9.3.2 Management review input
The review must take into account: where actions from earlier reviews stand; changes in the internal and external issues that matter to the BCMS; information on BCMS performance, including trends in nonconformities and corrective actions, results of monitoring and measurement, and audit results; feedback from interested parties; whether changes are needed, to policy and objectives among others, and which procedures and resources could lift performance and effectiveness; what the impact analysis and the risk assessment show; the result of evaluating continuity documentation and capabilities; risks or issues that no earlier risk assessment dealt with properly; lessons and actions coming out of disruptions and near misses; and chances for continual improvement.
Source: ISO 22301:2019, 9.3.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Review pack demonstrably covering every required input · Policy repository / GRC workspace
- Evidence that previously unaddressed risks were surfaced rather than dropped · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Trend data rather than point in time figures for nonconformities, measurement and audits · Policy repository / GRC workspace
- Near miss and disruption lessons presented with the actions arising · Policy repository / GRC workspace
- Interested party feedback captured and presented · Policy repository / GRC workspace
First move
Common gaps auditors find
- Input pack covering audit results and little else
- Near misses never captured, so the richest source of learning is absent
- Trends replaced by the current month, hiding deterioration
- Risks judged out of scope in an earlier assessment quietly disappear rather than being re presented
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet