'ISO 22301 certified' - scope, claims and criteria

The brief conflates three different questions, and the criteria differ for each:

1. Does the BCMS conform to ISO 22301 within the certified scope? Criteria: the standard's requirements, binding to the extent the organisation has adopted them - which it has, at least within the certified scope, and via its own BCMS policy. Internal policy is binding regardless of the certificate.
2. Are continuity arrangements effective for Tier 1 services? Criteria: RTOs from the BIA, contractual and regulatory obligations, internal policy. Different question, different evidence.
3. Is the public claim accurate and not misleading? Criteria: the certificate's scope statement and whatever governs corporate claims in the jurisdiction.

On 'certification proves effectiveness': it is a category error, and I would say so plainly. Certification is a third-party opinion that the management system conforms to the standard within a stated scope. It says nothing about whether a specific plan recovers a specific service within its RTO - that is demonstrated by exercising and by actual events. Management is entitled to hold the certificate; it is not entitled to draw an inference from it that the certificate does not support.

The scope statement matters more than the certificate. 'Data centre hosting from Site A' excludes head office, where continuity management actually sits, and excludes two Tier 1 services. I would report the claim to those charged with governance as a disclosure issue for legal/company secretarial to consider - not silently, and not as a technicality.

Two layers, judged differently.

Against internal policy - no judgement needed. The policy says annual exercising of all plans; 3 of 11 plans were exercised, by one desktop method. That is a deviation on the facts. The only judgement is cause and effect. If management argues the policy is unrealistic, the answer is to change the policy through the right channel - not to treat the deviation as acceptable while the criterion stands. I would recommend a risk-tiered policy rather than an unachievable one, but that is a forward-looking recommendation, not a defence.

Against the standard - judgement, and I must show it. ISO 22301 requires an exercise programme: planned, risk-based, varied in method, involving relevant interested parties including suppliers, with results feeding corrective action. My assessment is that one desktop exercise covering three plans does not meet that intent for an organisation with two Tier 1 services running from an uncertified site and a dependent colocation facility. I would articulate why - no technical recovery tested, no supplier involvement, no alternate-site activation, no timed validation of any RTO - rather than cite a clause number as if adequacy were self-evident.

Effect: RTOs are unvalidated; plan currency is unproven and corroborated by the stale-contact finding; the improvement loop is untested because there is nothing to improve from.

Recommendation: a tiered programme - executed failover for Tier 1 at a defined frequency with timings recorded against RTO, tabletop for Tier 2/3, supplier participation, and a schedule with issue tracking to closure approved by management and reviewed by the audit committee.

This is where criteria discipline earns its keep. The answer is not 'nonconformity with ISO 22301', because the standard has not been adopted for head office. A nonconformity requires a binding criterion, and outside the certified scope there is none from the standard.

But there are still applicable criteria:

• The internal BCMS policy, which speaks about continuity management for the organisation, not about Site A. If it commits the group to protecting its critical services, that commitment is the criterion.
• The group risk framework, which presumably identifies payroll and the portal as critical and expects assurance over them.
• Contractual and regulatory obligations attached to those services.

So the finding is best framed as an assurance-mapping gap, not a compliance breach: the two Tier 1 services the organisation relies on are outside the scope of the management system it operates and publicises, so the board's apparent assurance does not extend to them. That is usually more useful to a board than a clause violation, because it addresses the gap between the assurance they think they have and the assurance they actually have.

Recommendations: extend the BCMS scope to cover head office and the colocation dependency, and sequence the extension against the surveillance audit in four months; or, if exclusion is deliberate, document the rationale, show how those services are otherwise assured, and align the public claim to the actual scope. Either route is defensible. Silence is not, and the auditor should not let the gap pass because the certificate looks tidy.