The document that is owned by executive management and sets the purpose of BCM in an organization is the Business Continuity Policy. The Business Continuity Policy is a high-level document that defines the scope, objectives, principles, and roles and responsibilities for business continuity management within the organization. It also demonstrates the commitment of top management to support and continually improve the BCMS.  The Business Continuity Policy is one of the mandatory documents required by ISO 22301, the international standard for BCMS 1 2 .

The other options are not correct because they are not documents that are owned by executive management and set the purpose of BCM in an organization. A Business Process Policy is a document that describes the procedures and rules for performing a specific business process, such as procurement, sales, or accounting. A Register is a document that records and tracks the status of certain items, such as risks, incidents, or assets. A Worksheet is a document that contains data and calculations, such as a spreadsheet or a form.

References :  1 : ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 5.3  2 : ISO 22301 Auditing eBook, Chapter 2.2.2

Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service. This strategy involves the following steps:

Identify the recovery options: Based on the results of the business impact analysis (BIA) and the risk assessment, identify the possible recovery options for each critical product and service. Recovery options are the alternative ways of resuming the delivery of the product or service within the recovery time objective (RTO) and the recovery point objective (RPO). Examples of recovery options are: relocating to an alternate site, activating a mutual aid agreement, using a cloud-based backup, outsourcing to a third-party provider, etc.

Evaluate the recovery options: Assess the feasibility, effectiveness, and efficiency of each recovery option, using criteria such as: cost, availability, scalability, compatibility, security, compliance, etc. Compare the advantages and disadvantages of each option and rank them according to their suitability for meeting the recovery needs.

Select the recovery options: Choose the best recovery option for each critical product and service, based on the evaluation results and the available resources. Ensure that the selected option aligns with the organization’s business continuity objectives, policies, and strategies. Document the rationale and justification for the selection and communicate it to the relevant stakeholders.

Strategy option evaluation and selection is the strategy that supports the recovery needs of each critical product and service, as it enables the organization to identify, evaluate, and select the most appropriate recovery option for each critical product and service, based on the BIA and the risk assessment results. This strategy helps the organization to ensure the continuity and resilience of its critical products and services in the event of a disruption, and to optimize the use of its resources and capabilities.  References:

ISO 22301 Auditing eBook , Chapter 3: Business Continuity Management System, Section 3.4.2: Business Continuity Strategy, Page 19

ISO 22301 Auditing eBook , Chapter 5: Business Continuity Management System Audit Activities, Section 5.3.2: Audit of Business Continuity Strategy, Page 37

ISO 22301:2019 , Clause 8.3: Business Continuity Strategies and Solutions, Page 18

Scope is the term that defines the area of operation in which the task and its activities should be performed, as described in ISO 22301. Scope is one of the key elements of a business continuity plan (BCP), which is a documented information that specifies the procedures and resources needed to manage a disruptive incident and ensure the continuity of the organization’s critical functions. Scope helps to define the boundaries and applicability of the BCP, as well as the roles and responsibilities of the involved parties. Scope also helps to ensure the consistency and compatibility of the BCP with the organization’s business continuity objectives and strategies.  Scope is one of the key requirements of ISO 22301, as it provides the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS).  References : ISO 22301 Auditing eBook, page 36  1 ; ISO 22301:2019, clause 8.4.2  2

When designing questionnaires for the BIA, the following factors should be considered 1 :

Concise information: The questionnaires should provide clear and concise information about the purpose, scope, and objectives of the BIA, as well as the instructions on how to complete them. The questionnaires should also avoid unnecessary or redundant questions that could confuse or frustrate the respondents.

Layout: The questionnaires should have a logical and consistent layout that facilitates the readability and comprehension of the questions. The questionnaires should use appropriate fonts, colors, spacing, and numbering to highlight the key points and sections. The questionnaires should also use tables, charts, or graphs to present the data or information in a structured and visual way.

Types of question: The questionnaires should use different types of questions to elicit the required information from the respondents. The questionnaires should use open-ended questions to allow the respondents to provide their own opinions or explanations, closed-ended questions to obtain specific or quantitative data, and rating or ranking questions to measure the relative importance or priority of the factors or criteria.

Level of detail: The questionnaires should provide the appropriate level of detail for the BIA. The questionnaires should not be too general or vague, as this could lead to inaccurate or incomplete results. The questionnaires should not be too specific or technical, as this could overwhelm or intimidate the respondents. The questionnaires should balance the depth and breadth of the information needed for the BIA.

References :  1 : ISO 22301 Auditing eBook, Chapter 5: Business Impact Analysis and Risk Assessment, Section 5.2: Business Impact Analysis, Subsection 5.2.3: Data Collection Methods, Page 69.

