A worked example, labelled as a specimen
A fictional mid-size utility with a certified BCMS. The situation is common: a surveillance audit in seven months, a new head of risk, and a board question about a draft nobody can read.
The reading
The utility answers the free check: certified, ISO 22301:2019 cited, audit in seven months, processes described only by clause, impact analysis refreshed two years ago, an exercise planned, suppliers self-assessed, a customer contract names the edition, and the board has asked. The score puts it in plan this cycle.
The three actions the check returns
- Name an owner and a deputy for each of 8.1 to 8.6, and test the assignment by asking each holder to state their authority.
- Refresh the impact analysis: impact over time, the maximum tolerable period, the resumption time frames and the minimum acceptable capacity.
- Choose the three critical suppliers and verify one continuity claim each. A questionnaire is not verification.
The dated plan
| Window | Work | Owner | Evidence |
|---|---|---|---|
| Month 1 | Process owners and deputies named for 8.1 to 8.6 | Head of risk | Responsibility matrix, holders confirmed |
| Month 1 to 2 | Impact analysis refreshed for the three critical services | Service owners | Impact over time, MTPD, time frames approved |
| Month 2 to 3 | Strategy traceability check against the new targets | Head of risk | Selection rationale, resource per solution |
| Month 3 to 4 | Supplier verification for three critical suppliers | Procurement | Verified capability evidence |
| Month 4 to 5 | Exercise with a stated aim, testing one untested strategy | Exercise lead | Aim, report, actions tracked |
| Month 5 to 6 | Internal audit of three processes and their handoffs | Audit lead | Programme, report, findings |
| Month 6 to 7 | Management review with the process view and the evidence | Executive sponsor | Inputs, decisions, actions |
What the board note says
The draft is a guidance document at stage 40.60. It does not change the certificate, which remains against ISO 22301:2019. The utility is using the draft's process view as a design aid. The no-regret work is the evidence the utility already owes: process owners, justified recovery targets, verified suppliers and an exercise with an aim. The review point is 16 September 2027, marked as an estimate.