Business Continuity Management with ISO 22301

Business continuity is broader than IT continuity

• Common misconception: Companies often treat Business Continuity Management (BCM) as “IT continuity only.”
• Clarification: BCM includes continuity for the whole business, such as:
  • labs
  • buildings
  • transportation access
  • workforce availability

Examples:

• Laboratory downtime: What if the laboratory (not the IT network) is unavailable?
• Building outage: What if the building is down?
• Labor/transport disruptions: e.g., a bus driver strike prevents staff from reaching the office.
• Natural disasters: floods, earthquakes/tsunamis.
• Pandemics/lockdowns: COVID-type travel restrictions.

---

Risk management vs BCMS (“what if” vs granular risk)

• Risk management: can focus on specific domains (e.g., employment, health & safety, finance).
• BCMS focus: asks “what if”, but should avoid being overly granular about event types.

Principle: focus on business consequences, since different disasters can cause the same operational failures, such as:

• building unavailable
• blocked transportation routes

---

ISO 22301 as an execution assurance mechanism (competitive advantage)

ISO management system certification helps assure that continuity work is:

• not ad hoc
• performed “as per established processes and procedures”

Business impact:

• Reduces the likelihood of broken service promises (e.g., delayed parts or temporary closure with no reliable workaround).
• Builds customer/stakeholder confidence: people expect certainty (e.g., “access right now”), not open-ended timelines like “maybe 3–4 months” or “come back in 2 weeks” without a plan.

---

Core BCMS capability: recovery timeframes driven by customer needs

A key competence is:

• understanding what could go wrong
• defining recovery time objectives/timeframes

Emphasis: recovery targets should be driven more by customers’ needs than internal comfort (i.e., you can’t simply decide “maybe 2 days”).

---

Implementation guidance / playbook elements (ISO management system pattern)

Roadmap for implementing a BCMS (as described)

1. Start with:

   • Understand business impact and business benefits

2. Build organizational capability:

   • ensure sufficient people with the right knowledge/experience
   • use training/professional programs (e.g., SGS Academy classes mentioned)

3. Implement using ISO 22301 requirements:

   • ISO standards are framed as “world-class best practices”

4. Audit and certification flow:

   • Internal audits
   • Gap assessment (described as voluntary, not required)
   • Stage 1 review: check documentation and whether the system is fundamentally implemented
   • Stage 2 assessment: a “Big Bang audit” verifying conformance to ISO requirements
   • Non-conformances must be corrected before certification issuance

5. Maintenance after certification:

   • certificate validity: 3 years
   • annual surveillance audits (system must stay “alive”)
   • recertification at year 3
   • audit effort guidance (relative time):
     • surveillance ≈ 1/3 of the original Stage 1 + Stage 2 time
     • recertification ≈ 2/3 of the original Stage 1 + Stage 2 time

---

Management commitment is a gating factor

Biggest implementation mistakes:

• lack of resources
• lack of management commitment

Principle: If management only says “go ahead,” it won’t happen; if management is actively behind it, resources and execution follow.

Auditor perspective: absence of continual improvement signals both:

• requirement noncompliance
• weak management commitment

---

Concrete case example (COVID absenteeism preparedness)

A worldwide company (~10,000 people) reportedly used BCMS capabilities during COVID:

• Early signals: absenteeism began in China, then spread (Taiwan → India → Middle East → expected Europe/US)
• With BCMS “sensors/feelers” for early warning, they:
  • analyzed the issue and impact in advance
  • initiated measures early enough that Americas and Europe did not lose a single day
  • transitioned to working from home before widespread travel bans

Business lesson: BCMS should support disasters that are announced (e.g., pandemic trends), not only sudden shocks (e.g., earthquakes).

---

Frameworks / processes explicitly referenced

• ISO 22301 as the governing BCMS management system standard

• Certification lifecycle: Stage 1 → Stage 2 → certificate issuance → annual surveillance → recertification

• BCMS risk approach: “what if” based on consequences, not event-name granularity

• Competency/training approach: building internal knowledge and experience through training (e.g., academy classes)

---

Key metrics / targets mentioned (mostly procedural KPIs)

• Certificate validity: 3 years
• Audit cadence:
  • annual surveillance audits during the 3-year cycle
  • recertification at year 3
• Relative audit time:
  • surveillance ≈ 1/3 of Stage 1 + Stage 2 time
  • recertification ≈ 2/3 of Stage 1 + Stage 2 time
• Case study outcome metric: 0 days lost in Americas/Europe during COVID (reported)

---

Actionable recommendations (condensed)

• Treat BCMS as enterprise continuity (facilities, labs, staffing access), not only IT resilience.
• Design BCMS around business consequences and customer-driven recovery timeframes.
• Ensure management commitment + resourcing to prevent stalled implementation.
• Use early warning/monitoring signals to act on foreseeable disruptions (pandemics) ahead of time.
• Keep improving continuously; certification is not a “set and forget” exercise.

---

Presenters / sources

• Presenter: Not explicitly named in the provided subtitles.
• Standards / references: ISO 22301 (Business Continuity Management System)
• Organization referenced: SGS (including SGS Academy classes)