‘Improved’ ISO 22301 business continuity standard boosts resilience

Revised business continuity standard ISO 22301 is less prescriptive, has been simplified and is more accessible to corporates, according to experts and commentators, who also believe it will help boost resilience. Finalised at the beginning of this month, the new version updates standards and definitions relevant for today’s business continuity management systems (BCMS). Companies certified to the 2012 version of ISO 22301 will have three years to transition to the revised standard, but most anticipate this should be straightforward. Top-line changes to the standard include clear links between business continuity plans and the teams that respond to disruptions, plus removal of the term ‘risk appetite’. The British Standards Institution said the changes will help companies plan better for disruption and protect business reputations, while at the same time reducing the costs of a disruption and boosting corporate resilience. James Crask, senior vice-president at Marsh Risk Consulting, said changes to the structure of the standard and greater clarity will make it more accessible to corporates, and allow them to build business continuity into any existing management systems. The revisions have also removed repetition and simplified terminology, he added. “The standard now better reflects today’s thinking in the business continuity industry, particularly in relation to business impact analysis and the development of recovery strategies,” Mr Crask said. He added that compliance with the new version will provide firms with a better grasp of disruption risks. Thijs Willaert, director of marketing and communication at German auditing firm DQS CFS, agreed that while the changes to the standard are “not drastic”, they are effective. “Less text, more flexibility; less prescriptiveness, more pragmatism – that, in a nutshell, is the new version of the ISO 22301,” Mr Willaert said. “The new version of the standard is a definite improvement and will bring even more value to its users,” he added. Mr Willaert said more than 4,000 organisations from a range of industries hold an ISO 22301 certificate and, given the limited changes, most “should have no problem whatsoever with the transition”. This is largely because the 2012 version was one of the first to adopt the high-level structure now used for all ISO management system standards. Mr Willaert said the revision strips back requirements and has less specification about how requirements should be met. One of the few new requirements, clause 6.3, specifies that organisations should make changes to BCMS “in a planned manner”, Mr Willaert said, while the section on business impact analysis adds a mandatory requirement to use impact categories as a starting point. Mr Willaert said removal of the ‘risk appetite’ term is the right decision. “Not only is ‘risk appetite’ a rather subjective issue, it is also ultimately irrelevant: what matters is not the risk an organisation is willing to take, but the level at which the impact of not resuming activities would become unacceptable to an organisation,” he said.

‘Improved’ ISO 22301 business continuity standard boosts resilience

Want to read this article?

Read Next

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Want to read this article?

Read Next

Markel names head of terrorism in London

Insurers defend Nord Stream’s €400m lawsuit as act of war

Generali splits insurance and asset management in restructure

AEGIS London recruits cyber underwriting team from AIG

German SMEs record rise in cyberattacks, reveals HDI poll

Related Articles