Policy formulation is the BCMS process that is used to develop a business continuity policy that sets out an operating framework. According to ISO 22301, the organization shall establish a business continuity policy that is appropriate to the purpose and context of the organization and provides a framework for setting business continuity objectives.  The policy shall also demonstrate top management’s commitment to the BCMS and its continual improvement 1 .  The policy formulation process involves the following steps 2 :

Define the scope and objectives of the policy

Identify the relevant internal and external issues and requirements

Analyze the current state of the BCMS and the gaps to be addressed

Draft the policy statement and the key principles and guidelines

Review and approve the policy by the top management

Communicate and distribute the policy to the relevant stakeholders

Monitor and update the policy as needed  References :

ISO 22301:2019 , clause 5.3

ISO 22301 Auditing eBook , page 24

Organizational activities are the actions and processes that an organization performs to achieve its objectives and deliver its products and services. These activities are exposed to innumerable threats that have the potential to compromise the achievement of corporate goals. These threats can be internal or external, natural or man-made, intentional or accidental, and can affect the organization’s resources, capabilities, reputation, and continuity. Some examples of threats that can disrupt organizational activities are:

Natural disasters, such as earthquakes, floods, storms, fires, or pandemics

Cyber-attacks, such as hacking, malware, ransomware, denial-of-service, or data breaches

Human errors, such as mistakes, negligence, or miscommunication

Malicious acts, such as sabotage, theft, fraud, vandalism, or terrorism

Supply chain issues, such as delays, shortages, quality problems, or contractual disputes

Regulatory changes, such as new laws, standards, or policies that affect the organization’s operations or compliance

Market changes, such as shifts in customer demand, preferences, or expectations, or increased competition or innovation

Social changes, such as changes in demographics, culture, values, or behaviors that affect the organization’s stakeholders or environment To protect against these threats and ensure the continuity of organizational activities, organizations need to implement a business continuity management system (BCMS) that follows the requirements of ISO 22301. A BCMS is a set of policies, procedures, and practices that enable an organization to prepare for, respond to, and recover from disruptions when they arise. A BCMS helps an organization to identify its critical activities, assess the risks and impacts of potential disruptions, develop strategies and plans to mitigate and manage the disruptions, and test and improve the effectiveness of the BCMS. By implementing a BCMS, an organization can enhance its resilience, reduce its losses, and maintain its reputation and customer satisfaction.  References:  :  What is ISO 22301 standard and what is its purpose?  :  Building Business Resilience: A Guide to ISO 22301 Certification  :  ISO 22301:2019(en), Security and resilience ? Business continuity management systems ? Requirements

Support does not lay out the foundation of planning and managing the BCMS, but rather provides the necessary resources and arrangements to enable the effective operation of the BCMS. Support includes aspects such as competence, awareness, communication, documented information, and organizational knowledge.  The foundation of planning and managing the BCMS is laid out by the leadership and planning clauses of ISO 22301, which define the roles and responsibilities, policies, objectives, and actions to address risks and opportunities for the BCMS.  References : ISO 22301 Auditing eBook, page 15  1 ; ISO 22301:2019, clauses 5, 6, and 7  2

ISO 22301:2019 is the international standard for business continuity management systems (BCMS). It specifies the requirements for establishing, implementing, maintaining, and improving a BCMS that enables an organization to prepare for, respond to, and recover from disruptive incidents. ISO 22301:2019 consists of 13 sections and 2 supporting sections. The 13 sections are:

Scope: This section defines the scope and applicability of the standard and its intended outcomes.

Normative references: This section lists the normative references that are indispensable for the application of the standard, such as ISO 31000 and ISO/IEC 27000.

Terms and definitions: This section provides the definitions of the terms used in the standard, such as business continuity, incident, and risk.

Context of the organization: This section requires the organization to determine its internal and external issues, the needs and expectations of its interested parties, and the scope and boundaries of its BCMS.

Leadership: This section requires the top management to demonstrate leadership and commitment, establish the business continuity policy and objectives, assign roles and responsibilities, and support the BCMS.

Planning: This section requires the organization to plan actions to address risks and opportunities, achieve the business continuity objectives, and integrate the BCMS into its business processes.

Support: This section requires the organization to provide the necessary resources, competence, awareness, communication, and documented information to support the BCMS.

Operation: This section requires the organization to implement the operational planning and control, conduct the business impact analysis and risk assessment, determine the business continuity strategy and solutions, establish and implement the business continuity procedures, and exercise and test the BCMS.

