Documented information
Keep the information the BCMS depends on, create and update it to a defined standard, and control it through its life: approval, access, retention and disposition.
01What applies
Hold the documented information the BCMS depends on, create and update it to a defined standard, and control it throughout its life. The clause requires the information to be identified and described, in a suitable format and reviewed and approved for suitability and adequacy. Control covers availability, protection from loss of integrity, and distribution, access, retrieval and use. It also covers retention and disposition, and documents of external origin that the BCMS depends on. The register is the test: a document that exists but is not in the register is not controlled.
02Why it matters
In a disruption, the plan that gets used is the one someone can find. The clause is unglamorous and it is where most audit findings live. It also matters more in a process model, because the process register, the criteria and the handoff records are all documented information. If they are not controlled, the model cannot be audited.
03What good looks like
Build one register with columns for owner, version, approval, location, access and retention. Include external documents such as supplier certificates and regulator guidance. Set a review cadence per document type. Test retrievability by asking a responder to find the current plan in under two minutes without help.
04Evidence an auditor asks for
Ask a responder to find the current continuity plan and the last exercise report. Time it. Anything over two minutes is a control failure.
| Evidence | The record |
|---|---|
| Register | A document register covering the BCMS, with owner, version and approval |
| Creation and update | A defined creation, update, review and approval route in use |
| Control | Access, retention and disposition rules applied, including external origin documents |
05Where it commonly fails
- Register incomplete, so documents exist that nothing controls
- External origin documents excluded from control
- Retention rules stated but never applied
06What to do before the estimate
Audit the register against the files people actually use. Add the missing rows and delete the ones that no longer exist.