ISO 22301 and the Difference Between a BCP Document and a Plan That Works

Most organisations that have “done” business continuity have a document: a Business Continuity Plan, often produced once, during a compliance push, and rarely opened again until the next audit. ISO 22301, the international standard for Business Continuity Management Systems, is built around a different premise — that a plan is only as good as the evidence that it works.

The core building blocks of ISO 22301:

• Business Impact Analysis (BIA) — identifying which business processes are time-critical, what the maximum tolerable period of disruption is for each, and what resources (people, systems, data, suppliers) each process depends on.
• Risk assessment — the range of disruption scenarios the organisation is actually exposed to, from cyber incidents to supplier failure to facility loss, not just the scenario that was topical when the plan was written.
• Continuity strategy — the actual response options (alternate sites, failover systems, manual workarounds) chosen for each critical process, based on the BIA.
• Plans and procedures — the documented, actionable steps for response and recovery, with named roles, not just responsibilities described in the abstract.
• Exercising and testing — this is where most organisations’ continuity programmes actually stop, and where ISO 22301 places real weight.

Why the exercise programme is the part that matters. A tabletop exercise reveals whether the plan’s assumptions hold — whether the named recovery team members are actually reachable, whether the “alternate” data centre has been kept in sync, whether a supplier’s own continuity commitments were ever verified rather than assumed. A plan that has only ever existed on paper reliably fails on details that seem trivial until the moment they matter: an outdated contact list, a recovery site that was quietly decommissioned, a dependency on a system that itself has no continuity plan.

What “certifiable” business continuity looks like in practice:

• BIA and risk assessment reviewed and updated at a defined interval, not left static since the original project
• At least one exercise per year that meaningfully tests response — not just a walkthrough read from the document
• Lessons from each exercise formally captured and fed back into plan revisions
• Management review of continuity performance as a standing agenda item, not a special session before recertification

The connection to the rest of governance. Business continuity doesn’t operate in isolation from information security — a ransomware incident is both a security event and a continuity event, and organisations whose ISMS and BCMS are managed as separate, disconnected programmes routinely discover the gap between them during the incident they were both supposed to prepare for.