8.1 Operational planning and control
Plan, carry out and control the processes needed to satisfy BCMS requirements and to take the actions decided on for risks and opportunities, by setting criteria for the processes, controlling them against those criteria and keeping enough documented information to be sure they were carried out as planned. Control planned changes, look at what unplanned changes have led to and act to limit any harm, and make sure that processes done by others and the supply chain are kept under control.
Source: ISO 22301:2019, 8.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Change records covering planned changes and reviews of unintended change · Document repository
periodic reviewEvidence produced at each review
- Records showing processes ran to those criteria · Document repository
- Evidence of control over outsourced processes and the supply chain · Vendor register / contract repository
governing documentDocuments that govern the control
- Documented process criteria for BCMS operational processes · Document repository
First move
Common gaps auditors find
- Supply chain control asserted through contract clauses with no verification behind them
- Criteria absent, so control of a process cannot be demonstrated
- Unintended changes never reviewed because nothing detects them
- Outsourced processes treated as the provider's problem
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.5.3 Control of documented information · 8.2 Business impact analysis and risk assessment