ISO 22301 Clause 9.3: Management Review

Quick Reference (60 Seconds)

The single sentence to remember: a management review is the moment top management answers three questions about the BCMS, does it still fit our organisation (suitability), is it enough for our risk environment (adequacy), and is it actually working (effectiveness), and then commits, on the record, to whatever changes the answers demand. A BCMS whose review produces no decisions is a system whose leadership has not engaged with it. Clause 9.3 is the discipline that turns measurement and audit into strategic action, and strategic action is what a certification body, a regulator, a board, and (when a real disruption hits) a recovery team can actually rely on.

What the Standard Actually Requires

Figure · Process

What Clause 9.3 asks you to do

ISO 22301 Clause 9.3 asks organizations to have top management review the BCMS at planned intervals for continuing suitability, adequacy, and effectiveness. Read alongside ISO 22313:2020 (the companion guidance), ISO 22300:2021 (vocabulary), and the wider management-system genealogy (ISO 27001 Clause 9.3, ISO 9001 Clause 9.3), the requirement breaks into five interlocking obligations. Each of these is examined closely by certification auditors and by Indian regulators, because the management review is where the BCMS either becomes a living system or quietly dies as a binder on a shelf.

What the clause requires in substance

1. Top management must conduct the review. The clause is explicit: this is not a review by the BCM Manager for top management; it is a review by top management. "Top management" in ISO 22301:2019 has the same meaning as in ISO 27001 and ISO 9001, the person or group of people who direct and control the organisation at the highest level. In a growing company, that is typically the CEO/MD and the executive committee (CFO, COO, CISO, CRO, CHRO, business-unit heads). In a regulated entity, the board or its delegated committee (Audit Committee, Risk Management Committee) may be the actual decision body for continuity risk. The distinction that matters is authority: the people in the room must have the authority to commit resources, change the BCMS scope, revise objectives, and hold managers accountable. A review attended only by the BCM team and mid-level IT managers, however thorough, does not satisfy the clause, because the people who can actually decide are not in the room. The single most common 9.3 finding is "management review conducted without top-management participation."

2. The review must happen at planned intervals. "Planned" means scheduled in advance, on a documented calendar, with a defined cadence, not triggered ad hoc when someone remembers. The minimum defensible cadence for most organisations is annually; regulated entities should review at least semi-annually (the SEBI LODR Risk Management Committee meets at least twice a year). The cadence should be documented in the BCMS procedure and communicated to the board's calendar. Additional ad hoc reviews may be triggered by significant events, a major disruption, a regulatory change, a merger or acquisition, a failed exercise, a significant audit nonconformity, or a change in the organisation's risk profile, but these supplement, rather than replace, the planned cycle. The certification body will ask to see the review schedule and will check whether the reviews actually happened on the planned dates. A review that was supposed to happen in March but actually happened in September is a finding, not necessarily a major nonconformity, but a documented gap that requires explanation.

3. The review must address three distinct questions, suitability, adequacy, and effectiveness. These three words are the conceptual core of the clause and are examined closely:

   • Suitability: Does the BCMS still fit the organisation? Has the organisation changed in ways that make the current BCMS scope, policy, objectives, or strategy wrong? A company that has acquired another business, entered a new market (e.g., an Indian SaaS firm expanding to the EU and becoming subject to DORA), shifted to a cloud-native architecture, or moved from on-premises to a hybrid workforce has changed shape, and the BCMS must be reviewed against the new shape. A BCMS that was right for a 200-person single-site company may be unsuitable for a 2,000-person multi-site entity. Suitability is about alignment.
   • Adequacy: Is the BCMS sufficient for the organisation's current risk environment and continuity requirements? Even if the scope is right, are the resources, strategies, plans, exercise frequency, RTO/RPO targets, and supplier controls enough to meet the obligations? An organisation that has moved from Tier-2 criticality to Tier-1 (systemically important), for example, a payment system operator crossing RBI thresholds, may find its existing BCMS is no longer adequate. Adequacy is about sufficiency.
   • Effectiveness: Is the BCMS achieving its intended outcomes? Are the objectives being met? Are exercises passing? Are RTOs being achieved? Are corrective actions closing? Are actual disruptions being managed within tolerance? An ineffective BCMS is one that exists on paper but does not actually improve continuity. Effectiveness is about results.

   The review must explicitly address all three, and the minutes must record top management's judgement on each. A review that says "the BCMS is fine" without distinguishing suitability from adequacy from effectiveness does not satisfy the clause.

4. The review must consume a defined set of inputs. The clause specifies a structured input set. Top management cannot make a defensible judgement without evidence, and the clause prescribes what evidence must be on the table. The mandatory review inputs (examined in detail in §7) include: whether the actions agreed at earlier reviews were actually completed; changes in external and internal issues (Clause 4.1); changes in the needs and expectations of interested parties, including legal and regulatory requirements (Clause 4.2); information on BCMS performance and trends, including monitoring and measurement results (Clause 9.1); the extent to which BC objectives have been achieved (Clause 6.2); process performance and continuity of prioritised activities; nonconformities identified and corrective actions taken (Clause 10.1); audit results at planned intervals (Clause 9.2); the results of exercises and tests (Clause 8.5); actual disruption and incident performance (the real-world test); supplier and partner continuity performance; the effectiveness of actions taken to address risks and opportunities (Clause 6.1); and improvement opportunities and lessons learned. A review that omits any of these is incomplete; a review that addresses all of them superficially (a one-line "noted" per item) is also incomplete. The depth of the review must match the depth of the evidence.

5. The review must produce outputs, decisions, not just discussion. This is the clause's sharp edge. A management review that ends with "all noted, carry on" has not satisfied 9.3. The clause requires outputs: decisions and actions related to (a) the continuing suitability, adequacy, and effectiveness of the BCMS; (b) continual improvement opportunities (Clause 10.2); (c) any need for changes to the BCMS (scope, policy, objectives, strategy, plans, resources); (d) resource needs (people, budget, technology, supplier arrangements); and (e) actions required when BC objectives have not been achieved. Each output must be specific, owned, dated, and traceable to closure. The outputs are the link between the review and the rest of the BCMS, they drive Clause 6.3 (planned changes), Clause 7.1 (resources), Clause 10.1 (corrective actions), and Clause 10.2 (continual improvement). A review whose outputs are vague ("improve awareness training") or unowned ("someone should look at supplier resilience") fails the clause.

6. The review results must be retained as documented information. Under Clause 7.5, the organisation must retain documented information of the management review results. This means minutes (or an equivalent record) that capture: the date and attendees (with top-management attendees named); the inputs presented (with reference to the source documents, the audit report, the exercise report, the BIA update, etc.); the discussion on each input (at least a summary); top management's explicit judgement on suitability, adequacy, and effectiveness; the decisions made (each with an owner, deadline, and resource commitment); and any dissenting views (which strengthen, not weaken, the record). The minutes are the evidence a certification body and a regulator will request first. Retention should align with the longest applicable regulatory look-back (RBI supervisory cycles, SEBI inspection windows, typically five years or more).

What the clause does NOT require

This demarcation matters because over-engineering the review burns executive time and under-engineering it produces findings:

• It does not require the review to be a single annual meeting. The review may be conducted as a series of focused reviews (e.g., a board-committee review of governance each quarter, an executive review of operations each month, a complete annual review) provided the aggregate covers all required inputs and outputs over the cycle and the complete review happens at least annually. Many mature organisations federate the review across the governance calendar, but the annual complete review is non-negotiable.
• It does not require every member of top management to attend every review. The clause requires that top management conducts the review, which means sufficient top-management authority in the room to make decisions. In a large organisation, the CEO may delegate to the COO for operational reviews and attend only the annual review. The test is authority to decide, not every name on the org chart.
• It does not require the review to re-perform the work of Clause 9.1 (monitoring) or Clause 9.2 (internal audit). The review consumes the outputs of 9.1 and 9.2; it does not replicate them. A review that re-runs every metric, re-examines every audit finding, and re-tests every control has confused the three lines. The review's job is strategic synthesis, not operational re-performance.
• It does not require the review to produce a pass/fail verdict on the BCMS. The review produces decisions and actions, not a grade. The BCMS is not "certified" by the management review; it is directed by it. Certification is the external body's role.
• It does not require a specific format for the review minutes. The organisation may use its standard board/executive minute format, a bespoke BCMS review template, or the structure recommended in ISO 22313:2020. The test is content (does it cover the required inputs and outputs?), not form (is it in a specific template?).
• It does not require the review to be a long meeting. A well-prepared review with a structured input pack can be conducted in 90–120 minutes for a mid-sized organisation. The depth is in the preparation (the input pack), not the duration of the meeting. A four-hour review with no input pack and no decisions is worse than a 90-minute review with a tight pack and three decisions.

The 9.1 vs 9.2 vs 9.3 demarcation (the most-tested distinction)

Among the three performance-evaluation clauses, the boundary between 9.1, 9.2, and 9.3 is the single most frequently examined point in certification audits. The three lines of assurance must be visibly distinct in the organisation's documentation and conduct, and 9.3 is the apex.

