed by leadership
• Executive sponsorship limited to lip service, no time committed

Guidance on establishing a business continuity policy that is appropriate to the organization's purpose.

• Strategic alignment matrix linking innovation to business goals
• Board minutes referencing innovation strategy
• Approved innovation policy
• Innovation vision and strategy document
• Executive innovation charter

• Roles and responsibilities for innovation undefined
• No clear accountability for innovation outcomes
• Executive sponsorship limited to lip service, no time committed

Guidance on assigning and communicating management roles and responsibilities within the BCMS.

• RACI for innovation roles
• Innovation governance framework
• Strategic alignment matrix linking innovation to business goals
• Leadership innovation commitments register
• Executive innovation charter

• Executive sponsorship limited to lip service, no time committed
• No clear accountability for innovation outcomes
• Innovation strategy disconnected from corporate strategy
• Governance forum lacks decision-making authority

Guidance on determining risks and opportunities that need to be addressed to ensure the BCMS can achieve its intended outcomes.

• Innovation objectives with measurable targets
• Change management plan for innovation initiatives
• Innovation portfolio dashboard
• Resource allocation plan
• Portfolio balancing model (horizons 1/2/3)
• Innovation roadmap

• Risk treatment plans absent for high-uncertainty bets
• Initiative prioritisation done by HiPPO not criteria
• Roadmap not updated when strategy changes
• Innovation objectives lack measurable targets

Guidance on setting measurable BC objectives and establishing plans with responsibilities, timeframes, and resources.

• Innovation portfolio dashboard
• Opportunity and risk register
• Initiative prioritisation scorecard
• Innovation roadmap

• Risk treatment plans absent for high-uncertainty bets
• Opportunities and risks tracked separately with no link to objectives
• No resource plan tied to portfolio priorities
• Innovation objectives lack measurable targets

Guidance on managing changes to the business continuity management system in a planned manner.

• Opportunity and risk register
• Resource allocation plan
• Portfolio balancing model (horizons 1/2/3)
• Innovation roadmap

• Opportunities and risks tracked separately with no link to objectives
• No resource plan tied to portfolio priorities
• Portfolio biased toward horizon 1 incremental projects
• Roadmap not updated when strategy changes

Guidance on determining and providing resources needed for the establishment, implementation, and improvement of the BCMS.

• Resource and budget plan for innovation
• Communication plan (internal/external)
• Competence matrix for innovation roles
• IP register and assignment agreements
• Training records and learning paths
• Innovation tools and methods catalogue

• Innovation budget not ring-fenced from operating budget
• Competence requirements for innovation roles not defined
• Strategic intelligence siloed in one team
• Tools and methods inconsistent across teams
• Knowledge from past projects not captured or reused

Guidance on ensuring personnel performing BC functions have the necessary competence through education, training, or experience.

• Strategic intelligence repository
• Training records and learning paths
• Communication plan (internal/external)
• IP register and assignment agreements
• Time-allocation policy (e.g., 10% innovation time)

• Strategic intelligence siloed in one team
• Knowledge from past projects not captured or reused
• Competence requirements for innovation roles not defined

Guidance on ensuring personnel are aware of the BC policy, their contribution to the BCMS, and implications of non-conformance.

• Training records and learning paths
• IP register and assignment agreements
• Document control register for IMS
• Partnership and collaboration agreements

• IP register incomplete, ownership disputes likely
• Knowledge from past projects not captured or reused
• Strategic intelligence siloed in one team

Guidance on determining internal and external communication requirements related to the BCMS.

• Training records and learning paths
• Document control register for IMS
• IP register and assignment agreements
• Partnership and collaboration agreements
• Innovation infrastructure inventory
• Time-allocation policy (e.g., 10% innovation time)

• Partnership agreements lack IP and confidentiality clauses
• Strategic intelligence siloed in one team
• IP register incomplete, ownership disputes likely
• Tools and methods inconsistent across teams
• Innovation budget not ring-fenced from operating budget

Guidance on the creation, updating, and control of documented information required by the BCMS.

