The top management should demonstrate its commitment to the business continuity management system (BCMS) by conducting effective management reviews of the BCMS and ensuring that the business continuity management (BCM) objectives are aligned to the strategic goals of the business. These are two of the requirements of ISO 22301, the international standard for business continuity management systems, under clause 5.1: Leadership and commitment1.

Management reviews are periodic evaluations of the BCMS by the top management to assess its suitability, adequacy, and effectiveness. Management reviews help to ensure that the BCMS is performing as intended and meeting the requirements and expectations of the interested parties. Management reviews also help to identify and address any issues, gaps, or opportunities for improvement in the BCMS. Management reviews should be conducted at planned intervals, based on the organization’s needs and context. Management reviews should consider various inputs, such as the performance and results of the BCMS, the feedback and satisfaction of the interested parties, the internal and external audits, the corrective actions, the changes that may affect the BCMS, etc. Management reviews should also produce various outputs, such as the decisions and actions related to the improvement and effectiveness of the BCMS, the allocation of resources, the revision of policies and objectives, the communication of the results and outcomes, etc. Management reviews are an important way for the top management to demonstrate its commitment to the BCMS, as they show that the top management is actively involved in overseeing and supporting the BCMS.

BCM objectives are the specific and measurable outcomes that the organization intends to achieve with its BCMS. BCM objectives help to guide and direct the organization’s BCM activities and processes, as well as to evaluate and improve the organization’s BCM performance and capability. BCM objectives should be consistent with the organization’s business continuity policy and aligned with the organization’s strategic goals and vision. BCM objectives should also be relevant and meaningful to the organization’s context and needs, as well as the requirements and expectations of the interested parties. BCM objectives should be established and maintained by the top management, in consultation with the relevant stakeholders. BCM objectives should also be communicated and understood within the organization, as well as reviewed and updated regularly to reflect the changing circumstances and needs of the organization. Ensuring that the BCM objectives are aligned to the strategic goals of the business is an important way for the top management to demonstrate its commitment to the BCMS, as it shows that the top management is integrating BCM into the organization’s overall strategy and direction.

References:

• ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 5.1: Leadership and commitment1
• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.6: Business Continuity Objectives2
• ISO 22301 Auditing eBook, Chapter 5: Audit Process, Section 5.3: Audit Criteria3

Business Impact Analysis (BIA) is an objective approach that assesses the organisational activities and determines their criticality, dependencies, and recovery priorities. BIA is a key process in developing a business continuity management system (BCMS) according to ISO 22301. BIA helps to identify the potential impacts of disruptions to the organisation’s critical functions and processes, such as financial losses, reputational damage, legal liabilities, regulatory penalties, customer dissatisfaction, etc. BIA also helps to determine the recovery time objectives (RTOs), recovery point objectives (RPOs), and minimum business continuity objectives (MBCOs) for each critical function and process. BIA provides the basis for developing business continuity strategies and plans that ensure the continuity and resilience of the organisation. References:

• ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.3: Business Impact Analysis1
• ISO/TS 22317:2021(en), Security and resilience — Business continuity management systems — Guidelines for business impact analysis2

The act step in the PDCA cycle validates improvements by taking actions to address any gaps, nonconformities, or opportunities for improvement identified in the check step. The act step also involves reviewing the effectiveness of the actions taken and determining whether further improvement is possible or necessary. The act step closes the PDCA cycle and leads to a new plan step for the next cycle of continual improvement. The act step is one of the key requirements of ISO 22301, as it demonstrates theorganization’s commitment to enhance its business continuity capability and performance. References: ISO 22301 Auditing eBook, page 10 1; ISO 22301:2019, clause 0.3 2

Scope is the term that defines the area of operation in which the task and its activities should be performed, as described in ISO 22301. Scope is one of the key elements of a business continuity plan (BCP), which is a documented information that specifies the procedures and resources needed to manage a disruptive incident and ensure the continuity of the organization’s critical functions. Scope helps to define the boundaries and applicability of the BCP, as well as the roles and responsibilities of the involved parties. Scope also helps to ensure the consistency and compatibility of the BCP with the organization’s business continuity objectives and strategies. Scope is one of the key requirements of ISO 22301, as it provides the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 36 1; ISO 22301:2019, clause 8.4.2 2

 One of the purposes of the business impact analysis (BIA) is to determine the minimal acceptable outage (MAO) for each critical function or process of the organization. The MAO is the maximum amount of time that a function or process can be disrupted before it causes unacceptable consequences for the organization. The MAO is used to define the recovery time objective (RTO) and the recovery point objective (RPO) for each function or process. The RTO is the time within which a function or process must be restored after a disruption, and the RPO is the point in time to which the data and information must be recovered. The BIA helps the organization to prioritize its recovery efforts and allocate the necessary resources for business continuity. References: ISO 22301 Auditing eBook, page 38; ISO 22301:2019 standard, clause 8.2.2

Performance evaluation is the BCMS process that analyzes the adequacy of the business continuity capability using defined targets and performance indicators. It involves monitoring, measuring, analyzing, and evaluating the BCMS performance and effectiveness, as well as conducting internal audits and management reviews. Performance evaluation helps to identify the strengths and weaknesses of the BCMS, as well as the opportunities for improvement and corrective actions. Performance evaluation is one of the key requirements of ISO 22301, as it demonstrates the organization’s commitment to continual improvement and customer satisfaction. References: ISO 22301 Auditing eBook, page 19 1; ISO 22301:2019, clause 9 2

A documentary review is a type of review that involves examining documents, records, or other forms of evidence related to the audit criteria and objectives. It can often be used as a secondary method to support other forms of information collection methods, such as interviews, observations, or sampling. A documentary review can help to verify the existence, implementation, and effectiveness of the audited processes, activities, or controls. It can also provide useful information about the context, scope, and objectives of the audit, as well as the roles and responsibilities of the auditees and other relevant parties. References: ISO 22301 Auditing eBook, page 611; ISO 19011:2018, clause 6.3.22