Performance evaluation: This section requires the organization to monitor, measure, analyze, and evaluate the performance and effectiveness of the BCMS, conduct internal audits, and review the BCMS at planned intervals.

Improvement: This section requires the organization to identify and implement opportunities for improvement, address nonconformities and take corrective actions, and continually improve the BCMS.

Annex A: This section provides informative guidance on the relationship between the clauses of ISO 22301:2019 and ISO 22313:2020, which is the international standard for business continuity management systems - guidance on the use of ISO 22301.

Annex B: This section provides informative guidance on the relationship between the clauses of ISO 22301:2019 and ISO 31000:

A documentary review is a type of review that involves examining documents, records, or other forms of evidence related to the audit criteria and objectives. It can often be used as a secondary method to support other forms of information collection methods, such as interviews, observations, or sampling. A documentary review can help to verify the existence, implementation, and effectiveness of the audited processes, activities, or controls.  It can also provide useful information about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the auditees and other relevant parties.  References : ISO 22301 Auditing eBook, page 61 1 ; ISO 19011:2018, clause 6.3.2 2

 According to ISO 22301:2019, Clause 7.2, the organization must determine the necessary competence of persons doing work under its control that affects its business continuity performance. The organization must ensure that these persons are competent on the basis of appropriate education, training, or experience, and where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken. The organization must also retain appropriate documented information as evidence of competence. Therefore, people are the ones who have determined roles and responsibilities based on knowledge and skills profiles, as they are the key resources for implementing and maintaining the business continuity management system (BCMS).  References : ISO 22301:2019, Clause 7.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

 Enterprise Risk Management (ERM) is the approach that manages the full spectrum of risks and their combined impact as an interrelated risk profile to the organization.  ERM enables an organization to consider the potential impact of all types of risks on all processes, activities, stakeholders, products and services 1 .  ERM helps an organization to align its strategy, processes, technology, and knowledge with the purpose of evaluating and managing the uncertainties it faces 2 .  ERM is a holistic and integrated approach that covers strategic, operational, financial, and compliance risks, as well as opportunities 3 .  References :

ISO 31000:2018 , clause 3.1

ISO 22301 Auditing eBook , page 11

Enterprise Risk Management - Integrating with Strategy and Performance , page 4

 According to ISO 22301 Auditing eBook, Chapter 2.1.2, a business continuity champion is a person who represents the executive management perspective in setting up the expectation for business continuity management (BCM). The business continuity champion is responsible for ensuring that the BCM policy and objectives are aligned with the strategic direction of the organization, and that the necessary resources and support are provided for the implementation and maintenance of the business continuity management system (BCMS). The business continuity champion also acts as a liaison between the executive management and the business continuity manager, who is the person in charge of the operational aspects of the BCMS.  References : ISO 22301 Auditing eBook, Chapter 2.1.2.

 Most government policies have direct influences on how organizations shape their business strategies and plans, as they affect the legal, regulatory, economic, and social environment in which the organizations operate. Government policies can create opportunities or threats for the organizations, depending on their nature and impact. For example, government policies can affect the taxation, trade, security, environmental, and human rights aspects of the organizations’ activities. Therefore, organizations need to monitor and analyze the government policies that are relevant to their business objectives and interests, and adapt their business strategies and plans accordingly.  This is also important for the business continuity management system (BCMS), as it helps the organizations to identify and address the risks and opportunities related to the government policies, and to ensure the compliance and resilience of their BCMS.  References : ISO 22301 Auditing eBook, page 13  1 ; ISO 22301:2019, clause 4.1  2

Maintenance is the activity that ensures that the programme and its components remain in line with the organization’s overall strategy. Maintenance involves monitoring and reviewing the performance and effectiveness of the programme, identifying and implementing improvements, and ensuring alignment with the changing needs and expectations of the organization and its stakeholders. Maintenance is an essential part of the programme management cycle, as it helps to ensure that the programme delivers the intended benefits and outcomes, and that the programme remains relevant and adaptable to the changing environment. Maintenance is also a requirement of ISO 22301, the international standard for business continuity management systems (BCMS).  According to ISO 22301, the organization shall establish, implement and maintain a process for continual improvement of the BCMS, which includes evaluating the need for changes to the BCMS, and ensuring that the BCMS remains suitable, adequate and effective 1 .  References :

ISO 22301:2019 , clause 10.2