What ISO 22301 organises
ISO 22301:2019 is a requirements standard for business continuity management systems. It provides a framework to prepare for, respond to and recover from disruptions, with monitoring and improvement. Continuity does not mean maintaining every activity at any cost: it requires priorities, acceptable capacities and conditions for responsible action to be defined.
Relationship with prevention
A disruption can change shifts, installations, providers or procedures and create new risks. Using an alternative location or temporary equipment requires preventive review. Crisis management and continuity linked to OSH integrates protection of people into recovery decisions alongside consideration of commercial deadlines.
Processes and dependencies
The organisation identifies critical activities and their required resources: competent people, installations, information, supplies and external services. Dependencies can make an apparently complete plan unworkable. For example, recovering an IT system does not itself restore an operation if authorised personnel, safe equipment or access to updated instructions are missing.
Preparing usable alternatives
Plans should specify responsibilities, communications and activation criteria. Alternatives are assessed before depending on them. A temporary manual task needs controls, and a backup location requires suitable conditions for the activity. Returning to normal and reconciling records generated during the interruption should also be planned.
Exercise example
In a hypothetical example, a company simulates losing access to its main workplace. The exercise checks how it locates personnel, which operations it suspends and what documentation it needs for partial resumption. Results show whether decisions use sufficient information and alternative resources are genuinely available, without exposing people to additional risks.
Tests, changes and scope
A filed plan can become outdated after reorganisation or a provider change. Exercises and reviews reveal dependencies and allow them to be addressed. ISO 22301 does not replace emergency plans or health and safety obligations. Certification, where it exists, is interpreted according to its scope, not as a guarantee of instant recovery from every scenario.