• 9.1 (Monitoring, measurement, analysis and evaluation) is first-line management measuring its own system, continuously. Owners: BCM Manager, activity owners, IT/DR lead, SOC. Cadence: real-time (telemetry) through annual (programme review). Output: dashboards, trend packs, threshold-breach tickets, evaluation memos. Independence: none required (it is management measuring its own work). Question answered: "Is the BCMS performing, and where is it drifting?"
• 9.2 (Internal audit) is second-line independent assurance over the BCMS at planned intervals. Owner: internal audit function or external services provider, structurally independent of the BCMS first line. Cadence: planned intervals, risk-based, typically a three-year cycle with high-risk areas annual. Output: audit programme, audit reports, findings (conformities, nonconformities, opportunities for improvement), corrective-action verification. Independence: required. Question answered: "Does the BCMS conform to ISO 22301:2019 and to our own documented requirements, and is it effectively implemented?"
• 9.3 (Management review, this clause) is the apex strategic review by top management at planned intervals. Owner: top management (CEO/COO/CISO/board committee), chaired by the BCMS sponsor. Cadence: planned intervals, at least annually; semi-annually or quarterly for regulated entities. Output: decisions on continuing suitability, adequacy, effectiveness; resourcing; strategic changes; corrective-action direction; continual-improvement mandate. Independence: top-management perspective over both 9.1 and 9.2. Question answered: "Is the BCMS still the right system for this organisation, at this scale, in this risk environment, and what should we, as the leadership, change?"

The flow is: 9.1 produces the evidence → 9.2 independently tests the system and the evidence → 9.3 consumes 9.1 and 9.2 outputs to make strategic decisions → 10.1/10.2 act on what 9.1/9.2/9.3 find. A common failure is to collapse the three into one "annual BCM review", which produces neither trustworthy first-line measurement (9.1), nor independent assurance (9.2), nor strategic challenge (9.3). They are distinct disciplines with distinct owners, cadences, and outputs. The management review is the only one of the three where top management is the actor, not the audience.

The three-part test, suitability, adequacy, effectiveness

The three-part test is the conceptual core of Clause 9.3 and the lens through which a certification auditor reads the review minutes. Each word does specific work:

Suitability asks whether the BCMS is still the right design for the organisation as it now is. The test is against the organisation's current context (Clause 4.1), stakeholder expectations (Clause 4.2), and scope (Clause 4.3). A suitable BCMS is one whose scope, policy, objectives, and strategy are aligned with the organisation's purpose, size, structure, geography, and business model. When the organisation changes shape, through growth, acquisition, divestiture, market entry, technology shift, or regulatory change, the BCMS must be reviewed for suitability against the new shape. A common suitability finding in growing companies: the BCMS scope was defined when the company was a single-site, 150-person entity, but the company is now a 1,500-person, three-site, two-country entity, and the scope document has not been revisited. The BCMS is unsuitable not because it is bad, but because it is calibrated to a company that no longer exists.

Adequacy asks whether the BCMS is sufficient for the organisation's current risk environment and continuity obligations. The test is against the BIA (Clause 8.2), the risk assessment (Clause 8.2), the applicable legal and regulatory requirements (Clause 4.2), and the continuity strategy (Clause 8.3). An adequate BCMS is one whose resources, strategies, plans, exercise frequency, RTO/RPO targets, supplier controls, and recovery capabilities are proportionate to the risks and the required continuity outcomes. When the risk environment changes, a new threat (ransomware-as-a-service), a new dependency (a cloud provider becoming systemically critical), a new regulation (DPDP Act 2023, DORA, RBI Master Direction), or a new BIA result (an activity's MTPD has shortened), the BCMS must be reviewed for adequacy against the new environment. A common adequacy finding: the RTO for a critical payment system was set at 8 hours three years ago, but the BIA now shows the MTPD is 2 hours, and the RTO has not been revised. The BCMS is inadequate not because the plan is wrong, but because the target it is built to meet is no longer the right target.

Effectiveness asks whether the BCMS is actually achieving its intended outcomes. The test is against the BC objectives (Clause 6.2), the exercise results (Clause 8.5), the audit results (Clause 9.2), the corrective-action status (Clause 10.1), and, most powerfully, the performance during actual disruptions. An effective BCMS is one whose objectives are being met, whose exercises are passing (or whose failures are producing corrective actions that close), whose audits are finding fewer nonconformities over time, and whose actual disruptions are being managed within tolerance. An ineffective BCMS is one that exists on paper but whose exercises fail without corrective action, whose objectives are missed without escalation, whose audits repeat the same findings, and whose disruptions exceed tolerance without learning. Effectiveness is the hardest of the three to judge, because it requires honest negative evidence, and the most common 9.3 finding is a review that declared the BCMS "effective" without any negative evidence on the table, which usually means the negative evidence was suppressed or never collected.

Why This Control Matters

The management review is the single clause that most directly determines whether the BCMS is a living system or a document binder. Every other clause can be satisfied by competent specialists working in their domain, the BIA by the BCM team, the plans by the IT/DR lead, the exercises by the exercise coordinator, the audit by the internal audit function. Clause 9.3 is the only clause that requires top management to engage with the BCMS as a strategic system. When that engagement is real, the BCMS improves; when it is absent or perfunctory, the BCMS atrophies, and the organisation discovers the atrophy only when a disruption exposes it.

The governance failure pattern

The most expensive business-continuity failures in India over the past decade share a common root cause that is not technical: it is the absence of sustained top-management review. The pattern is consistent across sectors:

• A BCP/DR system is established (often for a certification or a regulatory deadline) with board sponsorship and real investment.
• The system is operated competently for one or two cycles.
• Leadership attention shifts to other priorities. The management review becomes a formality, a 30-minute agenda item, a "noted" minute, no decisions.
• The BIA goes stale (the organisation has grown; the critical activities have changed; the RTOs are now wrong).
• The exercises are run but their failures are not escalated; corrective actions accumulate without closure.
• The supplier landscape changes (new cloud dependencies, new outsourced processes) without the supplier-continuity controls being updated.
• A disruption hits. The BCMS does not perform. The regulator, the board, the customers, and the public all ask the same question: how did this happen?

The answer, almost always, is that the management review stopped working, not the technology, not the people, not the plans, but the governance loop that should have kept them current. Clause 9.3 exists to prevent exactly this failure mode. It is the clause that requires leadership to look at the BCMS, on the record, at planned intervals, and decide what to change.

The Indian regulatory context, why 9.3 is a board-level duty

In India, the management review of business continuity is not merely an ISO 22301 obligation; it is a board-level governance duty under multiple statutes and regulations. The Indian regulatory architecture has converged, over the past decade, on the principle that continuity and operational resilience are matters of board accountability, not delegable to management alone. This makes Clause 9.3 the ISO 22301 clause with the deepest overlap with Indian corporate law.

Companies Act 2013, Section 134(3)(n): The board's report, the principal annual disclosure to shareholders, must include a statement on the development and implementation of a risk-management policy for the company, including the identification of elements of risk that, in the opinion of the board, may threaten the existence of the company itself. This is a statutory requirement for every company in India (not just listed entities), and it directly engages the board with continuity risk. A disruption that threatens the existence of the company, a ransomware that encrypts the production database, a flood that takes out the only delivery centre, a supplier failure that halts the core product, is exactly the kind of risk §134(3)(n) requires the board to identify and address. The management review under Clause 9.3 is the process that produces the evidence the board needs to discharge this duty. A board that signs §134(3)(n) without a current management review of the BCMS is, in substance, asserting a risk-management posture it has not verified.

Companies Act 2013, Section 177(4)(vii): The Audit Committee of the board shall evaluate internal financial controls and risk-management systems. This gives the Audit Committee explicit oversight of the systems that the BCMS depends on (IT controls, data integrity, recovery capability) and of the BCMS itself as a risk-management system. In practice, many Indian companies route the BCMS management review through the Audit Committee or a dedicated Risk Management Committee.

SEBI LODR Reg. 21 (Risk Management Committee): For listed entities, the Risk Management Committee (RMC) must cover cyber security, operations, and continuity risks, and must meet at least twice a year. The RMC's terms of reference explicitly include reviewing the risk-management system, assessing its effectiveness, and recommending improvements. This is, in effect, a statutory management review of the BCMS (among other risks) at a cadence more frequent than ISO 22301's minimum. A listed entity's BCMS management review should be aligned with, and ideally feed into, the RMC's cycle, so that the same evidence supports both the ISO 22301 obligation and the SEBI obligation.

RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 Nov 2023, effective 1 Apr 2024): For banks, NBFCs (Top, Upper and Middle Layers), and other regulated entities, the Master Direction requires a board-approved BCP/DR policy, board oversight of IT service continuity, and periodic review of the continuity framework. The board (or its delegated IT/Risk committee) is the review body. RBI supervisory teams routinely examine board minutes for evidence of continuity review during inspections, and the absence of such evidence is treated as a governance deficiency, not merely a documentation gap. The HDFC Bank case (discussed in §14) is the canonical example of RBI escalating repeated digital outages to a board-level governance failure.

