10.2 Continual improvement
Keep making the BCMS more suitable, adequate and effective, using both qualitative and quantitative measures, and use what analysis and evaluation show, together with what management review produces, to decide whether business or BCMS needs or opportunities have to be dealt with as part of improvement.
Source: ISO 22301:2019, 10.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of improvements delivered over successive cycles · Document repository
governing documentDocuments that govern the control
- Improvement register or backlog with items traceable to analysis, evaluation or management review · Policy repository / GRC workspace
- Both qualitative and quantitative measures in use · Document repository
- Link from business change into the improvement determination · Document repository
First move
Common gaps auditors find
- Improvement evidenced only by corrective actions, so nothing improves that was not first broken
- Quantitative measures only, missing qualitative signals from exercises and near misses
- Improvement register that accumulates items and closes none
- Business needs never considered, so the BCMS improves against itself rather than against the organization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet