Business Continuity Objectives: From Strategy to Measurable Evidence

Business continuity objectives should tell management what capability will improve, by when, with whose resources and how success will be demonstrated. Statements such as “improve resilience” or “maintain continuity” express direction, but they do not provide enough information to manage performance or judge whether investment worked.

ISO 22301 requires business continuity objectives at relevant functions and levels. ISO/IEC 27001 has parallel management-system expectations for information-security objectives. Neither standard supplies one universal target. The organisation must set objectives that fit its context, policy, obligations, risks and continuity requirements.

Direct answer: Use two connected layers. Strategic objectives steer the business continuity management system; operational recovery objectives define acceptable time, data loss and service capacity for activities and resources. Give each objective an owner, baseline, target, deadline, evidence source and response when performance is off track.

Separate strategic and recovery objectives

Strategic objectives improve the BCMS as a management capability. Examples include extending exercise coverage, reducing unresolved continuity risks, improving supplier participation or closing recovery-capability gaps.

Recovery objectives apply to prioritised activities and the resources that support them. They can include recovery time, recovery point, minimum acceptable capacity, work-backlog tolerance and the time for escalation or stakeholder communication.

The two layers should connect. If a critical service repeatedly misses its recovery time, a strategic objective might fund architecture changes, alternate capacity or supplier improvements. The recovery target remains a business requirement; the strategic objective describes the managed change required to meet it.

The RTO and RPO evidence guide explains how time and data objectives differ and how to test them.

Start with approved inputs

Do not begin with a generic list of continuity metrics. Use evidence from:

• organisational strategy and priorities;
• the business continuity policy;
• interested-party and contractual requirements;
• business impact analysis;
• risk assessment and treatment;
• previous disruptions, exercises and near misses;
• internal and external audit results;
• supplier capability and concentration; and
• management-review decisions.

The business continuity policy guide shows how leadership direction should flow into objectives. The business impact analysis guide shows how unacceptable impact and priority should inform recovery requirements.

ISO’s ISO 22301 overview identifies the current published requirements edition as ISO 22301:2019, with Amendment 1:2024. Use the licensed standard for normative requirements; the method below is AuditPrepared implementation guidance.

Write objectives as decision statements

A useful objective answers seven questions:

1. Outcome: What capability or performance will change?
2. Scope: Which activity, service, location or management-system process is covered?
3. Baseline: What is the current measured condition?
4. Target: What result is required?
5. Time: By when, and over what measurement period?
6. Owner: Who is accountable for delivery and reporting?
7. Evidence: Which source proves progress and completion?

For example:

By 31 March 2027, demonstrate end-to-end recovery of the customer ordering service within its approved four-hour recovery time in two different disruption scenarios, with all critical dependencies included and no unresolved high-severity exercise finding.

This is stronger than “test the customer system twice” because it defines the capability, boundary, measure and acceptance condition.

Use a controlled objective record

An objective register can contain:

Field	Purpose
Objective ID and wording	Stable reference and intended outcome
Business rationale	Strategy, policy, risk or obligation supported
Scope and exclusions	Boundary for measurement
Baseline and date	Starting condition
Target and tolerance	Success and acceptable variation
Measure and formula	Consistent calculation method
Data source and frequency	Traceable reporting basis
Accountable owner	Authority for delivery and escalation
Resources and actions	People, budget, technology and milestones
Due date	Time commitment
Status and forecast	Current position and expected completion
Decision or exception	Recovery action or accepted deviation

Avoid “percentage complete” unless the denominator and completion criteria are defined. A project can report 90% for months while the final dependency prevents any useful recovery capability.

Choose measures that reveal capability

Balance activity, coverage, effectiveness and outcome measures.

Measure type	Weak example	Stronger example
Activity	Number of plans reviewed	Percentage of prioritised activities whose plans passed defined review criteria
Coverage	Number of exercises	Percentage of critical dependencies exercised through credible scenarios
Effectiveness	Training attendance	Role holders who demonstrated required decisions during an exercise
Outcome	Backup jobs completed	Restores that achieved approved data and time objectives
Improvement	Actions closed	High-severity actions verified effective after closure

Activity measures are useful for managing work, but they should not be presented as proof of resilience. Pair them with evidence that the capability performs.

Align targets with ownership and resources

An objective is not credible if its owner cannot influence the result. A continuity manager may coordinate a recovery objective, while the business owner approves the requirement and technology, facilities, people or suppliers deliver parts of it.

Define contributions and escalation routes. Record the budget, specialist support, supplier action and decision needed. If top management approves an objective but withholds essential resources, the contradiction should be visible in performance reporting and management review.

Use the free ISO 27001 Clause Explainer to explore how objectives, resources, monitoring and management review connect in a management system. Confirm formal obligations against the licensed standards.

Monitor without manufacturing precision

Define how each measure is calculated before reporting it. State the population, period, exclusions and data owner. Preserve source evidence such as exercise records, recovery logs, risk actions and supplier reports.

Use a simple status rule tied to action:

• On track: current performance and forecast support delivery.
• At risk: a milestone, resource or dependency threatens the target; recovery action is assigned.
• Off track: the target or tolerance is missed; escalation and decision are required.

Status should not be changed to green merely because an explanation exists. A justified miss is still a miss until management changes the objective, accepts the exposure or restores performance.

Review and revise objectives properly

Review objectives at planned intervals and after material change. Triggers can include a new service, acquisition, supplier failure, significant incident, exercise result, regulatory change or revised business priority.

Changing a target is legitimate when evidence changes, but preserve the previous value, rationale, approver and effective date. Otherwise, repeated target reductions can disguise deterioration.

The business continuity exercise guide shows how exercise results can provide objective evidence rather than simple completion counts.

Audit the objective from both directions

First, select an objective and trace down to actions, resources, source data, results and decisions. Then select a critical activity or major exercise finding and trace upward to the relevant objective. This two-way approach finds objectives that have no operating connection and material issues that management does not measure.

Sample audit questions

• Which strategy, policy commitment or risk produced this objective?
• Is the baseline measured using the same method as the target?
• Does the owner have authority over the required resources?
• Which evidence proves the reported status?
• What decision occurs when tolerance is exceeded?
• Have targets changed, and who approved the change?
• Does the objective measure activity, capability or both?

Judge pass, partial and fail conditions

Pass: Objectives are relevant, measurable and owned; baselines and evidence are traceable; resources and actions are defined; performance drives escalation and management decisions; and objectives are updated transparently when context changes.

Partial: Objectives exist and are reported, but several measure activity only, baselines are unclear, data is manually asserted without evidence, or owners lack authority over key dependencies.

Fail: Objectives are slogans, recovery targets conflict with approved impact analysis, missed targets produce no decision, or results are adjusted to create a favourable status.

Good continuity objectives make governance observable. They show what the organisation is trying to improve, whether capability is moving in the right direction and when leadership must act.