Purpose and outcomes as the unit of description
Describe each process by what it is for and what it must achieve, then judge whether it achieved it, instead of asking whether the clause was followed.
Basis: Our reading, from the public scope and the held clause set. The draft text is not public. This page reads the public scope and the held ISO 22301:2019 clause set, and does not quote either as draft text.
01What applies
A process reference model describes a process by its purpose and its outcomes. The purpose says why the process exists. The outcomes say what must be true when it has worked. For a BCMS, that means a business impact analysis is not described as a list of steps but as the process that establishes what disruption would cost over time and sets recovery priorities. The outcomes are then observable: a set of recovery targets that trace to an impact over time, approved by management, and used by the strategy process. The clause set supplies the substance; the model supplies the form.
02Why it matters
The form changes what an audit can ask. Instead of did you complete the template, the auditor can ask did this process produce the outcome the next process needs. That question finds the handoff failures that a clause checklist misses. It also gives a new process owner a clearer brief.
03What good looks like
Write a one-page process sheet: purpose, outcomes, owner, inputs, outputs, interfaces, measures, records. Use the outcomes as the audit criteria for that process. Review the sheet when the process changes. Keep the clause reference on the sheet so the link to the requirement is visible.
04Evidence an auditor asks for
Ask an auditor what they would look for to know the BIA worked. If the answer is a completed template, the outcomes are not defined.
| Evidence | The record |
|---|---|
| Process sheets | Purpose, outcomes, interfaces and measures for each core process |
| Audit criteria | Audit questions written from the outcomes |
| Outcome records | Evidence the outcome was achieved in the last cycle |
05Where it commonly fails
- Process sheets that list activities only
- Outcomes that cannot be observed in a record
- No interface recorded between two processes that depend on each other
06What to do before the estimate
Write the process sheet for the BIA and for the strategy process. Check that the BIA output is the strategy input.