Clause 10: Improvement

Requirement
The organisation must determine improvement opportunities and implement necessary actions to achieve the BCMS’s intended outcomes. When a nonconformity occurs, the organisation must react to it, evaluate the need for root-cause corrective action, implement needed action, review effectiveness, and make BCMS changes if necessary. Corrective actions must be appropriate to the effects of the nonconformities encountered, and documented information must be retained as evidence of the nature of nonconformities, subsequent actions, and corrective action results.

How to Implement
When something goes wrong, whether a failed control, an audit finding, or a real disruption that exposed a gap, log it immediately and investigate the root cause rather than just fixing the immediate symptom. Since disruptions themselves are often the richest source of lessons learned, build a structured post-incident review into your process, separate from the post-exercise reports required under 8.5, so real events and simulated ones both feed into improvement.

Mandatory Documents
Yes, explicitly mandatory. You must maintain:

• A Nonconformity and Corrective Action Register, recording nonconformities, actions taken, and corrective action results

Requirement
The organisation must continually improve the suitability, adequacy, and effectiveness of the BCMS, based on qualitative and quantitative measures, considering results of analysis and evaluation and management review outputs to determine needs or opportunities for improvement.

How to Implement
Treat improvement as continuous, drawing on exercise results, audit findings, BIA updates, and management review decisions throughout the year rather than only at the annual review. Since the standard explicitly calls out both qualitative and quantitative measures, make sure your improvement case draws on both hard metrics (RTO achievement) and softer indicators (staff confidence after an exercise, quality of interested party feedback).

Mandatory Documents
There is no explicit “shall be available as documented information” statement tied specifically to 10.2 itself. Improvement activity is evidenced through the mandatory records of other clauses, particularly management review decisions and corrective action results.