ISO 22301 Business Continuity Manager: Authority, Work and Evidence

The business continuity manager coordinates a system that the whole organisation must operate. The role can maintain the programme, challenge gaps and bring evidence to management, but it cannot personally own every critical activity, recovery dependency or disruptive-incident decision.

ISO 22301 does not require the job title “BCM manager.” It requires responsibilities and authorities to be assigned and communicated, with leadership accountability, resources, competence, evaluation and improvement. A coordinator, resilience lead, risk manager or other role can perform the function if the governance works.

Direct answer: Give the BCM manager authority to coordinate the BCMS, obtain information, challenge incomplete work, escalate risk and report directly to accountable leaders. Keep business owners accountable for their activities and recovery requirements, and assign technical and operational owners for the capabilities they control.

Define the role by outcomes

The BCM manager should be able to produce and maintain these outcomes:

• a controlled BCMS scope and governance structure;
• a current view of continuity obligations, risks and priorities;
• completed business impact analysis with accountable approval;
• coordinated strategies and plans across dependencies;
• competent role holders and an exercised response structure;
• performance, audit and management-review evidence;
• visible nonconformities, corrective actions and residual risks; and
• a programme of continual improvement.

This is broader than writing plans. It includes influencing decisions, resolving inconsistency and ensuring that evidence from different functions forms one coherent management system.

The business continuity policy guide explains how executive direction should establish authority and governance.

Separate coordination from accountability

Assigning everything to the continuity manager creates false assurance. Use a clear division:

Decision or work	Typical accountability
BCMS policy, scope and strategic direction	Top management
Activity priority and continuity requirements	Business activity owner
Technology recovery capability	Service or technology owner
Supplier continuity commitments	Contract and supplier owner
Facilities and people arrangements	Relevant functional owner
BCMS method, coordination and reporting	BCM manager
Independent evaluation	Internal audit or other independent assurance
Disruptive-incident command	Named response leader under approved authority

The same person can perform multiple roles in a small organisation, but the decision rights should remain explicit. The BCM manager should not approve their own independent assurance or accept business risk on behalf of an owner who has the authority and consequences.

Give the role practical authority

A role description should state the right to:

• request impact, dependency and recovery information;
• define and maintain the approved BCMS method;
• convene continuity owners and working groups;
• challenge unsupported or conflicting recovery claims;
• stop an unsafe exercise;
• escalate overdue high-risk actions;
• place material issues on management-review agendas;
• access relevant incident, change and supplier evidence; and
• report status without operational filtering.

Authority should be backed by an executive sponsor and governance forum. Without that support, process owners can delay analysis, suppliers can remain outside exercises and plans can be accepted without proven capability.

The executive support guide provides a method for turning continuity exposure into decisions on ownership, funding and risk.

Build an annual operating cycle

The BCM manager can run an integrated cycle rather than treating each document as a separate project.

Plan

• confirm scope, context, interested parties and obligations;
• review policy, objectives, risks and improvement priorities;
• schedule BIA, plan review, training, exercises and assurance;
• identify major business, technology and supplier changes; and
• agree resources and accountable owners.

Operate

• facilitate analysis and strategy decisions;
• coordinate plan maintenance and dependency alignment;
• support awareness and role competence;
• manage the exercise programme;
• maintain incident and escalation interfaces; and
• track exceptions, risks and corrective actions.

Evaluate

• monitor objectives and capability measures;
• test source data and reported status;
• support internal audits without replacing auditor independence;
• prepare management-review evidence; and
• compare demonstrated recovery with approved requirements.

Improve

• investigate nonconformities and recurring weaknesses;
• assign and verify corrective actions;
• update methods after incidents and exercises; and
• recommend changes in scope, strategy, resources or objectives.

Use the free ISO 27001 Clause Explainer to explore the common management-system concepts that ISO 27001 shares with continuity governance. Verify ISO 22301 obligations in the licensed standard.

Manage cross-functional dependencies

Continuity fails at interfaces: a critical activity assumes identity access, a recovery team assumes a facility, or a supplier assumes the customer’s staff will perform configuration. The BCM manager should reconcile these assumptions across owners.

Maintain dependency information with provider, consumer, required timing, minimum capacity, alternate arrangement and evidence of confirmation. Escalate where an internal or external provider cannot meet the consuming activity’s need.

The activity-definition guide shows how to preserve end-to-end service outcomes across organisational boundaries.

Prepare for disruptive incidents without owning every response

The programme role and incident-command role are related but different. The BCM manager may support or lead response depending on competence and approved arrangements. Plans should identify strategic, tactical and operational decisions, alternates and handovers.

During an event, the continuity manager may coordinate situation reporting, plan invocation, dependency issues and records. Business and executive leaders still make decisions about customer priorities, risk, expenditure, public commitments and return to normal.

The disruptive-incident roles guide explains how to prevent role overload and unclear authority under pressure.

Preserve evidence of operation

The role should maintain a controlled evidence map rather than an uncontrolled archive. Useful records include:

• governance terms and role assignments;
• programme plan and coverage;
• activity, BIA, dependency and strategy approvals;
• plan-review and change records;
• training and demonstrated competence;
• exercise objectives, results and actions;
• incidents, lessons and decisions;
• objective and performance reports;
• audit results and nonconformity records;
• management-review inputs and outputs; and
• corrective-action verification.

Evidence should show implementation and operation. An approved procedure proves the method was designed; completed records across a representative period prove it was used.

Handle common role challenges

Limited management attention

Report the business consequence, decision needed, owner and deadline. Replace broad awareness messages with evidence such as unmet recovery requirements, concentrated suppliers or untested dependencies.

Poor owner participation

Use approved responsibilities, scheduled governance and escalation. The BCM manager should facilitate analysis, not invent answers for absent owners.

Insufficient resources

Show which objectives and risk treatments cannot be delivered, the exposure created and feasible options. Preserve management’s decision.

Document completion without capability

Shift measures from files produced to dependencies validated, recovery achieved, alternates demonstrated and findings verified.

The business continuity exercise guide helps make this shift observable.

Audit the role through decisions and samples

Interview the BCM manager, executive sponsor and activity owners separately. Compare their understanding of authority and escalation. Sample a completed BIA, an overdue action, a supplier dependency and an exercise finding.

Sample audit questions

• Which decisions can the BCM manager make without further approval?
• Who accepts continuity risk for a business activity?
• When did the manager last escalate a material issue, and what changed?
• Which critical dependency is currently below requirement?
• How is the role separated from independent audit?
• What evidence shows owners, not the BCM manager, approved their requirements?
• Who performs the role when the manager is unavailable?

Judge pass, partial and fail conditions

Pass: Authority, accountability and escalation are clear; owners participate; dependencies and capability evidence are coordinated; material issues reach leadership; and actions close only after verification.

Partial: The manager maintains documents and schedules exercises, but relies on personal influence, receives inconsistent owner input or cannot obtain timely decisions and resources.

Fail: Continuity is treated as one person’s administrative duty, business owners do not approve requirements, material gaps are hidden, or the role is accountable for outcomes it cannot influence.

An effective BCM manager makes continuity a managed organisational capability. The strongest evidence is not a large document library, but clear ownership, resolved decisions and recovery arrangements that work across boundaries.