Leadership and commitment
Top management has to own the BCMS in practice: align it with strategy, integrate it into how the business runs, resource it, and hold managers accountable.
01What applies
Top management must personally own the BCMS. That means aligning the continuity policy and objectives with the strategic direction, integrating BCMS requirements into business processes, making resources available, communicating why effective continuity and conformity matter, holding the BCMS to its intended outcomes, directing and supporting the people who deliver it, promoting continual improvement, and backing other managers to lead continuity in their own areas. The clause is written to defeat the version where commitment is a signature on a policy. Integration is the operative word: continuity has to appear in the way products are launched, suppliers are chosen and change is approved.
02Why it matters
A BCMS fails from the middle when the top is not visibly behind it. The clause gives the auditor a set of observable behaviours rather than a sentiment. It also protects the BCMS owner: a resource decision that is made by top management is a decision that survives a budget cut. For the draft's process model, leadership is itself a process with inputs and outputs, so it can be measured like the others.
03What good looks like
Take the eight behaviours in the clause and write one artefact against each. Put continuity on the agenda of a forum that already has authority, not a separate meeting. Record the resource decision and the objectives it funds. Ask two managers below the top level what they are accountable for in a disruption, and fix the answer if it is vague.
04Evidence an auditor asks for
Ask a line manager outside the continuity team what they must do in the first hour of a disruption. If the answer is 'wait for the BC team', leadership has not been integrated.
| Evidence | The record |
|---|---|
| Direction | Minutes showing top management setting or approving policy and objectives |
| Integration | Evidence BCMS requirements appear in business process documentation and change approval |
| Resources | Budget or resource decision traceable to the BCMS |
| Accountability | Managers below top level held accountable for continuity in their areas |
05Where it commonly fails
- Commitment evidenced only by a signature on the policy
- Continuity funded from a residual budget with no decision behind it
- No demonstrable link between continuity objectives and strategic direction
06What to do before the estimate
Map the eight behaviours to one artefact each. Where there is no artefact, that is the next management review item.