SEBI Cybersecurity and Cyber Resilience Framework, CSCRF (20 Aug 2024): The CSCRF structures obligations around six functions, Governance, Identify, Protect, Detect, Respond, Recover. The Evolve goal is, in substance, a management-review obligation: it requires regulated entities to capture lessons from incidents, exercises, and audits, and to feed them back into the resilience programme. The CSCRF also requires board/committee reporting on cyber-resilience posture. The management review under Clause 9.3 is the natural vehicle for discharging the Evolve goal.

IRDAI Information and Cyber Security Guidelines 2023 (24 Apr 2023): For insurers, the guidelines require a board-approved Information and Cyber Security Policy that includes BCP/DR, with the board's Risk/IT committee exercising oversight. Annual compliance reporting to IRDAI (within 90 days of financial year-end) effectively requires an annual management review to produce the compliance certificate.

CERT-In Directions (28 Apr 2022): While the Directions themselves do not mandate a management review, the performance against the six-hour incident-reporting clock, the 180-day log retention, and the PoC liaison are all review inputs, and repeated CERT-In reporting failures are a signal that the BCMS is not effective.

DPDP Act 2023, Section 8(5) and 8(6): The security-safeguards duty (§8(5)) and the breach-notification duty (§8(6)) create statutory continuity obligations for every Data Fiduciary. Significant Data Fiduciaries face enhanced obligations including periodic security audits and a Data Audit. The management review must consume DPDP compliance performance as an input, breach-notification timeliness, data-availability incidents, SDF audit findings, and must direct corrective action where performance is deficient. With penalties up to ₹250 crore for inadequate security safeguards, the financial stakes of an unreviewed BCMS are now existential.

The cost of a perfunctory review

A management review that is conducted but produces no decisions is, paradoxically, more dangerous than no review at all, because it creates the illusion of governance while providing none of the substance. The costs are concrete:

• Stale BIA and stale RTOs. Without review-driven refresh, the BIA and RTO/RPO targets become progressively wrong. A disruption hits, the recovery takes 12 hours against an RTO of 4 hours, and the post-incident review discovers the RTO was set in 2022 against a 2022 business model. The gap is a governance failure, not a technical one.
• Accumulated corrective actions. Exercises and audits produce findings; without review-driven closure, the corrective-action register grows until it becomes a graveyard of good intentions. When a real disruption hits, the same finding that was logged and ignored for three years becomes the root cause.
• Supplier drift. The supplier landscape changes faster than any other BCMS input. Cloud providers change their service models, SaaS vendors change their BCP terms, critical suppliers are acquired or fail. Without review-driven supplier-continuity refresh, the BCMS is built on dependencies that no longer exist on the terms the BCMS assumes.
• Regulatory drift. The Indian regulatory landscape for continuity and operational resilience has changed materially every year since 2020, CERT-In Directions (2022), DPDP Act (2023), RBI Master Direction (2023), SEBI CSCRF (2024), APRA CPS 230 (2025, for Australian operations), DORA (2025, for EU-facing operations). A BCMS that is not reviewed against the regulatory landscape at least annually will be non-compliant with obligations the organisation does not yet know it has.
• Erosion of board confidence. When a disruption exposes a BCMS that has been reviewed only on paper, the board's reaction is not gentle. The CEO, the CISO, and the BCM Manager are called to account; the certification is questioned; the regulator is notified. The cost of the disruption itself (recovery, revenue loss, penalties) is compounded by the cost of the governance failure (board action, executive dismissal, regulatory enforcement, reputational damage).

The management review is the cheapest control in the BCMS, it costs only executive time, and it is the control whose absence is most expensive. The ROI of a well-conducted review is measured in the disruptions that do not become crises and the findings that do not become root causes.

Scope and Applicability

Clause 9.3 applies to every organisation that claims conformity to ISO 22301:2019, regardless of size, sector, or maturity. There is no small-organisation exemption, no reduced-scope variant, no "we will do it next year" deferral. The management review is a defining feature of a management system, a BCMS without one is not a BCMS, it is a collection of plans. The clause's applicability is therefore universal within the certified scope; what varies is the form the review takes.

Applicability by organisation size

Small organisations (10–100 people): The review is real but lightweight. The "top management" is typically the founder/CEO and one or two senior leaders (COO, CTO). The review may be a single annual half-day session with a structured input pack, conducted in a conference room or over a video call. The BCM Manager (who may be a part-time role) prepares the pack; the CEO chairs the review; the minutes are brief but must capture the required inputs, the three-part judgement, and the decisions. The cost is executive time (4–8 hours of CEO/COO time per cycle) plus BCM preparation time (2–3 days). For a small organisation, the review is often the only structured moment when continuity is discussed at the leadership level, which makes it disproportionately important. A common small-organisation failure: the founder "knows the continuity posture in their head" and sees no need for a formal review, until the founder is the one who is unavailable during a disruption.

Growing companies (100–2,000 people): The review is more structured and may be federated. Top management is the executive committee (CEO, CFO, COO, CISO, CRO, business-unit heads). The review is typically an annual complete session (half-day to full-day) supplemented by quarterly operational reviews (often within the existing executive committee meeting). The BCM Manager prepares a formal input pack with contributions from IT/DR, HR, procurement, legal, and business units. The review is minuted in the organisation's standard executive format. For regulated entities in this band (e.g., a small finance bank, a mid-tier insurer, a SEBI-registered MII service provider), the review must also align with the board-committee cycle (RMC, Audit Committee). The cost is 8–16 hours of executive-committee time per cycle plus 5–10 days of BCM preparation.

Large organisations (2,000+ people): The review is a federated governance regime. The complete annual review is conducted by the CEO and the executive committee, with the board committee (RMC, Audit Committee, or a dedicated Operational Resilience Committee) receiving a summary and the strategic decisions for ratification. Quarterly or monthly operational reviews are conducted by delegated executives (COO, CISO, CRO). The input pack is substantial, often 50–100 pages with dashboards, trend analysis, and deep-dive appendices. The BCM Programme Office (which may be 2–5 people in a large organisation) manages the year-round evidence pipeline that feeds the review. The cost is significant (20–40 hours of executive time per cycle plus a standing BCM Programme Office), but the alternative, an unreviewed BCMS in a systemically important entity, is materially riskier.

Applicability by sector (India)

BFSI (banks, NBFCs, insurers, payment system operators): The review is mandatory at the board level. RBI's Master Direction on IT Governance (2023) and the SEBI/IRDAI frameworks all require board-approved BCP/DR policy with periodic board review. The review must consume regulatory compliance performance (RBI inspections, SEBI inspections, IRDAI compliance certificates) as inputs, and must produce decisions that align the BCMS with the regulatory agenda. The HDFC Bank case (§14) illustrates what happens when the review loop is broken in a regulated entity. For payment system operators processing UPI rails, the review must address ecosystem-level continuity (NPCI dependencies, participating-bank performance).

Healthcare (hospitals, pharma, medical-device manufacturers): The review must address patient-safety continuity, the near-zero RTO for life-critical activities (emergency, ICU, OT). The AIIMS Delhi ransomware (2022) is the case every healthcare management review should test itself against: has clinical failover been exercised, and does a backup copy sit outside the primary's failure domain? For pharma manufacturers, the review must address GMP continuity (production stoppage is a patient-safety event) and the disclosure obligations (Sun Pharmaceutical's 2023 ransomware disclosure is a precedent). The review inputs must include clinical-incident near-misses, not just IT incidents.

IT/ITeS and SaaS: The review must address customer-facing availability commitments (SLAs), the continuity of the customer's business (for outsourced processes), and the multi-tenant cloud continuity posture. For Indian IT-services firms, the review must address the continuity of each major customer's outsourced process, the Wipro phishing breach (2019) showed how a vendor's identity-security failure becomes a customer-continuity event. For SaaS firms serving EU customers, the review must address DORA conformity (for financial-sector customers) and DPDP conformity (for Indian data).

Manufacturing (automotive, chemicals, electronics): The review must address production continuity, supply-chain continuity (especially single-source dependencies like Pratt & Whitney engines for Go First), and industrial safety continuity (LG Polymers, Maruti Manesar). For chemical/hazardous industry, the review must integrate with the NDMA on-site and off-site emergency plans. For automotive, the review must address the Just-In-Time supply chain (a single-component failure can halt an assembly line within hours).

Government and public sector: The review must address the continuity of public services, critical-infrastructure dependencies (power, telecom, the Mumbai 2020 blackout is the anchor case), and the Disaster Management Act 2005 obligations. For government departments and PSUs, the NDMA DMP template provides the review structure, and the management review must align with the DMP review cycle. CERT-In compliance is a mandatory review input for all government ICT.

