CHAPTER 8: IMPROVEMENT

Non-conformity and corrective action

BS25999 made a distinction between corrective and preventative (using the form: preventive) actions, however, ISO22301 only states the requirement for corrective action whenever some non-conformity is discovered, which simply removes the need to decide whether something has gone wrong, or could go wrong.

Consistent with other management system standards, there is a requirement for a system to record, and track, anything that is potentially wrong, and to ensure that both the symptoms (usually corrective action) and root cause (usually preventative action) are addressed.

This is another opportunity for organisations with other management systems in place to integrate BCM with them; a non-conformity system can sensibly be made generic, so that it allows actions to be tracked in respect of non-conformity of any management system, whether it is BCM, information security, quality, or any other.

Documentation

There are two, principal forms of documentation required; a non-conformance report, detailing the individual non-conformance; and some form of register, providing an audit trail of non-conformances, as well as a source of management information for performance evaluation.

Examples of both these documents are in Appendix 6.

Naturally, where changes to the BCMS are approved and made, those changes will be traceable through the document management protocols that apply to the individual documents, arrangements and the BCMS as a whole.

Continual improvement

Consistent with other management systems, ISO22301 looks for a systematic approach to improvement of the BCMS, through the identification and execution of corrective actions.

In BS25999 it was quite tricky to work out what, over and above the internal audit, management review and corrective/preventative action process, could be done to satisfy this requirement.

ISO22301 helpfully states the requirement for continual improvement, with the suggestion that processes, such as leadership, planning and performance evaluation, may be used to achieve this aim.

A practical step would be to include continual improvement as a standing item in the agenda, or checklist, for management review, thereby providing evidence that action is regularly being taken to consider how the BCMS and its related arrangements can be continually improved.