Operational planning and control
Set criteria for each operational process, run it against them, keep the records, control planned change, review unintended change and control what suppliers do.
01What applies
Plan, carry out and control the processes needed to satisfy BCMS requirements and to take the actions decided on for risks and opportunities. Set criteria for the processes, control them against those criteria and keep enough documented information to be sure they were carried out as planned. Control planned changes, look at what unplanned changes have led to and act to limit any harm, and make sure that processes done by others and the supply chain are kept under control. This is the clause the public scope of ISO/DIS 22333 names explicitly: the process approach it asks users to incorporate.
02Why it matters
This is the spine of the draft. A process reference model only works if each process has a purpose, an outcome and a criterion you can check. The clause gives the organization the discipline to write those criteria and the evidence to show the process ran. It also closes the common gap where a supplier is named in a contract but nobody has verified that the supplier's process actually delivers.
03What good looks like
For each operational process write one line: purpose, criteria, record, owner. Then test the record: does it show the process ran to the criteria. Add a change note for planned change and a short review for unintended change. For outsourced processes, add a verification step, not only a contract clause.
04Evidence an auditor asks for
Pick a process and ask for the criterion it is run to and the record from last month. If either is missing, the process is not controlled.
| Evidence | The record |
|---|---|
| Criteria | Documented process criteria for each BCMS operational process |
| Records | Records showing the processes ran to those criteria |
| Change | Records of planned change and reviews of unintended change |
| External | Verified control over outsourced processes and the supply chain |
05Where it commonly fails
- Supply chain control asserted in contract clauses with no verification
- Criteria absent, so control of a process cannot be demonstrated
- Unintended changes never reviewed because nothing detects them
06What to do before the estimate
Write the four-line definition for each operational process. Start with the three that touch the most critical service.