A control is a measure that is implemented to reduce or eliminate the risk from occurring, or to mitigate the impact of the risk if it occurs. A control can be preventive, corrective, or detective, depending on the stage of the risk management process. A control can also be administrative, technical, or physical, depending on the nature of the risk and the organization. A control can be designed, implemented, monitored, and evaluated based on the risk assessment and the risk treatment plan. A control can be documented in the business continuity policy, objectives, plans, procedures, and other relevant documents. A control can be audited to verify its effectiveness and efficiency in achieving the intended outcomes.  References :

PECB Certified ISO 22301 Lead Auditor eLearning Training Course 1 , Module 3: Fundamental principles and concepts of a business continuity management system (BCMS), Lesson 3.2: Business continuity management system (BCMS), Slide 15: Risk management

ISO 22301 Auditing eBook 2 , Chapter 3: Fundamental principles and concepts of a business continuity management system (BCMS), Section 3.2: Business continuity management system (BCMS), Subsection 3.2.4: Risk management

Business continuity programs should be a part of the governance process of the organization, which is the system by which the organization is directed and controlled. The governance process involves setting the strategic direction, establishing the policies and objectives, allocating the resources, monitoring the performance, and ensuring the accountability and transparency of the organization. Business continuity programs support the governance process by ensuring the continuity of the organization’s critical functions and processes in the event of a disruptive incident, and by enhancing the organization’s resilience and reputation.  References : ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems (BCMS), Section 1.1: Governance, page 8.

 Evaluation is the process of assessing the performance of an organization, a system, a process, or an activity against a set of criteria, standards, or objectives. Evaluation can be used to identify strengths, weaknesses, opportunities, and threats, as well as to measure the effectiveness, efficiency, and impact of the organization’s activities. Evaluation can also be used to compare the performance of different organizations, systems, processes, or activities, and to identify and share best practices and lessons learned. Evaluation is one of the key elements of the Plan-Do-Check-Act (PDCA) cycle, which is the basis of the ISO 22301 standard for business continuity management systems (BCMS). Evaluation is related to performance evaluation, audit, and benchmarking study, as these are some of the methods or tools that can be used to conduct evaluation.  References : ISO 22301 Auditing eBook, Chapter 2: Introduction to Business Continuity Management Systems (BCMS), Section 2.3: The PDCA Cycle, Page 17; ISO 22301 Auditing eBook, Chapter 5: Audit Principles, Section 5.1: Introduction, Page 65; ISO 22301 Auditing eBook, Chapter 6: Audit Program, Section 6.3: Audit Program Objectives, Page 75; ISO 22301 Auditing eBook, Chapter 7: Audit Activities, Section 7.1: Introduction, Page 85; ISO 22301 Auditing eBook, Chapter 8: Audit Competence and Evaluation of Auditors, Section 8.1: Introduction, Page 105.

Leadership prepares the organization before and during an incident by establishing the business continuity policy, objectives, and roles and responsibilities, ensuring the alignment of the business continuity management system (BCMS) with the organization’s strategic direction, providing the necessary resources and support for the BCMS, communicating the importance of effective business continuity management to all interested parties, and promoting continual improvement of the BCMS. Leadership also demonstrates commitment and accountability for the BCMS performance, ensures the integration of the BCMS requirements into the organization’s processes, reviews and evaluates the BCMS suitability, adequacy, and effectiveness, and ensures that the organization’s business continuity needs and exp

 One of the purposes of the business impact analysis (BIA) is to determine the minimal acceptable outage (MAO) for each critical function or process of the organization. The MAO is the maximum amount of time that a function or process can be disrupted before it causes unacceptable consequences for the organization. The MAO is used to define the recovery time objective (RTO) and the recovery point objective (RPO) for each function or process. The RTO is the time within which a function or process must be restored after a disruption, and the RPO is the point in time to which the data and information must be recovered. The BIA helps the organization to prioritize its recovery efforts and allocate the necessary resources for business continuity.  References : ISO 22301 Auditing eBook, page 38; ISO 22301:2019 standard, clause 8.2.2

The Incident Management Structure (IMS) is a framework for organizing and managing the response to a disruptive incident. The IMS defines three levels of management activities: strategic, tactical, and operational. The strategic level is responsible for setting the overall direction and objectives of the response, as well as allocating resources and coordinating with external stakeholders. The tactical level is responsible for implementing the strategic decisions and managing the operational teams. The tactical level also monitors the situation and reports to the strategic level. The operational level is responsible for executing the specific tasks and actions required to achieve the objectives of the response. The operational level also provides feedback to the tactical level on the progress and issues encountered.  References:

