Evaluation of documentation and capabilities
Evaluate whether the analysis, strategy, solutions, plans and procedures are still suitable, adequate and effective, including the capability of key partners and compliance with the law.
01What applies
Evaluate whether the impact analysis, the risk assessment, the strategies, the solutions, the plans and the procedures are still suitable, adequate and effective. Do this through reviews, analysis, exercises, tests, reports after incidents and performance evaluations. Evaluate the continuity capabilities of the partners and suppliers that matter. Evaluate whether applicable laws, regulations and industry practice are complied with, and whether the organization's own policy and objectives are met. Update documentation and procedures without delay. Carry out the evaluations at planned intervals, after any incident or activation, and whenever significant change happens.
02Why it matters
The clause is the quality gate for the whole continuity capability. It stops the organization from assuming that last year's plan still fits this year's business. It also puts supplier capability and legal compliance inside the evaluation, where they are usually separate. The requirement to update without delay is what closes the loop between finding and plan.
03What good looks like
Build an evaluation calendar with three triggers: planned interval, incident or activation, significant change. For each element of the plan set, name the evidence you will look at. Add a supplier capability assessment with verification behind it, not only a questionnaire. Record the legal and regulatory check. Update the plan and record the change.
04Evidence an auditor asks for
Ask what changed in the plan after the last exercise or incident. If nothing changed, the evaluation did not reach the documentation.
| Evidence | The record |
|---|---|
| Evaluation records | Evaluation covering each element of the BCMS documentation set |
| Suppliers | Partner and supplier continuity capability assessments with evidence behind them |
| Compliance | Compliance and conformity evaluation results |
| After an incident | Post-incident and post-activation evaluations |
| Updates | Documentation update records traceable to the findings |
05Where it commonly fails
- Supplier continuity accepted on a self-assessment with nothing verified
- Evaluation performed only on the anniversary, never after an activation
- Findings raised but documentation not updated
06What to do before the estimate
Add the three triggers to the calendar. For the next evaluation, list the evidence for each element before the meeting.