What is in scope for the review vs out of scope

In scope: The entire BCMS as defined in the scope statement (Clause 4.3), all prioritised activities, all sites within scope, all BCMS processes (policy, objectives, BIA, risk assessment, strategy, plans, exercises, audit, corrective actions), all applicable legal and regulatory requirements, and all supplier/partner continuity arrangements on which the organisation's prioritised activities depend.

Out of scope (but referenced): Activities explicitly excluded from the BCMS scope (Clause 4.3), business units or sites not in scope, and suppliers not classified as continuity-critical. However, the review must consider whether the scope itself is still right (a suitability question), so even out-of-scope elements are reviewed for whether they should be brought in scope.

Key Definitions and Terminology

Clause 9.3 uses a small set of terms with precise meanings drawn from ISO 22300:2021 and the wider management-system vocabulary. Understanding these terms is essential, because the certification auditor will test whether the organisation's review uses them correctly.

Top management: The person or group of people who direct and control the organisation at the highest level. In ISO 22301:2019, top management is the actor in Clauses 5.1, 5.2, 5.3, and 9.3, the clauses that require leadership engagement, not just specialist execution. Top management is not a job title; it is a function, the function of directing and controlling at the highest level. In a small company, it may be one person (the founder/CEO); in a large company, it is the executive committee and the board. The test is authority: can the people in the room commit resources, change the scope, revise the objectives, and hold managers accountable? If yes, they are top management for the purposes of 9.3.

Management review: A formal, scheduled, minuted evaluation of the BCMS by top management, conducted at planned intervals, against the three-part test of suitability, adequacy, and effectiveness, consuming a defined set of inputs and producing a defined set of outputs. The management review is not a status update, a project review, a budget review, or a generic risk review, it is a review of the BCMS specifically, conducted against ISO 22301's requirements.

Planned intervals: Intervals that are scheduled in advance, documented in the BCMS procedure or governance calendar, and adhered to. "Planned" is the opposite of "ad hoc." The intervals may be time-based (annually, semi-annually, quarterly) or event-based (triggered by a significant change), but the time-based cycle is mandatory. The certification body will compare the planned intervals in the procedure to the actual review dates in the minutes.

Suitability: The degree to which the BCMS is the right design for the organisation's current context, scope, and purpose. A suitable BCMS fits the organisation; an unsuitable BCMS is calibrated to an organisation that no longer exists (or never existed). Suitability is tested against Clause 4.1 (context), 4.2 (interested parties), and 4.3 (scope).

Adequacy: The degree to which the BCMS is sufficient for the organisation's current risk environment, continuity requirements, and legal/regulatory obligations. An adequate BCMS is enough; an inadequate BCMS is insufficient for the risks it must address. Adequacy is tested against Clause 8.2 (BIA and risk assessment), 8.3 (strategy), and 4.2 (legal and regulatory requirements).

Effectiveness: The degree to which the BCMS is achieving its intended outcomes, the planned results that the organisation has defined in its BC policy (5.2), objectives (6.2), and continuity strategy (8.3). An effective BCMS works; an ineffective BCMS exists on paper but does not actually improve continuity. Effectiveness is tested against Clause 6.2 (objectives achieved?), 8.5 (exercises passed?), 9.1 (metrics met?), 9.2 (audit findings improving?), 10.1 (corrective actions closing?), and, most powerfully, actual disruption performance.

Review input: A defined category of evidence that must be presented to top management during the review. The clause specifies a structured input set (detailed in §7). Each input is the output of another BCMS clause, 9.1 metrics, 9.2 audit results, 8.5 exercise results, 10.1 corrective-action status, 4.1/4.2 context changes, and so on. The inputs are the evidence base for the three-part judgement.

Review output: A decision or action that results from the review. The clause specifies a structured output set: decisions on continuing suitability/adequacy/effectiveness, continual-improvement opportunities, BCMS changes, resource needs, and actions when objectives are not achieved. Each output must be owned, dated, and traceable to closure. Outputs are the link between the review and the rest of the BCMS.

Documented information (Clause 7.5): Information that the organisation must create, retain, and control to satisfy the BCMS's requirements. For Clause 9.3, the documented information is the review results, the minutes (or equivalent record) that capture the inputs presented, the discussion, the three-part judgement, and the decisions. The documented information is the evidence a certification body and a regulator will request first.

Continual improvement (Clause 10.2): The recurring activity to enhance the suitability, adequacy, and effectiveness of the BCMS. The management review is the strategic engine of continual improvement, it identifies the improvements that matter, commits the resources, and tracks the outcomes. Without the review, continual improvement becomes ad hoc and discretionary; with the review, it becomes directed and accountable.

Three lines of assurance: A governance model that distinguishes first-line (management owning and operating the risk, Clause 9.1), second-line (independent oversight and challenge, Clause 9.2 internal audit), and third-line (top-management strategic review, Clause 9.3). The three lines must be visibly distinct in the organisation's documentation and conduct. The model originates in corporate-governance practice and is reflected in RBI's and SEBI's expectations for regulated entities.

Relationship to Other Clauses

Clause 9.3 is the apex of the BCMS, it consumes outputs from almost every other clause and drives decisions back into them. Understanding these relationships is essential, because the certification auditor will trace the evidence flow: does the review actually receive the outputs of 9.1, 9.2, 8.5, 10.1? Do the review's decisions actually drive changes in 6.3, 7.1, 10.1, 10.2?

The evidence flow into the review (inputs)

The decision flow out of the review (outputs)

The relationship to 9.1 and 9.2 in practice

The three performance-evaluation clauses form a hierarchy: 9.1 is the broadest and most continuous (first-line, real-time), 9.2 is narrower and periodic (second-line, risk-based intervals), and 9.3 is the narrowest and most strategic (top-management, apex). The review consumes both.

• 9.1 → 9.3: The monitoring and measurement results from 9.1 are the primary evidence base for the review. The review does not re-compute every metric; it consumes the dashboards, trends, and evaluations that 9.1 has produced. If 9.1 is weak (metrics not defined, thresholds not set, data not collected), the review is flying blind. A strong review depends on a strong 9.1.
• 9.2 → 9.3: The internal audit results from 9.2 are the independent evidence base for the review. The review consumes the audit findings, nonconformities, opportunities for improvement, the overall conformity judgement, as a check on whether 9.1 is reliable and whether the BCMS conforms to requirements. If 9.2 is weak (audits not done, auditors not independent, findings not honest), the review has no independent assurance. A strong review depends on a strong 9.2.
• 9.3 → 9.1/9.2: The review's decisions feed back into 9.1 (revised metrics, thresholds) and 9.2 (revised audit programme, focus areas). The review is the only clause with the authority to direct these changes, which is why top management must conduct it.

The relationship to Clause 5.1 (Leadership)

Clause 5.1 requires top management to demonstrate leadership and commitment to the BCMS. The management review under 9.3 is the primary evidence of 5.1, it is the moment when top management visibly engages with the BCMS, makes decisions, and commits resources. A certification auditor who finds a weak 9.3 will almost always also raise a 5.1 finding, because the absence of a real review is, by definition, an absence of leadership. The two clauses are inseparable: 5.1 is the requirement to lead; 9.3 is the process that proves it.

The relationship to Clause 10.2 (Continual improvement)

Clause 10.2 requires the organisation to continually improve the suitability, adequacy, and effectiveness of the BCMS. The management review is the strategic engine of 10.2, it identifies the improvements that matter (not just the ones that are easy), commits the resources, and tracks the outcomes. Without the review, continual improvement becomes ad hoc, a series of tactical fixes driven by the latest audit or the latest incident, with no strategic direction. With the review, continual improvement becomes directed, a portfolio of improvements prioritised by top management against the organisation's risk environment and continuity objectives. The review is where improvement is chosen, not just allowed to happen.

Detailed Implementation Guidance

This section is the operational core of the guide. It walks through the seven steps of a defensible management review, from charter to closed-loop action tracking. Each step is tiered by maturity (L1 minimum → L5 advanced) and includes the specific evidence the certification auditor will look for.

Step 1: Establish the management review charter

Before the first review, the organisation must establish the review's terms of reference, who conducts it, how often, with what inputs, producing what outputs, and to whom the minutes are reported. This is the management review charter (toolkit doc 01). The charter is approved by top management (the CEO or the board committee) and is itself a controlled document under Clause 7.5.

What the charter must specify:

1. The review body. Who conducts the review, the CEO and executive committee (for a growing company), the board Risk Management Committee (for a listed entity), the board IT/Risk committee (for an RBI-regulated entity), or a delegated executive review panel with board-committee ratification (for a large organisation). The charter names the roles (not just the current incumbents), so the charter survives personnel changes.

2. The cadence. How often the complete review is conducted (at least annually; semi-annually for regulated entities; quarterly for the operational sub-reviews in a federated model) and what triggers an ad hoc review (a major disruption, a regulatory change, a failed exercise, a merger/acquisition, a scope change). The cadence is documented in the BCMS procedure and the board calendar.

