Business Continuity Management System Requirements
Domain 2 tests clause-by-clause requirements of ISO 22301:2019 (Clauses 4–10) and whether an auditor can distinguish a conforming system from a documented but non-operational one.
Clause map
- 4 Context: external and internal issues, interested parties and their requirements, BCMS scope, processes.
- 5 Leadership: top management commitment, BC policy, roles and authorities.
- 6 Planning: risks and opportunities, BC objectives, planning of changes.
- 7 Support: resources, competence, awareness, communication, documented information.
- 8 Operation: operational planning and control; BIA and risk assessment; BC strategies and solutions; plans and procedures; exercise programme; evaluation of documentation and capabilities.
- 9 Performance evaluation: monitoring, measurement, analysis and evaluation; internal audit; management review.
- 10 Improvement: nonconformity and corrective action; continual improvement.
Worked example
An auditor reviews a BIA for a hospital sterilisation unit. The BIA lists activities but no MTPD, and the risk assessment omits supplier failure. The BC strategy is "use the sister hospital", but no procedure assigns staff or transport. Finding: the BIA does not establish time frames from which strategies and RTOs can be derived. The missing supplier risk and unassigned procedure reinforce a systemic weakness in 8.2 and 8.3.
Traps
Treating Clause 8 as a one-off project; auditing documents rather than implementation; missing the link from BIA to MTPD to strategy to plan; accepting "the plan exists" without exercise evidence; ignoring Clause 6 objectives and Clause 10 corrective-action effectiveness.