The BCMS and its processes
Establish, operate, maintain and improve the BCMS, including the processes it needs and how they interact, and be able to show the system ran rather than existed.
01What applies
Set up a BCMS, put it into effect, keep it running and keep improving it, including the processes it needs and how they interact. The clause is the anchor for the draft's process view: a BCMS is a set of interacting processes, not a shelf of documents. The interactions matter because the handoffs are where continuity work usually breaks. Impact analysis hands priorities to strategy, strategy hands solutions to planning, planning hands plans to exercise, exercise hands findings to evaluation, and evaluation hands changes back to the process owners. The evidence has to show a full cycle, not implementation only.
02Why it matters
A system description is the map a new process owner needs and the map an auditor uses to choose a sample. Without it, every audit samples documents and nobody sees the seams. With it, the organization can answer the question the draft is built around: does this process produce the outcome the next process depends on. The clause also makes continual improvement structural rather than aspirational.
03What good looks like
Write one page with the processes as boxes and the handoffs as arrows, each arrow labelled with the record that travels. Name an owner per box. Add a column for the clause the process serves. Test the map by tracing one disruption from warning to recovery and marking where the record changes hands. Fix the handoffs that have no record.
04Evidence an auditor asks for
Trace a single incident through the process map. Every handoff should have a record. The handoff with no record is the finding.
| Evidence | The record |
|---|---|
| System description | BCMS manual or equivalent showing the processes and their interactions |
| Owners | A named process owner for every BCMS process |
| Operation | Evidence of at least one full cycle of operation, not implementation only |
05Where it commonly fails
- A documented system that exists on paper with no evidence any process ran
- Process interactions undocumented, so handoffs are invisible
- Continual improvement asserted but not evidenced anywhere
06What to do before the estimate
Draw the map on one page. Mark the handoffs with no record, and give each one an owner and a fix date.