Evaluating BCMS Performance Based on ISO 22301
Monitoring, measurement, analysis and evaluation
The organization must determine what to monitor, methods, criteria and when results are analysed. Metrics should reflect continuity capability: recovery time achieved versus RTO, exercise completion, corrective action closure, supplier continuity assurance, and training coverage. A frequent trap is accepting activity metrics (number of plans written) as evidence of performance; questions often probe whether a measure demonstrates capability.
Internal audit
Audits must be planned, objective and impartial; auditors cannot audit their own work. The programme considers importance of processes, changes and previous results. Traps include treating internal audit as a paperwork check, failing to define audit criteria and scope, and using untrained or conflicted auditors. Findings must be reported to relevant management and recorded.
Management review
Top management must review the BCMS at planned intervals. Required inputs include status of previous actions, changes in context and interested-party needs, performance information (nonconformities, monitoring results, audit results, exercise results), and risks/opportunities. Outputs must include decisions on improvement and changes. A very common trap: a review that discusses only incidents and omits required inputs, or outputs with no decisions or actions.
Worked example
A utility's review pack covers audit findings, two exercise outcomes, a supplier failure and a trend of late corrective actions. Outputs: fund a second data link, retrain responders, and bring forward the next supplier assessment. This satisfies input and output expectations.
Rule of thumb
If a review produces no decisions or actions, it is not a conforming management review. Evidence must show both inputs considered and outputs decided.