• Partnership and collaboration agreements
• Time-allocation policy (e.g., 10% innovation time)
• Knowledge repository / lessons learned database
• Innovation infrastructure inventory
• Document control register for IMS

• Innovation budget not ring-fenced from operating budget
• Competence requirements for innovation roles not defined
• Tools and methods inconsistent across teams
• Knowledge from past projects not captured or reused
• Time allocation for innovation crowded out by BAU

Guidance on planning, implementing, and controlling the processes needed to meet BCMS requirements.

• Maintenance plan tied to energy performance
• Operating procedures for each SEU
• Shift handover logs covering energy
• Setpoint and operating window register
• Change management records affecting energy

• Maintenance focused on uptime not energy
• Change management bypasses energy review
• Operating criteria not documented for SEUs
• Outsourced providers have no energy obligations
• Setpoints drift between shifts

Guidance on conducting business impact analysis and assessing risks of disruption to prioritized activities.

• Design brief template with energy criteria
• Design review minutes covering energy
• Capex business case template requiring EnPI impact
• Commissioning records validating energy performance
• Life cycle cost or energy assessment records
• Specification checklist for energy efficient equipment

• Energy considered only after design freeze
• No life cycle cost analysis
• Commissioning does not verify energy performance
• Design briefs silent on energy

Guidance on determining and selecting appropriate strategies and solutions for continuing prioritized activities.

• Specification template for energy using equipment
• Purchase order checklist for energy criteria
• Contractor briefs referencing the energy policy

• Renewable or low carbon options not evaluated
• Energy specifications not communicated to suppliers
• Suppliers not assessed against energy criteria
• Procurement decisions based on capex only

Guidance on establishing and implementing documented plans and procedures for responding to disruptions.

• EnMS clause mapping to the control
• Records demonstrating top management oversight
• Management review minutes covering energy performance
• Action plan aligned with clause 6.2

• Top management oversight not evidenced
• Control implemented without explicit link to the EnMS
• Continual improvement not demonstrated through EnPIs

Guidance on establishing an exercise and testing programme to validate the effectiveness of BC strategies and plans.

• Internal audit results for the EnMS
• Records demonstrating top management oversight
• Evidence pack referencing energy review and EnPIs
• Action plan aligned with clause 6.2
• Management review minutes covering energy performance

• Records dispersed and not centrally managed
• Energy performance impact not assessed
• Continual improvement not demonstrated through EnPIs

Guidance on determining what needs to be monitored and measured to evaluate BCMS performance and effectiveness.

• Performance evaluation criteria document
• Balanced scorecard for innovation
• Internal audit programme and reports
• Customer and partner feedback summary
• Benchmarking study results
• Measurement and evaluation procedure

• Benchmarking against peers absent
• Management reviews skip innovation as an agenda item
• KPIs measure activity (idea count) not outcomes (revenue, adoption)
• Lagging indicators only, no leading indicators

Guidance on conducting internal audits at planned intervals to verify BCMS conformance and effectiveness.

• Audit nonconformity log
• Measurement and evaluation procedure
• Internal audit programme and reports

• Benchmarking against peers absent
• Evaluation criteria differ across portfolio without rationale
• Management reviews skip innovation as an agenda item
• KPIs measure activity (idea count) not outcomes (revenue, adoption)
• Lagging indicators only, no leading indicators

Guidance on top management review of the BCMS to ensure its continuing suitability, adequacy, and effectiveness.

• Innovation KPI dashboard
• Customer and partner feedback summary
• Balanced scorecard for innovation
• Management review minutes and actions
• Innovation analytics report

• Evaluation criteria differ across portfolio without rationale
• Customer feedback not systematically captured
• Lagging indicators only, no leading indicators
• Internal audits of IMS not scheduled

Use guidance to determine internal and external issues that shape BCMS direction including dependencies.

