Starting a BCMS With a Sponsor Who Wants a Certificate, Not a Capability
A regional healthcare insurer has decided to implement ISO 22301 because a large corporate client now requires certification in its supplier contracts. The executive sponsor (Chief Operating Officer) has set a nine-month deadline to certificate and has allocated one full-time business continuity manager, a part-time analyst, and a modest budget. In the kick-off meeting the COO says: 'I don't want a bureaucracy. Get the documentation templates, fill them in, and get us through the audit. We can build the real capability later.' The newly appointed BCMS manager knows that the organization has no business impact analysis, no tested recovery arrangements, and that its claims-processing platform has a single data centre with no failover. The COO controls the budget and has already told the audit-readiness consultant to 'keep it lean'.
1. What is the central judgement the BCMS manager must make about how to initiate this implementation?
Read the worked answer
The manager faces a conflict between the sponsor's stated goal (a certificate in nine months) and the standard's intent (a management system that demonstrably protects priority services). The judgement is whether to accept the framing and produce a documentation-led 'certification project', or to reframe the objective before committing resources.
Key reasoning:
- Initiation is where this is won or lost. The standard expects top management to demonstrate leadership and commitment, and to establish the BCMS in a way that is integrated with the organization's business processes. A template-filling exercise is not that, and it will not survive a competent Stage 2 audit, let alone a real disruption.
- The single data centre with no failover is not a documentation problem. No amount of filled-in templates changes the fact that a priority service has an untested, single-point dependency. An auditor sampling the BIA and risk assessment will find either that the dependency was never identified (a serious gap) or that it was identified and no treatment decided (also a gap).
- The nine-month deadline is not automatically unreasonable, but it constrains what can realistically be implemented and tested - particularly exercise programmes, which need cycles to mature.
The manager should not simply comply, nor simply refuse. The professional move is to bring the sponsor an honest assessment of what nine months can deliver and what it cannot, framed in the sponsor's own language (client retention, contractual risk).
2. Draft the substance of what the BCMS manager should say to the COO, and identify the leadership behaviours being relied upon.
Read the worked answer
Substance of the message:
- Separate the two outcomes. Certification is an audit opinion that the management system conforms. Capability is whether the insurer can keep paying claims when the data centre fails. The client contract almost certainly cares about the second, and the first is only a proxy for it.
- Flag the specific exposure. Claims processing depends on a single data centre with no failover. This must be surfaced as a priority finding from the context/risk work, with a treatment decision (accept, mitigate, transfer) owned by the COO, not buried.
- Propose a realistic plan. Nine months can plausibly deliver: context and scope, BIA and risk assessment, continuity strategies and plans for priority services, and at least one exercise. It is tight for a mature exercise programme and for embedding the system. Offer a phased approach: certificate on a defensible scope, with a documented improvement roadmap for the capability gaps.
- Be explicit about what 'lean' can and cannot mean. Lean documentation is fine; lean evidence of operation is not. The auditor will look for records that the system has run - management review, internal audit, exercise results, corrective actions.
Leadership behaviours relied upon: top management providing resources and direction, taking ownership of risk decisions, and integrating the BCMS with business planning rather than treating it as a compliance veneer. If the COO will not engage on the capability question, the manager should record the advice given and the decision taken - that record protects both the manager and the organization.