ISO 22301:2019 (Business Continuity Management Systems) Awareness Training

© Operational Excellence Consulting
ISO 22301:2019
Security & Resilience –
Business Continuity Management Systems
© Operational Excellence Consulting. All rights reserved.

LEARNING OBJECTIVES
2
Provide background
knowledge of ISO
22301
Describe the audit
approach and learn
useful tips for
handling an audit
session
Gain an overview of
the ISO 22301:2019
structure
Understand the ISO
22301:2019
certification process
NOTE: This is a PARTIAL PREVIEW.
To download the complete presentation, please
visit: https://www.oeconsulting.com.sg

CONTENTS
3
OVERVIEW OF
ISO 22301
ISO 22301:2019
STRUCTURE
ISO 22301:2019
CERTIFICATION
PROCESS
AUDIT APPROACH
01 04
03
02
HANDLING AN
AUDIT SESSION
05

95%
of global business leaders report that their crisis management
capabilities need improvement.
4
Source: PwC Global Crisis Survey 2021

51%
of companies across the globe don’t have a business continuity plan.
5
Source: Mercer, 2020

● ISO 22301 is an International
Standard for implementing and
maintaining effective business
continuity plans, systems and
processes
● It establishes a framework for
industrial plants or entire companies
to manage all aspects of business
continuity
● Applies to all types and sizes of
organizations
WHAT IS ISO 22301?
© Operational Excellence Consulting 6

OBJECTIVE OF ISO 22301
7
ISO 22301:2019 specifies requirements to implement,
maintain and improve a management system to
protect against, reduce the likelihood of the
occurrence of, prepare for, respond to and recover
from disruptions when they arise.

WHAT IMPROVEMENTS WERE MADE TO ISO 22301:2019?
8
The structure of the
standard has been
reviewed to make it
easier to read and
implement, with greater
clarification of what is
required
The language and
terminology have been
simplified to remove
duplication and better
reflect today’s thinking in
the business continuity
industry
The High Level Structure
(HLS) has been
streamlined to remain in
line with all other ISO
management system
standards

WHO CAN USE ISO 22301?
9
Implement, maintain
and improve a BCMS
Seek to ensure
conformity with stated
business continuity
policy
Need to be able to
continue to deliver
products and services
at an acceptable
predefined capacity
during a disruption
Seek to enhance their
resilience through the
effective application of
the BCMS
ISO 22301 is applicable to all types and sizes of organizations that:

BENEFITS TO AN ORGANIZATION FOR IMPLEMENTING A BUSINESS
CONTINUITY MANAGEMENT SYSTEM
10
Help organizations respond
to, and recover from,
disruptions effectively
Reduced costs and less impact
on business performance
should something go wrong
Provides ability to reassure
clients, suppliers, regulators
and other stakeholders
Companies with multiple sites
can rely on the same
consistent approach
A better understanding of
critical issues and areas of
vulnerability
Improved business
performance and
organizational resilience

ADVANTAGES OF CERTIFICATION
● Certification to ISO 22301 is
voluntary
● Independent check of conformity by a
third party
● Indicates an effective Business
Continuity Management System
● National/International recognition
● Provides competitive advantage
● Improves company image
11
11

● Identifying potential risks, likelihood
and consequences
● Documenting assumptions and criteria
● Identifying activities by risk
classification in order of priority
● Allocating necessary resources to risk
management plan
● Documenting results and develop a
Risk Management Action plan
RISK-BASED THINKING
12
Risk
Evaluation
Risk
Analysis
Risk
Identification
Risk Assessment
Risk Treatment
Scope, Context, Criteria
COMMUNICATION
&
CONSULTATION
MONITORING
&
REVIEW
RECORDING & REPORTING

ISO 22301:2019 IS BASED ON THE ISO HIGH-LEVEL STRUCTURE FOR
MANAGEMENT SYSTEM STANDARDS
13
1. Scope
2. Normative References
3. Terms & Definitions
4. Context of the Organization
5. Leadership
6. Planning
7. Support
8. Operation
9. Performance Evaluation
10. Improvement

HLS – THE SAME CORE ELEMENTS
14
Environment
ISO 14001
Food Safety
ISO 22000
Quality Management
ISO 9001
Occupational
Health & Safety
ISO 45001
THE SAME
CORE
ELEMENTS

ISO 22301:2019 IS BASED ON THE PDCA MODEL
15
Source: Adapted from ISO
SCOPE OF THE BUSINESS CONTINUITY MANAGEMENT SYSTEM
IMPLEMENT
& OPERATE
THE BCMS
ESTABLISH
BCMS
MAINTAIN &
IMPROVE
THE BCMS
MONITOR
& REVIEW
THE BCMS
Plan Do
Check
Act
INTERNAL &
EXTERNAL
ISSUES
NEEDS &
EXPECTATIONS
OF INTERESTED
PARTIES
INTENDED
OUTCOMES OF
THE BCMS

