8.6 Evaluation of business continuity documentation and capabilities
Evaluate whether the impact analysis, the risk assessment, the strategies, the solutions, the plans and the procedures are still suitable, adequate and effective. Do this through reviews, analysis, exercises, tests, reports after incidents and performance evaluations; evaluate the continuity capabilities of the partners and suppliers that matter; evaluate whether applicable laws, regulations and industry practice are complied with, and whether the organization's own policy and objectives are met; and update documentation and procedures without delay. Carry out these evaluations at planned intervals, after any incident or activation, and whenever significant change happens.
Source: ISO 22301:2019, 8.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Compliance and conformity evaluation results · Document repository
periodic reviewEvidence produced at each review
- Evaluation records covering each element of the BCMS documentation set · Document repository
- Partner and supplier continuity capability assessments with evidence behind them · Vendor register / contract repository
- Post incident and post activation evaluations · Document repository
governing documentDocuments that govern the control
- Documentation update records traceable to evaluation findings · Document repository
First move
Common gaps auditors find
- Supplier continuity accepted on a self assessment questionnaire with nothing verified
- Evaluation performed only on the anniversary, never after an actual activation
- Findings raised but documentation not updated, so the next responder uses the superseded version
- Legal and regulatory compliance evaluation omitted from the continuity evaluation entirely
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.5 Exercise programme · 9.1 Monitoring, measurement, analysis and evaluation