3. The chair. Who chairs the review, typically the BCMS sponsor at top-management level (CEO, COO, or a designated C-suite executive). The chair is responsible for the quality of the review, not just its occurrence.

4. The quorum. The minimum top-management attendance required for the review to be valid. A review attended only by the BCM team is not valid regardless of how thorough the discussion is. The quorum should require at least the chair and one other top-management member, and, for regulated entities, a board-committee member or their delegate.

5. The input set. The structured list of inputs that must be presented at every review (detailed in Step 3 below). The charter references the ISO 22301 input categories and may add sector-specific inputs (RBI inspection findings, SEBI compliance, IRDAI compliance, DPDP breach logs, CERT-In reporting performance).

6. The output set. The structured list of outputs the review must produce (detailed in Step 5 below). The charter specifies that every output must be owned, dated, and traceable to closure.

7. The reporting destination. Where the review minutes go, to the board committee (Audit Committee, RMC), to the certification body (on request), to the regulator (on request), and to the BCMS team (for action tracking).

8. The action-tracking mechanism. How review decisions are tracked to closure, the action register, the owner, the deadline, the verification method, and the reporting back to the next review. This is the closed loop that makes the review a living process rather than an annual event.

Maturity tiering:

• L1 minimum: No charter; the review happens (or does not) based on individual initiative.
• L2 defensible: A one-page charter approved by the CEO, specifying the review body, cadence, chair, and input set.
• L3 established: A charter integrated with the board-committee terms of reference (for listed entities), with a federated review model (annual complete + quarterly operational) and a documented action-tracking mechanism.
• L4 mature: A charter that specifies the year-round evidence pipeline (who produces each input, when, in what format), the decision-rights matrix (which decisions the review body can make vs which require board ratification), and the escalation criteria (when an ad hoc review is triggered).
• L5 advanced: A charter that integrates the BCMS review with the ISO 27001, RBI/SEBI/IRDAI, and DPDP governance cycles into a federated operational-resilience governance regime, with a single evidence pipeline feeding multiple review bodies and a unified action tracker.

Step 2: Build the year-round evidence pipeline

The quality of the review is determined by the quality of the evidence presented to top management. If the evidence is prepared in the week before the review, frantically assembled, incomplete, and unverified, the review will be shallow. The mature approach is a year-round evidence pipeline: a standing set of inputs that are maintained continuously and consolidated into the review pack at the planned interval.

The pipeline owner. The BCM Manager (or the BCM Programme Office in a large organisation) owns the pipeline. They are responsible for collecting each input from its source (IT/DR for recovery metrics, HR for awareness training, procurement for supplier continuity, internal audit for audit results, legal for regulatory compliance), verifying its accuracy, and consolidating it into the review pack.

The pipeline cadence. Some inputs are produced continuously (9.1 metrics, dashboards updated monthly or quarterly); some are produced periodically (9.2 audit results, per audit engagement; 8.5 exercise results, per exercise); some are produced annually (BIA refresh, risk assessment refresh, regulatory compliance certificates). The pipeline tracks the production cadence of each input and flags any input that is overdue or stale at the time of the review.

The pipeline evidence. Each input in the pipeline is backed by source evidence, not just a summary slide, but the underlying audit report, exercise report, BIA document, metric dashboard, regulatory return, or incident log. The review pack references the source evidence (by document ID and version), so the certification auditor can trace any statement in the review pack back to its source.

Maturity tiering:

• L1 minimum: Evidence is assembled in the week before the review, from memory and from whatever documents the BCM Manager can find.
• L2 defensible: A checklist of inputs is maintained; each input has a source owner; the pack is assembled over 2–3 weeks before the review.
• L3 established: A year-round pipeline with defined production cadences; inputs are tracked monthly; stale inputs are flagged; the pack is a consolidation of continuously maintained evidence.
• L4 mature: The pipeline is automated through a growing GRC SaaS or a BCM-specialist platform (categorised tool, not named here); dashboards are real-time; the pack is generated semi-automatically with narrative added by the BCM Manager.
• L5 advanced: The pipeline is integrated across ISO 22301, ISO 27001, RBI/SEBI/IRDAI, and DPDP evidence sources; a single evidence repository feeds multiple governance cycles; the review pack is a strategic synthesis drawing on federated evidence.

Step 3: Assemble the structured input pack

The input pack is the document top management reads before and during the review. Its quality determines the quality of the review. The pack must address every ISO 22301 input category, plus any sector-specific inputs the organisation has committed to. The following is the canonical input set, organised by source clause.

Status of actions from previous management reviews

The first input is always the status of actions committed in previous reviews. This is the closed-loop test, did the decisions made last year actually happen? For each action, the pack records: the decision, the owner, the deadline, the current status (done / in progress / overdue / cancelled), the evidence of completion, and the reason for any slippage. Overdue actions are the most important item in this section, they are the test of whether the review's decisions carry weight. A pattern of overdue actions across multiple cycles signals that the review is not a decision body but a discussion forum, which is a 9.3 finding.

What the auditor checks: Is there a documented action tracker? Are the actions from the last review (and the one before) closed or honestly reported as overdue? Is there evidence of completion (not just a status update)?

Changes in external and internal issues (Clause 4.1)

The pack reports the changes in the organisation's context since the last review. External issues: market changes, competitor changes, technology changes (e.g., the shift to generative AI), threat landscape changes (ransomware trends, the BCI Horizon Scan), geopolitical changes, climate and weather events (Amendment 1:2024 added climate change to 4.1/4.2). Internal issues: organisational changes (growth, restructuring, M&A), process changes, technology changes (cloud migration, new systems), people changes (key-person departures, capability gaps), financial changes (budget pressure, investment). The pack does not re-state the full context (that was done at BCMS establishment), it reports what has changed and assesses the implications for the BCMS.

What the auditor checks: Does the pack identify material changes in context? Does it assess the implications for the BCMS (not just list the changes)? Is climate change addressed (Amendment 1:2024)?

Changes in the needs and expectations of interested parties, including legal and regulatory requirements (Clause 4.2)

The pack reports the changes in stakeholder expectations and in the legal/regulatory landscape. For an Indian organisation, this section is critical, the regulatory landscape has changed every year since 2020. The pack identifies new or changed regulations (CERT-In Directions 2022, DPDP Act 2023, RBI Master Direction 2023, SEBI CSCRF 2024, APRA CPS 230 for Australian operations, DORA for EU-facing operations), new or changed customer contractual requirements (continuity clauses, audit rights, data-localisation), and new or changed stakeholder expectations (board, employees, suppliers, regulators, media). For each change, the pack assesses whether the BCMS still meets the requirement and identifies any gaps.

What the auditor checks: Are recent regulatory changes identified? Are their implications for the BCMS assessed? Are gaps identified and directed to corrective action?

Information on BCMS performance and trends (Clause 9.1)

The pack presents the BCMS performance metrics and their trends. This is the primary first-line evidence. The metrics should cover: RTO/RPO achievement (target vs actual for the period); exercise pass rate; corrective-action closure rate; supplier-continuity compliance; awareness-training completion; incident frequency and impact; BIA/plan currency (when last refreshed); and any custom metrics the organisation has defined. The pack presents trends (not just point values), is performance improving, stable, or deteriorating? Deteriorating trends are the most important input, they are the early warning that the BCMS is losing effectiveness.

What the auditor checks: Are metrics defined and tracked? Are thresholds set in advance? Are breaches escalated? Are trends presented (not just point values)? Is negative evidence presented honestly?

The extent to which BC objectives have been achieved (Clause 6.2)

The pack reports the status of each BC objective. Objectives are the measurable targets the organisation set (Clause 6.2), e.g., "achieve RTO of 4 hours for the core banking system by Q4", "exercise all Tier-1 plans by year-end", "achieve 95% supplier-continuity compliance for Tier-1 suppliers by Q3". For each objective, the pack reports: the target, the current value, the trend, the probability of achievement, and the reason for any shortfall. Unachieved objectives are mandatory inputs to the review's output (Step 5), the review must direct action when objectives are not met.

What the auditor checks: Are objectives measurable? Are they tracked? Is the extent of achievement reported honestly? Are unachieved objectives directed to action?

Process performance and continuity of prioritised activities

The pack reports the performance of the prioritised activities (those identified in the BIA, Clause 8.2) during the period. For each prioritised activity: is it operating within its RTO/RPO? Were there any continuity incidents? Were there any near-misses? Is the activity's BIA still current? This input connects the BCMS to actual business operations, it is the evidence that the BCMS is protecting the activities that matter.

What the auditor checks: Are prioritised activities identified and tracked? Is their continuity performance reported? Are incidents and near-misses reported honestly?