ISO 22301:2019 KEY CLAUSE STRUCTURE (4-10)
PLAN DO CHECK ACT
4. Context of the
organization
5. Leadership 6. Planning 7. Support 8. Operation 9. Performance
evaluation
10. Improvement
4.1 Understanding the
organization and its
context
5.1 Leadership and
commitment
6.1 Actions to address
risks and opportunities
7.1 Resources 8.1 Operational planning
and control
9.1 Monitoring,
measurement, analysis
and evaluation
10.1 Nonconformity and
corrective action
4.2 Understanding the
needs and expectations
of interested parties
5.2 Policy 6.2 Business continuity
objectives and plans to
achieve them
7.2 Competence 8.2 Business impact
analysis and risk
assessment
9.2 Internal audit 10.2 Continual
improvement
4.3 Determining the
scope of the BCMS
5.3 Roles,
responsibilities and
authorities
6.3 Planning changes to
the BCMS
7.3 Awareness 8.3 Business continuity
strategies and solutions
9.3 Management review
4.4 Business continuity
management system
7.4 Communication 8.4 Business continuity
plans and procedures
7.5 Documented
information
8.5 Exercise programme
8.6 Evaluation of
business continuity
documentation and
capabilities

THE PDCA CYCLE IS THE ENGINE OF CONTINUOUS IMPROVEMENT
17
Consolidation
through
Standardization
Improvement
P
D
C
A
P
D
C
A
Current
Standard
New
Standard
Time
Continuous
Improvement

● The certification body examines the
BCMS for conformity to the ISO
22301:2019 standard
● The BCMS audit is a compliance
audit
● Certification means the organization
has a documented BCMS that is
fully implemented and meets ISO
22301:2019 requirements
BECOMING ISO 22301:2019
CERTIFIED
18

ISO 22301:2019 CERTIFICATION PROCESS
3 5 7
1 4 6
2
Implementation of BCMS Selection of a
Certification Body
Stage 2 Audit Continual Improvement
and Surveillance Audits
Conduct Internal Audit
and Review Result by
Top Management Stage 1 Audit
Confirmation of
Registration

WHAT DOES CERTIFICATION ASSURE?
20
Regular assessment to
continually monitor and
improve processes
Credibility that the
system can achieve its
intended outcomes
Reduced risk and
uncertainty and
increase market
opportunities
Consistency in the
outputs designed to
meet stakeholder
expectations

● Systematic, independent and
documented process for obtaining
audit evidence and evaluating it
objectively to determine the extent
to which audit criteria are fulfilled
● Audit criteria
○ Processes or procedures
○ Standards
WHAT IS AN AUDIT?
21

WHAT ARE AUDITS USED FOR?
22
Auditing conformity
Auditing effectiveness
Looking at the overall process
Approving external service providers
Investigating problems
Way of improving
Assessing for certification
Highlight examples of good practice

● Focuses on employees’
understanding of the organization’s
processes and verifies that these
processes are:
o complied with
o under control
o achieving the desired results
● Provide evidence, e.g. records,
meeting minutes, reports, data and
emails
AUDIT APPROACH
23

AUDIT FINDINGS
24
MAJOR NONCONFORMITY
§ A major nonconformity
relates to the absence or
total breakdown of a required
process or a number of
minor nonconformities listed
against similar areas
§ A major nonconformity at the
Registration Audit would
defer recommendation for
registration until that major
has been closed
MINOR NONCONFORMITY OBSERVATION
§ A minor nonconformity is an
observed lapse in your
systems ability to meet the
requirements of the standard
or your internal systems,
while the overall process
remains intact
§ An observation or
opportunity for improvement
relates to a matter about
which the Auditor is
concerned but which cannot
be clearly stated as a non-
conformity
§ Observations also indicate
trends which may result in a
future nonconformity

HOW TO HANDLE AN AUDIT SESSION?
25
Ask and clarify
Admit obvious non-conformities
Do not panic
Take note of improvement areas
highlighted by the auditor
Show internal audit report, when
necessary
Offer evidence and explain patiently

● Polite
● Professional
● Positive / Receptive
● Sincere
● Commitment
● Formal but not overly serious
AUDITEE’S CONDUCT
26

● Be honest and open
● Recognize they may be experts
● Realize they may not be subject
matter experts
● Understand the purpose of the
meeting and review related
records prior to interviews
INTERACTING WITH AUDITORS – DO’S
● Turn mobile phones to silent mode
● Get the right person in to answer
the question
● Listen carefully and understand
each question before answering –
Be sure responses are complete
and accurate
27

Operational Excellence Consulting is a management training
and consulting firm that assists organizations in improving
business performance and effectiveness. Based in Singapore,
the firm’s mission is to create business value for organizations
through innovative design and operational excellence
management training and consulting solutions. For more
information, please visit www.oeconsulting.com.sg
ABOUT OPERATIONAL EXCELLENCE CONSULTING

ISO 22301:2019 (Business Continuity Management Systems) Awareness Training

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a ISO 22301:2019 (Business Continuity Management Systems) Awareness Training

Semelhante a ISO 22301:2019 (Business Continuity Management Systems) Awareness Training (20)

Mais de Operational Excellence Consulting

Mais de Operational Excellence Consulting (20)

Último

Último (20)

ISO 22301:2019 (Business Continuity Management Systems) Awareness Training