ISO 22301 Auditing eBook, Chapter 4: Incident Response and Recovery, Section 4.2: Incident Management Structure 1

ISO 22320:2018(en), Security and resilience — Emergency management — Guidelines for incident management 2

According to ISO 22301:2019, Clause 3.10, critical functions are the functions that are directly responsible for the delivery of products and services to the customers and other interested parties. Critical functions are essential for the organization to achieve its objectives, protect its reputation, and meet its legal and contractual obligations. Critical functions are also the ones that are most vulnerable to disruption, and therefore require the highest level of protection and recovery capability. The identification and prioritization of critical functions are part of the business impact analysis (BIA) process, which is a key component of the business continuity management system (BCMS).  References : ISO 22301:2019, Clause 3.10; ISO 22301 Auditing eBook, Chapter 4.2.2.

The step that collates and validates all resource requirements of the selected continuity solutions is the  compile  step. This step involves gathering all the information about the resources needed to implement and operate the continuity solutions, such as human resources, equipment, facilities, materials, suppliers, partners, etc.  The compile step also involves verifying that the resource requirements are realistic, feasible, and consistent with the organization’s objectives, policies, and budget 1 .

References :  1 : ISO 22301 Auditing eBook, Chapter 6: Business Continuity Strategy, Section 6.2: Continuity Solutions, Subsection 6.2.4: Compile, Page 88.

Coordination is the process of planning and arranging BCM tasks into a proper order of relationship to achieve the defined outcomes. Coordination involves establishing the roles and responsibilities of the BCM team, the stakeholders, and the external parties, as well as defining the communication channels and protocols.  Coordination also ensures that the BCM activities are aligned with the organizational objectives, policies, and procedures, and that the BCM resources are allocated and utilized efficiently and effectively.  References:  ISO 22301 Auditing eBook, page 28 1

The top management should demonstrate its commitment to the business continuity management system (BCMS) by conducting effective management reviews of the BCMS and ensuring that the business continuity management (BCM) objectives are aligned to the strategic goals of the business.  These are two of the requirements of ISO 22301, the international standard for business continuity management systems, under clause 5.1: Leadership and commitment 1 .

Management reviews are periodic evaluations of the BCMS by the top management to assess its suitability, adequacy, and effectiveness. Management reviews help to ensure that the BCMS is performing as intended and meeting the requirements and expectations of the interested parties. Management reviews also help to identify and address any issues, gaps, or opportunities for improvement in the BCMS. Management reviews should be conducted at planned intervals, based on the organization’s needs and context. Management reviews should consider various inputs, such as the performance and results of the BCMS, the feedback and satisfaction of the interested parties, the internal and external audits, the corrective actions, the changes that may affect the BCMS, etc. Management reviews should also produce various outputs, such as the decisions and actions related to the improvement and effectiveness of the BCMS, the allocation of resources, the revision of policies and objectives, the communication of the results and outcomes, etc. Management reviews are an important way for the top management to demonstrate its commitment to the BCMS, as they show that the top management is actively involved in overseeing and supporting the BCMS.

BCM objectives are the specific and measurable outcomes that the organization intends to achieve with its BCMS. BCM objectives help to guide and direct the organization’s BCM activities and processes, as well as to evaluate and improve the organization’s BCM performance and capability. BCM objectives should be consistent with the organization’s business continuity policy and aligned with the organization’s strategic goals and vision. BCM objectives should also be relevant and meaningful to the organization’s context and needs, as well as the requirements and expectations of the interested parties. BCM objectives should be established and maintained by the top management, in consultation with the relevant stakeholders. BCM objectives should also be communicated and understood within the organization, as well as reviewed and updated regularly to reflect the changing circumstances and needs of the organization. Ensuring that the BCM objectives are aligned to the strategic goals of the business is an important way for the top management to demonstrate its commitment to the BCMS, as it shows that the top management is integrating BCM into the organization’s overall strategy and direction.

References:

ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements, Clause 5.1: Leadership and commitment 1

ISO 22301 Auditing eBook, Chapter 2: Business Continuity Concepts and Principles, Section 2.6: Business Continuity Objectives 2

ISO 22301 Auditing eBook, Chapter 5: Audit Process, Section 5.3: Audit Criteria 3