The Scope That Excluded the Thing That Failed
A mid-sized logistics company has held ISO 22301 certification for two years. The certification scope statement reads: "Primary distribution centre, fleet operations, and customer service functions located at the Northgate site." The company also runs a small but business-critical customs brokerage unit at a leased office two kilometres away; it was excluded from scope during the original project because it was 'administratively separate' and had never suffered a disruption. During a peak shipping week, a burst water main floods the customs office, destroying paper documentation and taking the unit offline for nine days. Because customs clearance stalled, more than 300 shipments were held at port, and the company incurred contractual penalties. The BCMS itself functioned as designed: the Northgate site was unaffected. Senior management now asks the business continuity manager whether the incident counts as a BCMS failure and whether the certificate is at risk.
1. Was this a failure of the BCMS? Justify your position against the concept of scope and the organization's own context.
Read the worked answer
The BCMS did not fail on its own terms - the disruption occurred inside an activity the organization had deliberately excluded from scope. But that is not the same as saying the organization is blameless.
Two concepts must be separated:
- Conformity. The standard requires the scope to be defined and documented, and to be appropriate to the organization's context. If the exclusion of customs brokerage was a conscious, documented decision consistent with the context analysis, the system conformed.
- Effectiveness and appropriateness. The context analysis is where the real question lies. A unit that is 'business-critical' and whose failure stalls 300 shipments is, by any reasonable reading, part of the organization's value chain. Excluding it on the basis of administrative separation rather than dependency analysis suggests the scope was drawn for convenience, not from the context.
The honest answer to management: the NCMS performed as scoped, but the scope itself is now demonstrably questionable. The incident is evidence that the context analysis and scope decision were inadequate - which is a BCMS issue even though no in-scope process failed.
2. What should the business continuity manager do next, and what does this imply for the certificate?
Read the worked answer
Sequence matters here.
- Do not rush to widen scope before the next surveillance audit without a plan. Widening scope is a significant change and must be managed through the change-management and planning elements of the BCMS - updated context analysis, updated risk assessment and BIA for the customs unit, revised objectives, revised plans, and evidence the new scope is actually implemented.
- Treat the incident as an input to management review and corrective action. The proximate cause (water main, no offsite copies of documentation) is a risk-treatment gap for an activity that should have been in scope. The root cause is the scope decision. Both belong in the corrective-action process.
- Re-run the BIA across the value chain, not by site. Ask which activities, wherever performed, support priority products and services. Customs clearance almost certainly surfaces as time-critical.
- On the certificate: the current certificate remains valid for the certified scope. The certification body should be informed of the change in scope when it is decided, since scope changes affect audit planning. Concealing the decision until the next audit is poor practice and creates a finding of its own.
The exam point: scope is a judgement about the organization's dependencies, not a boundary drawn around buildings or org charts.