Nonconformities and corrective actions (Clause 10.1)

The pack reports the nonconformities identified (from internal audit 9.2, external audit, exercises 8.5, incidents, regulatory inspections) and the corrective actions taken. For each nonconformity: the finding, the root cause, the corrective action, the owner, the deadline, the closure status, and the effectiveness verification. The pack highlights recurring nonconformities (the same finding across multiple cycles), these signal a systemic issue that the review must address. It also highlights overdue corrective actions, these signal that the corrective-action process is not working.

What the auditor checks: Is there a nonconformity register? Are root causes identified (not just symptoms)? Are corrective actions tracked to closure with effectiveness verification? Are recurring nonconformities escalated?

Audit results (Clause 9.2)

The pack reports the internal audit results since the last review. For each audit engagement: the scope, the criteria, the auditors (with independence confirmation), the findings (conformities, nonconformities, OFIs), the overall conformity judgement, and the status of findings closure. The pack also reports external audit results (certification body surveillance audits, regulatory inspections, customer audits). The audit results are the independent evidence, they are the check on whether 9.1 is reliable.

What the auditor checks: Was the internal audit conducted per the programme (Clause 9.2)? Were the auditors independent? Were findings reported honestly? Is the certification body's surveillance report included?

Exercise and test results (Clause 8.5)

The pack reports the exercise and test results since the last review. For each exercise: the scenario, the scope, the objectives, the participants, the results (pass/fail/partial), the findings (what worked, what did not), the corrective actions, and the closure status. Failed exercises are the most important input in this section, they are the controlled-discovery mechanism that finds BCMS weaknesses before a real disruption does. A pattern of "all exercises passed" across multiple cycles is a red flag, either the exercises are too easy (not stress-testing the BCMS) or the findings are not being reported honestly.

What the auditor checks: Were exercises conducted per the programme (Clause 8.5)? Did they stress-test the BCMS (scenarios severe-but-plausible)? Were failures reported honestly? Were corrective actions taken?

Actual disruption and incident performance

The pack reports the actual disruptions and incidents that occurred during the period and how the BCMS performed. For each disruption: the trigger, the impact, the RTO/RPO achieved vs target, the activation of plans (Clause 8.4), the effectiveness of the response, the lessons learned (Clause 8.6), and the corrective actions. This is the most powerful input, it is the real-world test of the BCMS. A disruption in which the RTO was missed by 300% is more important than a hundred exercises that passed. If the organisation had no disruptions during the period (unlikely for any organisation of meaningful size), the pack should note this and acknowledge that the absence of real-world evidence is itself a limitation.

What the auditor checks: Were disruptions reported honestly? Was the BCMS performance assessed against the targets? Were lessons learned and directed to corrective action? If no disruptions occurred, is this acknowledged?

Supplier and partner continuity performance

The pack reports the continuity performance of the organisation's continuity-critical suppliers and partners. For each Tier-1 supplier: the criticality, the continuity clause in the contract, the supplier's BCP/DR evidence (their own exercise results, their own audit certificates), the supplier's incidents during the period, and the organisation's contingency arrangements (alternative supplier, in-sourcing, work-around). Supplier drift is the most common undetected BCMS degradation, the SaaS vendor changes its BCP terms, the cloud provider changes its region architecture, the outsourced process changes its subprocessors, and the review is the checkpoint where these changes are surfaced.

What the auditor checks: Are Tier-1 suppliers identified and tracked? Is their continuity evidence current? Are supplier incidents reported? Are contingency arrangements tested?

Improvement opportunities and lessons learned

The pack reports the improvement opportunities identified during the period, from staff suggestions, from exercise after-actions, from incident reviews, from audit OFIs, from benchmarking, from the BCI Horizon Scan and similar practitioner data. This input is the forward-looking section, it identifies what the BCMS could do better, not just what it is doing wrong. The review prioritises these opportunities and commits the resources to pursue the high-value ones (an output, Step 5).

What the auditor checks: Are improvement opportunities solicited and captured? Are they prioritised? Are resources committed to the high-value ones?

The effectiveness of actions taken to address risks and opportunities (Clause 6.1)

The pack reports the effectiveness of the risk-treatment actions identified in Clause 6.1. For each risk treatment: the risk it addressed, the action taken, the effectiveness (did the risk reduce as intended?), the residual risk, and any new risks that emerged. This input closes the loop on risk management, it is the test of whether the risk-based planning in 6.1 actually reduced the risks it was designed to reduce.

What the auditor checks: Are risk-treatment actions tracked? Is their effectiveness assessed? Are residual risks reported?

Step 4: Conduct the review meeting

The review meeting is where top management engages with the evidence and makes decisions. Its quality depends on the quality of the preparation (Steps 1–3) and the discipline of the chair.

Pre-circulation. The input pack is circulated to top management at least 5–10 working days before the review. Top management is expected to read it. A review where the pack is presented for the first time in the meeting (with no pre-reading) is a review where no one has thought about the evidence, and the decisions will reflect that.

The agenda. A defensible agenda follows the structure of the input pack, with explicit time for each section and explicit time for the three-part judgement and the decisions. A typical agenda (for a 120-minute complete review):

1. Opening, attendance, conflicts of interest (5 min)
2. Status of actions from previous review (10 min)
3. Changes in context, stakeholders, regulations (15 min)
4. BCMS performance, metrics, objectives, trends (20 min)
5. Audit results and corrective-action status (15 min)
6. Exercise results and disruption performance (20 min)
7. Supplier continuity (10 min)
8. Three-part judgement: suitability, adequacy, effectiveness (15 min)
9. Decisions: improvements, changes, resources, actions on unachieved objectives (10 min)

The three-part judgement. The chair leads a structured discussion on each of the three questions:

• Suitability: Does the BCMS still fit the organisation, given the changes reported in §3.2 and §3.3?
• Adequacy: Is the BCMS sufficient for the current risk environment and continuity requirements, given the BIA, risk assessment, and regulatory landscape?
• Effectiveness: Is the BCMS achieving its intended outcomes, given the metrics, objectives, exercises, audits, and disruption performance?

The discussion must be honest, the chair's job is to challenge, not to ratify. A review where the three-part judgement is "everything is fine" without challenge is a review that has not engaged with the negative evidence.

The decisions. For each decision, the chair confirms: the decision, the owner, the deadline, the resource commitment, and the verification method. Decisions must be specific ("increase the exercise programme from semi-annual to quarterly for Tier-1 plans, owned by the BCM Manager, effective Q3, with a budget of ₹[amount] for the additional exercise") not vague ("improve exercising").

The minutes. The minutes are taken during the meeting and circulated within 5–10 working days after. The minutes capture: the date, the attendees (with top-management attendees named and their authority confirmed), the inputs presented (with reference to the source documents), the discussion summary (not verbatim, but the key points and any dissenting views), the three-part judgement (explicitly stated), the decisions (each with owner, deadline, resource commitment), and any follow-up actions. The minutes are the documented information retained under Clause 7.5.

Step 5: Produce the structured outputs

The review's outputs are its reason for existing. The clause requires outputs in five categories. Each must be owned, dated, and traceable to closure.

5.1 Decisions on continuing suitability, adequacy, and effectiveness. The review's explicit judgement, recorded in the minutes, on whether the BCMS continues to be suitable, adequate, and effective, and what to do about it. The judgement may be "continue as is" (rare, and only if the evidence genuinely supports it), "continue with specific changes" (the common case), or "major change required" (when the evidence shows the BCMS is materially unsuitable, inadequate, or ineffective). The judgement is a decision, it commits the organisation to a direction.

5.2 Decisions related to continual improvement (Clause 10.2). The improvement opportunities identified in §3.12 are prioritised, and the high-value ones are committed with resources. These decisions drive the continual-improvement programme for the next cycle. The review is where the improvement portfolio is chosen.

5.3 Decisions related to changes to the BCMS. The review may authorise changes to the BCMS scope (Clause 4.3), policy (Clause 5.2), objectives (Clause 6.2), strategy (Clause 8.3), plans (Clause 8.4), exercise programme (Clause 8.5), or monitoring (Clause 9.1). Significant changes are managed under Clause 6.3 (planned changes). The review is the authorising body for these changes.

5.4 Resource needs (Clause 7.1). The review allocates or reallocates resources, people (new BCM headcount, training budget), budget (exercise programme, supplier audits, technology refresh), technology (BCM platform, backup systems, DR infrastructure), and supplier arrangements (alternative suppliers, enhanced clauses). The resource decisions are the test of whether the review's decisions carry weight, a review that "decides" improvements without committing resources has not decided anything.

5.5 Actions required when BC objectives have not been achieved. For each unachieved objective (§3.5), the review directs action, a revised objective (with justification), a corrective action (to address the root cause), or a scope change (if the objective is no longer relevant). Unachieved objectives cannot be silently dropped; they must be explicitly addressed.

Step 6: Track outputs to closure (the closed loop)

The review's outputs are tracked in an action register (toolkit doc 10) until closure. The BCM Manager owns the register and reports the status of actions at each operational sub-review (in a federated model) and at the next complete review. Each action has: the decision, the owner, the deadline, the current status, the evidence of completion, and the effectiveness verification (did the action achieve what it was supposed to achieve?).

