Setting Objectives and Scope When the Parent Group Has Its Own BCMS
A manufacturing subsidiary is planning its BCMS implementation. Its parent group already holds a group-level ISO 22301 certificate covering corporate functions and shared IT, and has issued a group policy requiring all subsidiaries to 'align with the group BCMS'. The subsidiary operates two plants, has its own ERP instance hosted by group IT, and relies on a group-level crisis team for anything escalated above site level. The subsidiary's management wants its own certification so that it can bid for a public-sector contract. Tension has emerged: the group BCMS manager insists the subsidiary should be a 'site' under the group certificate and not duplicate documentation; the subsidiary's plant directors want autonomy and argue that group plans don't reflect plant realities. The subsidiary BCMS lead must now define scope, objectives, and the interface with the group system before planning proceeds.
1. How should the subsidiary BCMS lead resolve the scope and interface question?
Read the worked answer
The lead should treat this as a planning decision grounded in the standard's requirements for scope and for understanding the organization and its context - not as a political negotiation.
Reasoning:
- Scope follows dependency, and dependencies run both ways. The subsidiary depends on group IT (ERP hosting) and on the group crisis team; the group depends on the subsidiary's plants for production. Any defensible scope must state explicitly which activities are performed by the subsidiary and which are provided by the group, and how the interfaces are managed.
- Duplication is not the issue; clarity is. The group manager is right that duplicating documentation is wasteful. The subsidiary lead is right that group plans may not reflect plant realities. Both can be satisfied by referencing group arrangements where they genuinely cover the activity, and documenting the subsidiary-specific plans and interfaces where they do not.
- The public-sector contract drives the scope decision. If the contract requires the subsidiary to hold its own certificate, the scope must be one the subsidiary can actually control and evidence. A scope that leans entirely on group arrangements the subsidiary cannot direct is fragile at audit.
- Document the interface. The standard expects the organization to determine external and internal interfaces and dependencies. A short interface document - who escalates to whom, what the group guarantees, what the subsidiary must do itself - resolves most of the tension and is directly auditable.
Recommendation: subsidiary scope covering plant operations and subsidiary-level functions, with explicit reference to group-provided IT and crisis escalation, plus an agreed interface document signed by both BCMS leads.
2. What should the subsidiary's BCMS objectives look like, and how should they connect to the group's objectives?
Read the worked answer
Objectives must be measurable, monitored, communicated, and consistent with the policy - and here they must also be consistent with the group's objectives without being a copy of them.
A workable structure:
- Inherit where the group owns the control. For ERP availability, the subsidiary cannot set an objective it cannot influence. It should adopt the group's availability target and define its own dependency-management objective (e.g. 'interface with group IT reviewed and tested twice yearly; escalation path validated in at least one exercise per year').
- Set subsidiary-owned objectives for subsidiary-owned risk. Examples: 'All priority production activities have a validated BIA and a tested continuity plan by Q3'; 'Maximum tolerable disruption for priority product lines defined and approved by plant directors'; 'At least two exercises per plant per year, with corrective actions closed within 60 days'.
- Make them measurable and assign owners. Each objective needs a metric, a target, a frequency of monitoring, and a named owner at plant level.
- Review at management review. Progress against objectives is a standing input.
The judgement being tested: objectives must be within the organization's sphere of control, must reflect the priority activities identified by the BIA, and must be genuinely monitored rather than written once and filed. Copying the group's objectives wholesale would fail the first test; inventing objectives that ignore the group dependency would fail the second.