Continual Improvement in ISO 22301: Evidence That Capability Is Better

Continual improvement in business continuity means making the management system or recovery capability more suitable, adequate or effective over time. Updating a date, closing an action or adding pages to a plan does not by itself demonstrate improvement. The organisation needs evidence that a weakness was understood, changed and verified.

ISO 22301 requires continual improvement of the business continuity management system. ISO/IEC 27001 applies the same management-system discipline to the ISMS. The two can share improvement governance where their scopes and evidence remain clear.

Direct answer: Build one controlled improvement pipeline from incidents, exercises, performance data, audits, change and management review. Prioritise by risk, address causes rather than symptoms, define the intended improvement, verify effectiveness and retain evidence of the before-and-after condition.

Distinguish correction, corrective action and improvement

These actions are related but not identical:

• Correction fixes the observed issue, such as replacing an outdated contact.
• Corrective action addresses why the issue occurred, such as linking contact changes to a controlled HR or supplier process.
• Improvement strengthens capability beyond restoring conformity, such as creating an alternate communication route and proving it through exercise.

One finding may require all three. Closing only the immediate error can allow recurrence; adding an ambitious enhancement without correcting the current defect leaves exposure in place.

Use evidence sources as improvement sensors

Collect opportunities and failures from:

• real disruptions and near misses;
• exercise observations and measured results;
• missed recovery objectives;
• internal and external audits;
• business impact analysis and risk reassessment;
• supplier reviews and service failures;
• technology and organisational change;
• stakeholder feedback and complaints;
• monitoring trends and exceptions; and
• management-review decisions.

Do not create separate unconnected logs for every source. Use a common identifier or linkage so management can see repeated causes across incidents, audits and exercises.

The business continuity exercise guide explains how objective results become verified actions rather than informal lessons.

Prioritise by exposure, not visibility

A minor document issue can be easy to close while a difficult supplier dependency remains unresolved. Prioritise using consequence, likelihood, recurrence, affected activities, time to exposure and the strength of current controls.

An improvement register can include:

Field	Purpose
Source and reference	Trace to incident, exercise, audit or measure
Problem statement	Observable condition, not assumed cause
Affected scope	Activities, sites, services and dependencies
Risk and urgency	Basis for priority
Root cause	Evidence-supported reason for the weakness
Action and owner	Change to be delivered by an accountable role
Resources and due date	Feasibility and commitment
Intended result	Capability expected after change
Verification method	How effectiveness will be tested
Closure evidence	Result and approval
Residual risk	Remaining exposure and acceptance

Use the free ISO 27001 Risk Score Calculator to support consistent qualitative prioritisation where information-security scenarios are involved. Do not use a score as a substitute for analysis or owner judgement.

Investigate causes proportionately

Match the investigation depth to consequence and recurrence. Ask why the control failed, why monitoring did not detect it earlier, and which management-system condition allowed it.

For example, an exercise may find an obsolete supplier number. The immediate cause is an outdated record. Deeper causes may include no designated owner, no notification from procurement, a copy stored outside document control and no pre-exercise validation. The effective action depends on which causes evidence supports.

Avoid naming “human error” as the final cause without examining workload, competence, interface design, conflicting objectives and supervision. Likewise, “procedure not followed” should lead to questions about practicality, availability and reinforcement.

Define the before-and-after capability

Every material action should state what will be better. Examples include:

• reduced time to declare a disruptive incident;
• increased coverage of critical supplier participation;
• recovery achieved within the approved time;
• fewer single-person dependencies;
• shorter lag between operational change and plan update;
• improved data integrity after restoration; or
• closed mismatch between activity need and service capability.

Record the baseline and evidence source. Without the starting condition, the organisation can prove that a change occurred but not that it improved performance.

Verify effectiveness before closure

Completion evidence might show that a procedure changed, training occurred or technology was deployed. Effectiveness evidence shows the intended result under relevant conditions.

Verification methods include:

• repeat the failed exercise step;
• sample recent transactions or changes;
• test alternate personnel or suppliers;
• measure recovery against the objective;
• inspect logs and alerts over a defined period;
• interview affected role holders; and
• independently review the changed control.

The verifier should have sufficient objectivity for the risk. The action owner can provide evidence, but a high-impact issue may need independent confirmation.

The plan activation guide shows how real and simulated activation records can demonstrate decision improvement.

Integrate improvement with change management

Some corrective actions introduce new risk. A faster failover may weaken access control; a second supplier may add data-sharing exposure; a simplified plan may omit specialist steps.

Evaluate proposed changes for:

• effect on BCMS and ISMS scope;
• revised risks and obligations;
• dependencies and recovery objectives;
• information-security control during disruption;
• training and communication needs;
• document and configuration updates; and
• exercise or validation before full reliance.

Improvement should make the system stronger as a whole, not optimise one measure while shifting risk elsewhere.

Use management review for decisions

Present more than the number of open and closed actions. Top management needs:

• high-risk overdue items and affected capability;
• recurring themes and common causes;
• objectives and recovery requirements being missed;
• resource or authority barriers;
• changes in context, obligations and interested parties;
• evidence that completed actions worked; and
• recommendations requiring strategic decision.

The ISO 27001 management review guide provides a decision-focused method that can be adapted to integrated management systems without obscuring the BCMS scope.

Measure improvement without gaming it

Useful measures include recurrence rate, median action age by risk, percentage of material actions independently verified, plan-update lag after change, exercised dependency coverage and recovery-objective achievement.

Avoid rewarding fast closure alone. Teams may divide difficult issues, downgrade severity or close actions on document updates to improve the metric. Pair timeliness with effectiveness and residual-risk visibility.

Use the free ISO 27001 Clause Explainer to review nonconformity, corrective action and improvement concepts common to management systems, then apply the licensed ISO 22301 requirements.

Audit improvement as a closed loop

Select a sample from different sources and risk levels. Trace each from detection to problem statement, cause, action, implementation, verification and closure. Then sample a recurring issue to determine whether previous action addressed the real cause.

Sample audit questions

• What changed in capability, not only documentation?
• Which evidence supports the stated root cause?
• Was action priority consistent with continuity exposure?
• Who verified effectiveness and using what criteria?
• Did the change introduce new dependencies or risks?
• Which issue has recurred after closure?
• What decision did management make about overdue high-risk actions?

Judge pass, partial and fail conditions

Pass: Improvement sources are integrated, priorities follow risk, causes are evidence-based, intended outcomes are measurable, effectiveness is verified and trends drive management decisions.

Partial: Actions are tracked and usually completed, but closure relies on document change or attendance evidence, root-cause depth varies, or recurring themes are not analysed.

Fail: Findings disappear without trace, high-risk actions remain overdue without accepted exposure, repeated failures are treated as isolated events, or status is improved by changing the measure rather than capability.

Continual improvement is visible when the organisation can compare its previous and current capability and explain why the change matters. The result should be fewer unmanaged assumptions, stronger recovery evidence and faster learning after disruption.