Overdue actions are escalated, to the chair, to the executive committee, and (for material actions) to the board committee. A pattern of overdue actions across multiple cycles is a finding, it signals that the review is not a decision body.

Effectiveness verification is the test of whether the action worked. "Train all staff on the new plan" is an action; "the next exercise shows that staff know the new plan" is the effectiveness verification. The review must verify effectiveness, not just completion.

Step 7: Report to the board committee and the regulator

The review's outputs are reported to the board committee (Audit Committee, RMC, or a dedicated Operational Resilience Committee) for ratification and oversight. For regulated entities, the review's outputs may need to be reported to the regulator, in the annual compliance certificate (IRDAI), in the board's report (Companies Act §134(3)(n)), in the RMC's report to the board (SEBI LODR Reg. 21), or in the supervisory return (RBI). The reporting is not the review itself; it is the accountability mechanism that ensures the review's decisions are visible to the governance bodies that oversee the organisation.

Federation: how to structure the review across the governance calendar

For growing companies and large organisations, the complete annual review may be supplemented (or partly decomposed) into a federated set of reviews across the governance calendar:

• Monthly operational review (BCM Manager + IT/DR + key activity owners): metrics, incidents, near-misses, corrective-action status. This is essentially the 9.1 evaluation cadence.
• Quarterly executive review (COO + CISO + BCM Manager + business-unit heads): trends, exercise results, supplier performance, audit findings, regulatory updates. This is a mid-cycle checkpoint.
• Semi-annual RMC review (board Risk Management Committee, for listed entities): strategic risks, regulatory compliance, major findings, major decisions. This satisfies the SEBI LODR Reg. 21 cadence.
• Annual complete review (CEO + executive committee + board committee): the full input set, the three-part judgement, the full output set. This satisfies Clause 9.3.

The federation must be documented in the charter (Step 1), and the annual complete review must consume the outputs of the federated reviews. The certification auditor will check that the federation covers the full input/output set over the cycle and that the annual review is genuinely complete.

Tools, Technologies, and Solutions

The management review is, at its core, a governance process, not a technology. The clause can be fully satisfied with office-suite tools (a Word document for the charter, an Excel tracker for the action register, a PowerPoint pack for the inputs, Outlook for the calendar, and SharePoint or Google Workspace for the evidence repository). Many small and growing companies run defensible 9.3 programmes with exactly this stack. However, as the organisation scales, more sites, more prioritised activities, more regulations, more frequent reviews, the evidence pipeline and action tracking become hard to manage with office tools alone, and a category-level GRC/BCM platform becomes economic. This section describes the tool categories (we do not name vendors; the matrices are category-level).

The tool stack by function

Category-level tool landscape (genericised)

The tools that support management review fall into five categories. Within each category, the choice depends on the organisation's size, sector, existing technology stack, and budget. The matrices below are category-level, vendor names are deliberately omitted per Singahi's IP rules.

Category 1: Growing GRC SaaS. General-purpose governance-risk-compliance platforms that include policy management, action tracking, audit management, and reporting modules. Suitable for growing companies (250–2,000 people) that want a single platform for ISO 22301, ISO 27001, and regulatory compliance. Strengths: breadth, workflow, audit-ready evidence. Weaknesses: BCM-specific depth (BIA, exercise management) is often light, a BCM-specialist tool may be needed alongside.

Category 2: BCM-specialist SaaS. Platforms purpose-built for business continuity, BIA management, plan authoring, exercise management, and management-review modules. Suitable for organisations whose primary focus is BCM (rather than integrated GRC). Strengths: BCM depth, best-practice templates. Weaknesses: integration with the broader GRC/IR stack may require custom work.

Category 3: Enterprise IRM suite. Large-scale integrated risk management platforms that span operational risk, compliance, audit, BCM, and cyber. Suitable for large organisations (2,000+ people) and regulated entities that need federated governance. Strengths: integration, scale, regulatory-grade evidence. Weaknesses: complexity, cost, long implementation (6–18 months).

Category 4: BCM consulting services. Category-level BCM consulting firms (the Big Four and their Indian counterparts, specialist BCM boutiques, and category-level compliance and audit firms) that prepare the input pack, facilitate the review, and provide independent challenge. Suitable for organisations that lack internal BCM depth or that want an external perspective. Strengths: expertise, independence, benchmarking. Weaknesses: cost, knowledge transfer (the consultant leaves; the knowledge leaves with them).

Category 5: Office tools (the L1–L2 baseline). Word, Excel, PowerPoint, Outlook, SharePoint/Google Workspace, Confluence. Suitable for small organisations (10–250 people) and for any organisation's first review cycle. Strengths: zero additional cost, universal familiarity, full customisation. Weaknesses: does not scale; manual consolidation is error-prone; version control is fragile; audit evidence is hard to assemble.

Tool selection criteria (category-level)

When evaluating a tool category for the management review, the following criteria matter:

1. Evidence federation. Can the tool aggregate evidence from multiple sources (9.1 metrics, 9.2 audits, 8.5 exercises, 10.1 actions) into a single review pack? The best tools do this automatically; office tools require manual aggregation.
2. Action tracking with effectiveness verification. Does the tool track not just action completion but also effectiveness (did the action achieve what it was supposed to)? This is the closed-loop requirement.
3. Board-committee reporting. Does the tool produce reports in the format the board committee expects? For listed entities, the SEBI LODR RMC reporting format; for banks, the RBI supervisory format; for insurers, the IRDAI compliance format.
4. Multi-framework support. Can the tool serve ISO 22301, ISO 27001, RBI/SEBI/IRDAI, and DPDP from a single evidence base? This avoids the "evidence silo" problem where each framework has its own evidence repository.
5. Audit readiness. Can the tool produce the evidence a certification body or regulator will request, on demand, with traceability from the review pack back to the source evidence?
6. Total cost of ownership. Subscription + implementation + internal admin time. The cheapest subscription is often not the cheapest total cost.
7. Data residency. For Indian organisations subject to RBI data-localisation or DPDP, can the tool host evidence within Indian jurisdiction? Many SaaS tools now offer India-region hosting (AWS Mumbai, Azure Pune, Google Mumbai).

The collaboration layer

The review meeting itself is conducted using standard collaboration tools, video conferencing for distributed participants, screen-sharing for the pack, and a shared note-taking surface (Confluence, SharePoint, or a real-time collaborative document). For most growing companies, the existing collaboration stack is sufficient; no specialist tool is needed for the meeting itself. The discipline is in the preparation and the follow-through, not the meeting technology.

Policy and Procedure Templates

This section provides the structural skeleton of the two core 9.3 artefacts: the Management Review Policy (the "what" and "why") and the Management Review Procedure (the "how"). These are also delivered as ready-to-customise templates in the toolkit (docs 01 and 02). The policy and procedure use "shall" language (which is appropriate for the organisation's own documents, only the standard's own text must be paraphrased).

Management Review Policy (structural skeleton)

1. Purpose. This policy establishes the requirement for top management of [Organisation Name] to review the Business Continuity Management System (BCMS) at planned intervals for continuing suitability, adequacy, and effectiveness, in accordance with ISO 22301:2019 Clause 9.3, the Companies Act 2013 §134(3)(n) and §177, SEBI LODR Reg. 21 (where applicable), [and sector-specific regulations: RBI Master Direction on IT Governance / SEBI CSCRF / IRDAI Information and Cyber Security Guidelines 2023 as applicable].

2. Scope. This policy applies to the BCMS as defined in the BCMS Scope Statement [document reference], covering all prioritised activities, sites, and supplier arrangements within that scope.

3. Top-management responsibility. Top management, defined as [the CEO and Executive Committee / the Board Risk Management Committee / a delegated executive review panel with board ratification], shall conduct the management review at planned intervals. Top management shall:

• Review the BCMS against the three-part test of suitability, adequacy, and effectiveness;
• Consume the structured input set defined in the Management Review Procedure;
• Produce the structured output set defined in the Management Review Procedure;
• Commit the resources required to implement the review's decisions;
• Ensure the review results are retained as documented information under Clause 7.5.

4. Cadence. The complete management review shall be conducted at least annually. For regulated entities, an additional semi-annual review shall be conducted and aligned with the [Risk Management Committee / Audit Committee] cycle. Ad hoc reviews shall be triggered by [a major disruption; a regulatory change; a failed exercise; a merger/acquisition; a scope change; a significant audit nonconformity].

5. Inputs. The management review shall consume, at minimum, the following inputs: [the full ISO 22301 input list, per §7 Step 3].

6. Outputs. The management review shall produce, at minimum, the following outputs: decisions on continuing suitability, adequacy, and effectiveness; decisions on continual improvement; decisions on BCMS changes; resource commitments; actions on unachieved objectives.

7. Reporting. The review results shall be reported to [the Board Audit Committee / the Board Risk Management Committee / the Board], and, where applicable, to [RBI / SEBI / IRDAI / CERT-In] in the prescribed format and cadence.

