A management review without inputs
Kestrel Water, a regional utility with 220,000 customers, holds one management review each year. The 2024 meeting lasted 40 minutes. The pack contained the incident log and a finance summary. It did not include the BIA, risk assessment results, exercise results, internal audit findings, the status of previous actions or progress against objectives. The operations director, who chaired the meeting, signed the minutes as 'top management approval'. The business continuity policy, signed by the CEO, states a commitment to 'continuously improve resilience', but no objectives have been set and the policy is not published on the intranet or covered in induction. The internal audit of the BCMS was performed by the BC coordinator, who reports to the operations director. Two nonconformities from the previous audit remain open.
1. Identify the clauses most clearly not met and explain why each gap matters, not merely that something is missing.
Read the worked answer
Several clauses are engaged. Clause 9.3.2 lists the inputs management review must consider, including BIA and risk assessment results, exercise results, audit results, status of previous actions and performance information. Without them the review cannot assess whether the BCMS is achieving its intended outcomes, so any decisions are uninformed. Clause 6.2 requires measurable business continuity objectives consistent with the policy; none exist, so there is nothing to monitor and no basis for improvement. Clause 5.2 requires the policy to be communicated within the organization and available as documented information; an intranet and induction gap means staff cannot know their responsibilities. Clause 9.2 requires audits to be conducted with objectivity and impartiality, which is not the case when the BC coordinator audits her own area. Clause 10.2 is engaged by the two open nonconformities.
The causal chain matters: no objectives leads to no measurement, which leads to an empty management review, which leads to unresolved corrective actions. The nonconformities are symptoms of a BCMS that is documented but not operating.
2. The operations director says that as accountable executive he is 'top management' for the review. Assess this claim and the adequacy of the review outputs.
Read the worked answer
The claim depends on authority, not title. ISO 22301 refers to the person or group who directs and controls the organization at the highest level. If the operations director has that authority, including control of resources and the ability to change the BCMS, chairing the review is acceptable, and the review may be integrated with other management reviews. If he does not, the review cannot make the decisions the standard expects, and the signature is not evidence of top-management review.
Even if he is top management, the outputs are inadequate. Clause 9.3.3 requires decisions and actions related to opportunities for improvement, the need for changes to the BCMS, and resource needs. A 40-minute meeting with an incident log and finance summary, with no recorded decisions, fails that test. The real issue is not who signed the minutes but whether the review had the information and authority to direct the BCMS. Kestrel should either raise the review to the executive level with a complete input pack, or formally delegate with clear authority and report back.
3. What should the BC manager do in the next 90 days to put the BCMS back on a conforming footing?
Read the worked answer
First, brief the CEO and executive team on the gap and its implications for regulatory and customer obligations; a water utility cannot treat this as a documentation exercise. Second, rebuild the management review pack around the 9.3.2 inputs, including the refreshed BIA and risk assessment, exercise results, audit findings and corrective-action status, and schedule a review with decisions recorded. Third, set two or three measurable objectives that follow from the policy and the BIA, with owners and review dates. Fourth, communicate the policy through induction and the intranet and confirm awareness. Fifth, reassign the internal audit to an independent auditor, or arrange an external audit, so that objectivity is demonstrable. Sixth, close or formally escalate the two open nonconformities with root-cause analysis and effectiveness checks. Progress should be reported to top management, and the actions should be entered in the corrective-action process rather than tracked informally.