Actions to address risks and opportunities
Plan for what could help or hinder the management system itself, and keep that register separate from the disruption risks handled in the impact analysis.
01What applies
Work out what could help or hinder the management system itself and plan what to do about it. The clause is about BCMS effectiveness, not about disruptions. A weak document control process, a vacant process owner role, a training budget that was cut, an audit programme that cannot be delivered: these are BCMS risks. The clause expects planned actions with owners, integration into BCMS processes, and an evaluation of whether the actions worked. It also expects opportunities, not only threats. Conflating this register with the disruption risk assessment hides the management system weaknesses that most often cause a nonconformity.
02Why it matters
Two risk registers, kept apart, give the auditor and the executive different things: one explains what could stop the organization delivering services, the other explains what could stop the BCMS working. Mixing them produces a single list that is too operational for the board and too managerial for the impact analysis. The clause protects the improvement agenda by giving management system weaknesses a place to be recorded and funded.
03What good looks like
Start a short register with four columns: issue, effect on BCMS effectiveness, action, owner and date. Seed it from the last audit findings, the vacant roles, the overdue reviews and the exercise actions that were never closed. Review it at the management review and close items with evidence, not assertion.
04Evidence an auditor asks for
Ask for the register that contains a risk to the BCMS itself. If the only register is the disruption risk assessment, this clause has no home.
| Evidence | The record |
|---|---|
| BCMS risk register | Risks and opportunities to BCMS effectiveness, kept distinct from disruption risk |
| Planned actions | Actions with owners and the BCMS process each is integrated into |
| Evaluation | Evidence the actions were evaluated for effect |
05Where it commonly fails
- BCMS risk conflated with disruption risk
- Opportunities omitted, leaving a one-sided register
- Actions planned but never integrated into a process or evaluated
06What to do before the estimate
Open the register with the last five audit findings and the three unfilled roles. Give each one an action, an owner and a date.