• Context analysis
• Dependency map
• PESTLE

• Dependencies not mapped
• Context generic

Identify and prioritise interested parties whose needs influence BCMS outcomes including regulators and supply chain.

• Stakeholder register
• Prioritisation
• Supplier list

• Supply chain stakeholders absent
• Priority not set

Apply guidance to set a meaningful BCMS scope including critical activities, products, services, and exclusions.

• Scope statement
• Critical activity list
• Exclusion rationale

• Critical activities undefined
• Scope cosmetic

Monitor BCMS performance using leading and lagging indicators and evaluate effectiveness.

• KPI dashboard
• Indicator definitions
• Reports

• Only lagging KPIs
• No effectiveness measure

Plan and conduct internal audits using a risk-based approach with independent auditors.

• Audit plan
• Reports
• Auditor independence statement

• Auditors not independent
• No risk basis

Conduct management review with inputs covering performance, audits, exercises, and improvement opportunities.

• Review pack
• Minutes
• Decisions log

• Inputs thin
• Decisions not actioned

Use guidance to identify nonconformities, apply root cause analysis, and verify corrective action effectiveness.

• NC log
• RCA records
• Verification evidence

• No verification step
• RCA shallow

Drive continual improvement through learning from exercises, incidents, audits, and reviews.

• Improvement log
• Lessons learned
• Maturity assessments

• No maturity model
• Lessons not actioned

Guidance to embed leadership commitment, sponsorship, and visible support for the BCMS at executive level.

• Sponsor charter
• Exec briefings
• Visibility plan

• No exec sponsor
• BC invisible to staff

Develop a meaningful BC policy supported by guidance on content, communication, and review.

• BC policy
• Comms records
• Review log

• Generic policy
• No staff awareness

Guidance to assign BC roles including BCM coordinator, response teams, and recovery owners.

• RACI
• Team charters
• Role descriptions

• No team charters
• Recovery owners absent

Plan operational processes for BC including outsourced processes and change management.

• Process map
• Outsourced register
• Change log

• Outsourced not in BC scope
• Changes not BC-reviewed

Apply BIA and risk assessment guidance to determine recovery priorities, RTOs, RPOs, and MTPDs.

• BIA report
• RTO/RPO register
• MTPD log

• RTOs not validated
• MTPD undefined

Select BC strategies and solutions for people, premises, technology, information, and supplies.

• Strategy paper
• Resource plan
• Supplier resilience plan

• No supplier resilience
• Strategy ignores people

Develop BC plans, incident response procedures, and recovery procedures with clear activation criteria.

• BC plans
• IR procedures
• Activation criteria

• No activation criteria
• Plans not site-specific

Design an exercise programme covering tabletop, simulation, live, and full failover with progression.

• Exercise schedule
• Scenarios
• After-action reports

• Tabletop only
• No progression

Evaluate documentation, plans, and capabilities periodically and after disruption events.

• Evaluation reports
• Post-incident reviews
• Capability assessment

• No post-incident reviews
• Capability not assessed

Use guidance to identify BCMS risks and opportunities and integrate treatment into planning.

• Risk register
• Opportunity log
• Treatment plan

• Opportunities ignored
• Risk not BC-specific

Set SMART BC objectives with guidance on alignment to policy and measurable targets.

• Objectives register
• Targets
• Alignment map

• Targets missing
• No alignment map

Build BC competence through training, exercises, and experience guided by role-based requirements.

• Competency matrix
• Training plan
• Exercise records

• No role-based training
• Exercises rare

Plan internal and external communication including incident and stakeholder communication with templates.

• Comms plan
• Templates
• Notification list

• Templates outdated
• Notification list stale

Maintain BCMS documentation aligned to guidance on creation, control, and accessibility during disruption.

• Doc procedure
• DMS
• Offline copies

• No offline copies
• DMS depends on systems being up