Understanding the organization and its context
The BCMS has to rest on a written view of what could stop it delivering continuity, inside and outside the organization, kept current as the business changes.
01What applies
Identify the external and internal issues that bear on the organization's purpose and that could stop the BCMS delivering what it is meant to deliver. Read them against the organization's objectives, what it provides, and how much risk, and of what kinds, it is prepared to carry. The clause expects the issues to be specific enough to trace to a continuity outcome. It is not a general threat scan: an issue that cannot be linked to a product, a service or a BCMS outcome has no place in the record. The analysis is a living input to scope, impact analysis and strategy, not a document produced for the certification file.
02Why it matters
A context analysis is the difference between a BCMS that fits this organization and a template that fits any organization. When the analysis is real, the scope decision, the impact criteria and the strategy choice all have a reason a reader can follow. When it is generic, every later decision looks arbitrary, and the auditor can tell. The clause also forces the risk appetite into the open, which is the only way to judge whether a chosen continuity solution is proportionate.
03What good looks like
Write the external issues as forces with a named effect: a customer contract that requires a recovery time, a regulator that requires notification, a supplier with no alternative, a labour market that makes a key role hard to replace. Write the internal issues as constraints: a single site, a legacy system, a recent acquisition, a thin finance function. For each, name the BCMS outcome it threatens and the appetite the organization has set. Review it at the management review and whenever the organization changes shape.
04Evidence an auditor asks for
Ask the BCMS owner to name the three external issues most likely to break continuity this year and the appetite that decides how much is spent on each. If the answer is a list of categories rather than named issues, the analysis is a template.
| Evidence | The record |
|---|---|
| Context analysis | A dated analysis naming external and internal issues, each linked to a BCMS outcome |
| Risk appetite | The appetite the analysis was judged against, approved by the executive |
| Review record | Evidence the analysis was revisited after a reorganisation, acquisition or product change |
05Where it commonly fails
- Context recorded once at certification and never revisited
- Issues listed generically with no traceable effect on a BCMS outcome
- Internal issues omitted, so the analysis reads as an external threat scan
06What to do before the estimate
Book one hour with the executive who owns risk appetite. Produce a two-column list: issue, and the continuity outcome it threatens. Mark the three that changed since the last review.