Assessment, Audit and Maintenance: Keeping the Programme Honest
Domain focus
Assessment and maintenance tests whether you can keep the programme credible after the plan is signed. Questions cover performance measurement, internal audit, management review, maintenance triggers and corrective action.
Monitoring and measurement
Decide what is measured, how, when and by whom, and report it. Useful measures: percentage of prioritized activities with a current BIA; percentage of plans reviewed within cycle; exercise objectives met; corrective actions closed on time; supplier continuity compliance; actual recovery times versus RTO in real incidents. Measures should evidence capability, not document counts alone.
Internal audit
Per ISO 22301 clause 9.2, audit the BCMS on a planned schedule against defined criteria and scope, with auditors who do not audit their own work, reporting findings to management. Audit tests conformity and effectiveness of the management system; it is neither an exercise (which tests capability) nor a management review.
Management review
Clause 9.3: top management reviews the BCMS at planned intervals, taking inputs such as audit results, exercise outcomes, BIA currency, risk changes, nonconformities and corrective action status, and producing decisions on resources, improvement and change.
Maintenance triggers
Do not rely on an annual date alone. Review when the organisation, structure or key people change; a new site, system, supplier or process is introduced; a merger or outsourcing occurs; an exercise or real incident exposes a gap; audit raises a nonconformity; regulations or contracts change; or risk assessments are refreshed. Maintain version control and re-issue controlled copies, retrieving the old ones.
Worked example
An internal audit finds 3 of 12 plans past their review date and 2 contact annexes listing leavers. Root cause: review dates sat in a spreadsheet nobody owned. Corrective action: assign plan ownership, automate reminders from the document register, and verify at the next audit. The action, owner, due date and verification route are recorded and reported at management review - the loop closes only when verification shows the fix held.
Traps
Treating internal audit as management review; reviewing only on the anniversary; updating a plan without version control or re-distribution; closing corrective actions on the owner's word without verification; assessing documents rather than capability; and failing to refresh the BIA when the organisation changes, which invalidates every downstream RTO.