According to ISO 22301:2019, clause 10, improvement consists of two elements: nonconformity and corrective action, and continual improvement. Nonconformity and corrective action is the process of identifying and addressing any deviations from the requirements of the standard or the organization’s own policies and procedures. It involves taking actions to eliminate the causes of nonconformities, prevent their recurrence, and reduce their impact. Continual improvement is the process of enhancing the suitability, adequacy, and effectiveness of the BCMS and its performance. It involves identifying and implementing opportunities for improvement based on the results of monitoring, measurement, analysis, evaluation, internal audit, and management review. References: : ISO 22301 Auditing eBook, page 11 : ISO 22301:2019, clause 10 : ISO 22301: Clause 10 - Improvement – ISO Templates and Documents Download : ISO 22301 continuous improvement – How to achieve it - Advisera

The key areas of exercise are organisation and plans. According to the ISO 22301 Auditing eBook1, an exercise is a process to train for, assess, practice, and improve performance in an organization. The purpose of an exercise is to evaluate the organization’s capability to respond to a disruptive incident and implement its business continuity plans. Therefore, the key areas of exercise are the organization itself, which includes its structure, roles, responsibilities, resources, and culture, and the plans that define the objectives, scope, scenarios, procedures, and evaluation criteria of the exercise. These two areas are essential to ensure that the exercise is realistic, relevant, effective, and aligned with the organization’s business continuity objectives and expectations. References:

• ISO 22301 Auditing eBook, page 71
• ISO 22301:2019, clause 8.5

 Business Impact Analysis (BIA) is a process of identifying and evaluating the potential impacts of disruptions to critical business processes, systems, and resources. One of the objectives of BIA is to validate the dependencies of the organization’s essential functions and operations. Dependencies are the relationships or interconnections between the organization and its internal or external stakeholders, such as suppliers, customers, partners, regulators, etc. Dependencies can affect the organization’s ability to deliver its products and services, and therefore, they need to be considered in the BIA process. According to ISO/TS 22317:2021, there are two types of dependencies that are validated by BIA: internal dependencies and external dependencies1. Internal dependencies are the dependencies within the organization, such as between different functions, processes, activities, resources, or locations. For example, a production function may depend on the supply of raw materials from a warehouse, or a finance function may depend on the availability of an accounting system. Internal dependencies can be identified by analyzing the inputs and outputs of each function or process, and the resources required to support them. External dependencies are the dependencies outside the organization, such as with suppliers, customers, partners, regulators, or other stakeholders. For example, a retail company may depend on the delivery of goods from its suppliers, or a bank may depend on the compliance with regulatory requirements. External dependencies can be identified by analyzing the contracts, agreements, or expectations with the external parties, and the potential impacts of their failure or disruption. References:

• ISO/TS 22317:2021, clause 6.3.2

When designing questionnaires for the BIA, the following factors should be considered1:

• Concise information: The questionnaires should provide clear and concise information about the purpose, scope, and objectives of the BIA, as well as the instructions on how to complete them. The questionnaires should also avoid unnecessary or redundant questions that could confuse or frustrate the respondents.
• Layout: The questionnaires should have a logical and consistent layout that facilitates the readability and comprehension of the questions. The questionnaires should use appropriate fonts, colors, spacing, and numbering to highlight the key points and sections. The questionnaires should also use tables, charts, or graphs to present the data or information in a structured and visual way.
• Types of question: The questionnaires should use different types of questions to elicit the required information from the respondents. The questionnaires should use open-ended questions to allow the respondents to provide their own opinions or explanations, closed-ended questions to obtain specific or quantitative data, and rating or ranking questions to measure the relative importance or priority of the factors or criteria.
• Level of detail: The questionnaires should provide the appropriate level of detail for the BIA. The questionnaires should not be too general or vague, as this could lead to inaccurate or incomplete results. The questionnaires should not be too specific or technical, as this could overwhelm or intimidate the respondents. The questionnaires should balance the depth and breadth of the information needed for the BIA.

References: 1: ISO 22301 Auditing eBook, Chapter 5: Business Impact Analysis and Risk Assessment, Section 5.2: Business Impact Analysis, Subsection 5.2.3: Data Collection Methods, Page 69.

 According to the ISO 22301 Auditing eBook, there are three types of personal interview, which differ in terms of the structure, purpose and depth of information to be elicited. They are:

• Fully structured interview: This type of interview follows a predefined set of questions that are asked in a fixed order. The interviewer does not deviate from the script and does not probe for additional information. The advantage of this type of interview is that it ensures consistency and comparability of data across different interviewees. The disadvantage is that it may not capture the nuances and complexities of the interviewee’s responses, and may miss some important information that is not covered by the questions.
• Semi-structured interview: This type of interview has a general outline of topics or questions to be covered, but the interviewer has the flexibility to ask follow-up questions, clarify ambiguities, and explore new areas of interest that emerge during the conversation. The advantage of this type of interview is that it allows for a deeper and richer understanding of the interviewee’s perspectives, opinions, and experiences. The disadvantage is that it may introduce some variability and bias in the data collection and analysis, depending on the interviewer’s skills and style.
• Unstructured interview: This type of interview has no predetermined agenda or questions, and the interviewer relies on the natural flow of the conversation to guide the discussion. The interviewer may use some open-ended prompts or probes to elicit more information, but the interviewee has the freedom to express whatever they want. The advantage of this type of interview is that it can reveal unexpected and insightful information that may not be obtained through other methods. The disadvantage is that it may be difficult to manage, control, and summarize the data, and it may require more time and resources to conduct and analyze.

References: : ISO 22301 Auditing eBook, Chapter 5: Audit Techniques, Section 5.2: Personal Interview, Page 63-64.

1of30