Resources
Determine what the BCMS needs to run and keep it provided through establishment, operation, maintenance and improvement, not only at implementation.
01What applies
Determine and provide the resources needed to establish, implement, maintain and continually improve the BCMS. The clause covers people, tools, space, information, supplier capacity and money. It expects the need to be determined rather than inherited, and the provision to be visible in a decision. The common failure is a resource base sized for the implementation project and then left to decay, so maintenance, exercises and supplier assessment quietly stop. A resource decision that is traceable to the objectives is also the strongest defence when a budget review arrives.
02Why it matters
Continuity work is cheap until it has to be maintained. The clause makes maintenance a resource commitment, not an act of goodwill. For the draft's process view, resources are an input to every process: an exercise programme without a facilitator is a process with no resource, and it will fail the first time it is tested. The clause also links the resource decision to top management, which is where it belongs.
03What good looks like
Write the resource need per process: who runs it, what it costs, what it needs from a supplier and what it needs from IT. Put the total in front of the executive who owns the BCMS, once a year, with the objectives it funds. Track the shortfalls the BCMS owner knows about and escalate them with the consequence, not just the request.
04Evidence an auditor asks for
Ask what the exercise programme costs and who approved it. If the answer is nobody, the resource was not determined.
| Evidence | The record |
|---|---|
| Determination | Documented resources the BCMS requires, per process |
| Provision | Budget, headcount or contracted capacity allocated to the BCMS |
| Review | Evidence the resourcing is revisited as the BCMS matures |
05Where it commonly fails
- Resource need never determined, so provision is whatever was left over
- Provision covers implementation only and lapses at maintenance
- Shortfalls known to the BCMS owner but never escalated
06What to do before the estimate
Cost the four processes that most often lapse: exercises, supplier assessment, impact analysis refresh and internal audit. Put the four numbers on one page.