What evidence do auditors commonly ask for on 6.3 Planning changes to the business continuity management system?

Change records for BCMS changes showing purpose and consequence analysis; Assessment of the effect on BCMS integrity; Resource and accountability reallocation recorded with the change.

What is the most common gap auditors find on 6.3?

BCMS changes made informally, visible only as an unexplained document version bump

ISO 22301:2019 · Planning, ISO 22301:2019

`6.3` Planning changes to the business continuity management system

Where the BCMS has to change, including changes prompted by nonconformity or improvement, make the change in a planned way, weighing why it is being made and what it could lead to, whether the BCMS stays intact, whether enough resources are available, and how responsibilities and authorities are assigned or moved.

Source: ISO 22301:2019, 6.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.

artefacts

held by a system

at each review

moderate

to go live

Ticketing / ITSM

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Change records for BCMS changes showing purpose and consequence analysis · Ticketing / ITSM

periodic reviewEvidence produced at each review

Assessment of the effect on BCMS integrity · Ticketing / ITSM

governing documentDocuments that govern the control

Resource and accountability reallocation recorded with the change · Policy repository / GRC workspace

First move

Start with the 1 of 3 artefacts that already live in a system (Ticketing / ITSM); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

BCMS changes made informally, visible only as an unexplained document version bump
Consequence analysis skipped for changes that originated as corrective actions
Responsibilities left with departed staff after a reorganisation

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

6.2.2 Determining business continuity objectives · 7.1 Resources