Scope that stops at the legal boundary
Northvale Diagnostics runs a single accredited laboratory that processes 2,400 clinical samples a day for 60 clinics. Its BCMS scope statement reads: 'The business continuity management system covers the Northvale laboratory building, its staff and its information systems.' Two dependencies sit outside that statement. Samples are collected by a single courier company under a contract that guarantees pickup within four hours but says nothing about disruption. If the analysers are unavailable, work is to be redirected to a partner laboratory 200 km away under a 'best efforts' arrangement that has never been invoked or tested. The laboratory manager argues that because the courier and the partner are separate legal entities, they belong in supplier management, not in the BCMS. During a recent quality meeting, the BC manager noted that the scope had not been reviewed since certification two years ago and that the partner laboratory had changed ownership.
1. Is the scope statement compliant with ISO 22301? Justify your answer and describe the correction needed.
Read the worked answer
It is not compliant. Clause 4.3 requires the scope to consider the external and internal issues in 4.1, the requirements of interested parties in 4.2, and the interfaces and dependencies of the organization. Legal ownership is not the test; dependency is. Northvale's ability to deliver diagnostic results depends on sample collection by the courier and on analyser capacity at the partner laboratory. Excluding both removes from the BCMS exactly the parts of the service most likely to fail and least under direct control.
The laboratory manager's argument confuses contract structure with management-system boundaries. A supplier can be an external provider controlled under 8.1 while its service also appears in the BIA, the risk assessment, the strategy and exercises. The correction is to redraw the scope around the services and supporting activities, naming the courier, the partner laboratory and the interfaces between them; then re-run the BIA and risk assessment for those dependencies, confirm the MTPD and MBCO, and ensure strategies and supplier controls reflect them. The two-year gap since review, and the change of ownership at the partner, reinforce the nonconformity because the scope no longer reflects the current context.
2. Evaluate the 'best efforts' partner arrangement as a business continuity solution under clause 8.3.
Read the worked answer
Under clause 8.3, a strategy or solution must be selected on BIA and risk outputs and be capable of meeting the prioritized timeframes and minimum capacity. 'Best efforts' supplies no committed capacity, no stated response time, no activation authority, no defined communication route and no evidence of capability, so it cannot be shown to meet any MTPD. It is an intention, not a solution.
Three tests should be applied. Capacity: how many samples per day can the partner absorb, and at what notice? Time: from decision to first validated result, including transport, accessioning and quality checks, does the total fit inside the MTPD? Reliability: if the partner uses the same analyser platform, reagent supplier or staff pool, the 'alternative' may share the original failure mode, and the 200 km separation helps with a site-specific event but not a regional one. The remedy is either a contract with defined capacity, activation triggers, a tested RTO and periodic joint exercises, or a different solution such as a second line or a second partner. Until one exists, the residual risk should be documented and accepted by top management.
3. The courier contract guarantees a four-hour pickup but is silent on disruption. What should the BC manager require, and why does this follow from the BIA rather than from procurement preference?
Read the worked answer
The BIA establishes that sample collection is a dependency of every prioritized activity and sets the time within which collection must resume. That output is the specification against which the courier arrangement must be judged; procurement alone cannot know what 'adequate' means. Clause 8.1 also requires control of externally provided processes, so the contract is a control mechanism, not just a commercial document.
The BC manager should require continuity obligations proportionate to the BIA: an alternative pickup route and vehicle capacity, priority allocation for Northvale during a regional disruption, notification timelines, disclosure of subcontractors, a defined recovery time for collection, and the right to test the arrangements. The risk assessment should then evaluate single-source concentration and the feasibility of a secondary courier or staff collection for urgent samples. Without these, the four-hour guarantee describes normal operations only and collapses in exactly the conditions the BCMS exists to manage.