ISO 22301 Clause 9 - Performance Evaluation

Clause 9 is where the BCMS gets checked. The clause has three sub-parts: ongoing monitoring and measurement of BCMS performance, periodic internal audit of conformance with the standard and with the organisation's own requirements, and management review of the BCMS as a whole. Together these are the feedback loop that tells top management whether the system is working and what needs to change.

Sub-clauses of ISO 22301 Clause 9

Clause 9.1 - Monitoring, Measurement, Analysis and Evaluation requires the organisation to determine what needs to be monitored and measured, the methods to be used to ensure valid results, when monitoring and measuring will take place, and who will analyse and evaluate the results. Documented information must be retained as evidence of the results, and the BCMS performance and effectiveness must be evaluated. In practice this is met through a mix of objective tracking, exercise outcomes, audit results and incident reviews, with conclusions recorded in the management review.

Clause 9.2 - Internal Audit requires the organisation to conduct internal audits at planned intervals to confirm the BCMS conforms to the standard and the organisation's own requirements and is effectively implemented and maintained.

Clause 9.3 - Management Review requires top management to review the BCMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness.