Clause 9 : Performance Evaluation

Requirement
The organisation must determine what needs to be monitored and measured, the methods to use, when and by whom monitoring and measurement are performed, and when and by whom results are analysed and evaluated. Documented information must be retained as evidence of results. The organisation must evaluate BCMS performance and effectiveness.

How to Implement
Define metrics that go beyond simple activity counts, for example, RTO achievement rates in exercises, time to activate response teams, or percentage of prioritised activities with tested solutions. Assign clear ownership for collecting and analysing this data, and feed it directly into management review.

Mandatory Documents
Yes, explicitly mandatory. ISO 22301 states the organisation “shall retain appropriate documented information as evidence of the results.” You must keep:

• Records of monitoring and measurement results

Requirement
9.2.1 General requires internal audits at planned intervals to check whether the BCMS conforms to the organisation’s own requirements and the standard, and is effectively implemented and maintained. 9.2.2 Audit Programme(s) requires planning, establishing, implementing, and maintaining an audit programme considering process importance and previous audit results, defining audit criteria and scope, selecting auditors to ensure objectivity, reporting results to relevant managers, retaining documented evidence of the programme and results, ensuring corrective actions are taken without undue delay, and ensuring follow-up audits verify that actions taken were effective.

How to Implement
Build an annual audit schedule covering every clause and, critically, the BCMS-specific elements in Clause 8 (BIA currency, strategy relevance, plan usability). Since the standard explicitly requires corrective actions “without undue delay” and follow-up verification, build a tracked timeline for closing audit findings rather than letting them sit open indefinitely.

Mandatory Documents
Yes, explicitly mandatory. You must maintain:

• An Internal Audit Programme
• Internal Audit Reports with evidence of implementation, findings, and verified follow-up actions

Requirement
9.3.1 General requires top management to review the BCMS at planned intervals for continuing suitability, adequacy, and effectiveness. 9.3.2 Management Review Input requires considering previous action status, changes in issues relevant to the BCMS, performance trends (nonconformities, monitoring results, audit results), interested party feedback, the need for BCMS changes, available resources and procedures for improvement, information from the BIA and risk assessment, output from the 8.6 evaluation, risks not adequately addressed in previous assessments, lessons learned from near-misses and disruptions, and improvement opportunities. 9.3.3 Management Review Outputs requires decisions on continual improvement and BCMS changes, including scope variations, updates to the BIA/risk assessment/strategies/plans, procedure modifications, and how control effectiveness will be measured, with results communicated to relevant interested parties and acted upon.

How to Implement
Schedule management reviews at least annually and treat the agenda as genuinely comprehensive, since ISO 22301’s list of required inputs is notably more detailed than most other Annex SL standards, reflecting how much BCMS-specific data (BIA outputs, exercise results, near-misses) needs to reach top management. Document not just the discussion but the specific decisions made, and make sure those decisions are actually communicated back out to relevant interested parties, since this communication step is an explicit requirement, not an afterthought.

Mandatory Documents
Yes, explicitly mandatory. You must maintain:

• Management Review Minutes/Records, covering all required inputs and outputs, with evidence that results were communicated and acted upon