The Do step in the PDCA cycle is the stage where the plan is implemented and executed. It involves carrying out the activities and processes that are defined in the BCMS. It is also the step where communication with key stakeholders is maintained. Communication is a vital element of the BCMS, as it ensures that all relevant parties are informed and involved in the business continuity process. ISO 22301 requires organizations to establish communication procedures that enable timely and effective communication during a disruption.  These procedures should include clear communication channels, escalation processes, and guidelines for communication with stakeholders such as customers, suppliers, and regulatory bodies 1 . Communication and training are also important aspects of the Do step, as they ensure that all stakeholders are involved and aware of the PDCA cycle and their role in it.  Provide training and support to help employees understand the process and how they can contribute to it 2 . The Do step also involves testing and exercising the BCMS to verify its effectiveness and identify areas for improvement. Testing and exercising are essential for validating the assumptions, plans, and procedures of the BCMS and ensuring that they are fit for purpose.  They also help to raise awareness and confidence among the staff and stakeholders and demonstrate the organization’s commitment to business continuity 3 .  References:  :  ISO 22301 Clause 7.4 Communication  :  The Plan-Do-Check-Act (PDCA) Cycle: A Guide to Continuous Improvement  :  ISO 22301 Business Continuity Management Made Easy

 Leadership stresses the importance of executive support for the BCMS, as it is one of the key factors for the success of the system. According to the ISO 22301 Auditing eBook, leadership is the process of influencing and directing people to achieve the organization’s business continuity objectives. Leadership involves setting the vision, direction, and strategy for the BCMS, as well as providing the necessary resources, support, and communication to implement and maintain the system. Executive support refers to the commitment and involvement of the top management in the BCMS. Executive support ensures that the BCMS is aligned with the organization’s overall strategy and objectives, and that it receives the adequate attention, budget, and resources it needs. Executive support also ensures that the BCMS is integrated into the organization’s culture and values, and that it is communicated to all relevant parties, such as employees, customers, suppliers, regulators, and the public. Executive support can create a positive impact on the organization’s resilience and reputation, as it demonstrates the organization’s readiness and capability to respond to and recover from disruptive incidents. Leadership and executive support are closely related and mutually reinforcing. Leadership requires executive support to establish and sustain the BCMS, and executive support requires leadership to guide and direct the BCMS. Without leadership and executive support, the BCMS may not be effective, efficient, or consistent, and may not achieve the desired outcomes.  References : ISO 22301 Auditing eBook, pages 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, and 27.

The plan phase in the PDCA cycle establishes the operating framework for the BCMS by defining the scope, objectives, policy, and processes of the BCMS. The plan phase also involves conducting a business impact analysis (BIA) and a risk assessment (RA) to identify the business continuity requirements and strategies.  The plan phase is one of the key requirements of ISO 22301, as it provides the foundation and direction for the BCMS implementation and improvement.  References : ISO 22301 Auditing eBook, page 10  1 ; ISO 22301:2019, clause 0.3  2

 The scope of the business continuity management system (BCMS) is the statement that defines the boundaries and applicability of the BCMS. It specifies which products, services, processes, locations, and organizational units are covered by the BCMS, as well as any exclusions or limitations. The scope should document and explain any exclusions, which are the products, services, or processes that are not within the scope of the BCMS. Exclusions may be justified for various reasons, such as:

The products, services, or processes are not critical to the organization’s operations and objectives.

The products, services, or processes are already covered by other management systems or plans.

The products, services, or processes are outside the organization’s control or influence.

The products, services, or processes are not relevant or applicable to the organization’s context or needs.

However, the exclusions should not affect the organization’s ability to provide products and services that meet the requirements and expectations of its interested parties. The exclusions should also not compromise the conformity of the BCMS with the requirements of ISO 22301, the international standard for business continuity management systems. The scope and the exclusions should be documented in a clear and concise manner, and communicated to all relevant stakeholders. The scope and the exclusions should also be reviewed and updated regularly to reflect the changing circumstances and needs of the organization.  References:

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 4.3: Determining the scope of the business continuity management system 1

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Integration, Section 3.1: Business Continuity Integration Levels 2

ISO 22301 Clause 4.3 Determining the Scope of the Business Continuity Management System 3

 According to ISO 22301, a business continuity management system (BCMS) is a part of the organization’s overall management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity. A management system is a set of interrelated or interacting elements of an organization that establishes policies and objectives and enables the achievement of those objectives. A management system can address one or more disciplines, such as quality, environment, information security, or business continuity. Therefore, a BCMS is not limited to the IT management system, nor is it always managed by an external service provider.  A BCMS is integrated with the organization’s strategic direction, culture, values, and processes, and it involves the participation and commitment of all levels and functions of the organization.  References : ISO 22301 Auditing eBook, page 9  1 ; ISO 22301:2019, clause 3.4  2

Continual improvement is the process that ensures the BCMS operates effectively and remains relevant in its context. Continual improvement is an essential aspect of any management system, as it allows organizations to identify areas for improvement and implement changes to enhance their performance. According to ISO 22301, organizations should establish, implement, maintain, and continually improve a business continuity management system (BCMS) based on the principles of continual improvement. Furthermore, this ongoing process should be embedded into the organization’s culture. The continual improvement involves regularly reviewing the BCMS to identify areas for improvement and taking action to make changes that will enhance the system’s effectiveness. This can be achieved through various methods, such as monitoring and measuring the system’s performance, analyzing data and trends, conducting internal audits and management reviews, and implementing corrective and preventive actions. ISO 22301 also emphasizes the importance of leadership in driving continual improvement. Top management should continually improve the BCMS and provide the necessary resources and support to achieve this. They should also set objectives and targets for improvement and monitor progress. Continual improvement is a systematic and ongoing process that involves identifying opportunities for improvement, making changes, and monitoring the results to ensure practical improvements.  References:  : ISO 22301 Auditing eBook, page 11 : ISO 22301:2019, clause 10.2 : ISO 22301:2019, clause 3.15 :  ISO 22301 Clause 10.2 Continual improvement  :  ISO 22301 continuous improvement – How to achieve it