8. Document control. This policy is a controlled document under the BCMS Document Control Procedure. It shall be reviewed at least annually and re-approved by top management.

Management Review Procedure (structural skeleton)

1. Purpose. This procedure defines the step-by-step process for planning, preparing, conducting, and following up the management review.

2. Roles.

• Chair: [CEO / COO / designated C-suite executive]. Responsible for the quality of the review, the three-part judgement, and the decisions.
• BCM Manager: Responsible for the year-round evidence pipeline, the input pack, the minutes, and the action tracker.
• Contributors: [CISO, CRO, IT/DR Lead, HR Lead, Procurement Lead, Legal Lead, Internal Audit]. Responsible for their respective inputs.
• Review body: [the Executive Committee / the RMC / the delegated review panel]. Responsible for the three-part judgement and the decisions.
• Minute-taker: [BCM Programme Office / Company Secretary]. Responsible for the documented information.

3. Pre-review (T-30 to T-5 days).

• T-30: BCM Manager issues the input-collection request to contributors.
• T-20: Contributors submit their inputs (metrics, audit results, exercise results, action status, regulatory updates).
• T-15: BCM Manager consolidates inputs into the draft pack; verifies accuracy; identifies stale inputs.
• T-10: BCM Manager circulates the draft pack to the Chair for review.
• T-5: BCM Manager circulates the final pack to the review body.

4. The review meeting (T-0).

• Opening: attendance, conflicts of interest, agenda confirmation.
• Inputs: structured walkthrough of each input section (per §7 Step 4 agenda).
• Three-part judgement: Chair leads the structured discussion on suitability, adequacy, effectiveness.
• Decisions: Chair confirms each decision with owner, deadline, resource commitment.
• Closing: confirmation of the next review date.

5. Post-review (T+1 to T+10 days).

• T+5: BCM Manager circulates the draft minutes to the review body.
• T+10: BCM Manager finalises the minutes and logs all decisions in the action tracker.
• T+15: BCM Manager reports the review outputs to the [board committee / regulator] in the prescribed format.

6. Action tracking (continuous).

• Each action is tracked in the action register (toolkit doc 10).
• Status is reported at each operational sub-review and at the next complete review.
• Overdue actions are escalated to the Chair.
• Effectiveness verification is recorded for each completed action.

7. Federation. [If the organisation uses a federated model: the monthly, quarterly, semi-annual, and annual reviews and their respective inputs/outputs.]

Document control

The charter, policy, procedure, input pack, minutes, and action register are all controlled documents under Clause 7.5. Each has a version number, an owner, an approval authority, a retention period, and a storage location. The BCM Manager is the custodian. The retention period should align with the longest applicable regulatory look-back, typically five years for RBI/SEBI supervisory cycles, longer for listed entities subject to SEBI inspection windows.

Risk Assessment and Treatment

The management review itself is the organisation's strategic risk-assessment and risk-treatment forum for the BCMS, but the review must be fed by a structured risk-assessment process (Clause 6.1, Clause 8.2) and must direct risk-treatment actions (Clause 10.1, 10.2). This section addresses how 9.3 integrates with the BCMS risk landscape.

What can go wrong with the management review itself

The management review is a process, and like any process it has failure modes. A risk assessment of the review itself identifies the following top risks, with their treatments:

How the review treats BCMS risks identified elsewhere

The management review is the apex risk-treatment forum for the BCMS. Risks identified in Clause 6.1 (risks and opportunities), Clause 8.2 (BIA and risk assessment), Clause 9.2 (internal audit findings), and Clause 8.5 (exercise failures) all flow to the review for strategic direction. The review's job is to:

1. Confirm the risk treatment. For each risk identified, confirm that the treatment is appropriate and effective.
2. Re-prioritise. Risks change over time, a risk that was Tier-3 last year may be Tier-1 this year (e.g., ransomware-as-a-service has lowered the barrier; a new regulation has raised the stakes). The review re-prioritises.
3. Commit resources. Risk treatment requires resources, the review allocates them.
4. Direct corrective action. For risks where the treatment has not been effective, the review directs corrective action (Clause 10.1).
5. Authorise strategic change. For risks that require a fundamental change to the BCMS (new strategy, new supplier, new technology), the review authorises it (Clause 6.3).

The risk of "review theatre"

The most insidious risk is review theatre, a review that looks like a review (meeting held, pack presented, minutes produced) but does not actually challenge the BCMS or commit to change. Review theatre is harder to detect than an absent review, because the documented evidence exists. The certification auditor's test for review theatre is to compare the review's judgement and decisions across multiple cycles: if the judgement is always "suitable, adequate, effective" and the decisions are always "continue as is" or vague improvements with no resources, the review is theatre. The treatment for review theatre is leadership, a chair who challenges, contributors who report honestly, and a board committee that holds the review body accountable for the quality of the review, not just its occurrence.

Audit and Compliance Checklist

This section provides 30 audit questions that a certification body (BSI Group, DNV, SGS, TÜV, Bureau Veritas, Intertek, NQA and equivalents), a regulator (RBI/SEBI/IRDAI/CERT-In), or an internal auditor will use to test conformity with Clause 9.3. For each question, the expected evidence and the red flag (the signal that the answer is "no") are specified. Use this as a self-assessment before the certification audit.

Review establishment (charter, cadence, top management)

1. Is there a documented management review charter or terms of reference?

   • Expected evidence: A controlled document (under Clause 7.5) specifying the review body, chair, cadence, quorum, input set, output set, and reporting destination.
   • Red flag: No charter; or a charter that is not approved by top management; or a charter that has not been reviewed since the BCMS was established.

2. Does the charter specify that top management conducts the review?

   • Expected evidence: The charter names the top-management roles (CEO, executive committee, board committee) that constitute the review body.
   • Red flag: The charter delegates the review to the BCM Manager or to mid-level management.

3. Is the review conducted at planned intervals?

   • Expected evidence: A documented cadence (at least annually) in the charter and in the board/governance calendar; review minutes dated consistently with the cadence.
   • Red flag: No documented cadence; reviews conducted ad hoc; or the gap between reviews exceeds the planned interval without explanation.

4. Are top-management attendees named in the minutes?

   • Expected evidence: Each set of minutes lists the attendees by name and role, with top-management attendees clearly identified.
   • Red flag: Minutes that list only the BCM team; or minutes with no attendance record; or "apologies" from every top-management member.

5. Is there evidence the review actually happened (not just minutes that were written)?

   • Expected evidence: Minutes with a date, attendees, discussion summary, and decisions; ideally corroborated by calendar invitations, video-conference recordings, or expense records.
   • Red flag: Minutes that appear to have been written retrospectively for the certification audit (often detectable by inconsistent detail or no corollary evidence).

Input completeness (the ISO 22301 input set)

6. Does the review pack include the status of actions from previous reviews?

   • Expected evidence: An action-status table showing each previous decision, owner, deadline, current status, and evidence of completion.
   • Red flag: No action tracker; or the tracker shows a pattern of overdue actions with no escalation.

7. Does the review pack include changes in external and internal issues (Clause 4.1)?

   • Expected evidence: A section identifying material changes in the organisation's context since the last review, with implications for the BCMS.
   • Red flag: No context-change section; or a section that re-states the original context without identifying what changed.

8. Does the review pack address climate change (Amendment 1:2024 to 4.1/4.2)?

   • Expected evidence: Explicit consideration of climate-related risks and adaptation in the context and stakeholder sections.
   • Red flag: No mention of climate; or a one-line dismissal ("not relevant").

9. Does the review pack include changes in legal, regulatory, and stakeholder requirements (Clause 4.2)?

   • Expected evidence: Identification of new or changed regulations (CERT-In, DPDP, RBI, SEBI, IRDAI, DORA, APRA CPS 230 as applicable) and assessment of BCMS gaps.
   • Red flag: No regulatory-update section; or a section that misses recent material changes.

10. Does the review pack include BCMS performance information and trends (Clause 9.1)?

    • Expected evidence: Metric dashboards with trends, threshold breaches, and evaluations.
    • Red flag: No metrics; or point values without trends; or only positive metrics (no negative evidence).

11. Does the review pack include the extent to which BC objectives have been achieved (Clause 6.2)?

    • Expected evidence: An objectives-status table showing each objective, its target, current value, and probability of achievement.
    • Red flag: No objectives; or objectives that are not measurable; or all objectives marked "on track" without evidence.

12. Does the review pack include nonconformities and corrective-action status (Clause 10.1)?

    • Expected evidence: A nonconformity register with root causes, corrective actions, closure status, and effectiveness verification.
    • Red flag: No register; or recurring nonconformities with no escalation; or corrective actions closed without effectiveness verification.

13. Does the review pack include audit results (Clause 9.2)?

    • Expected evidence: The internal audit reports issued since the last review, with findings and the overall conformity judgement.
    • Red flag: No audits conducted; or audits not independent; or audit findings not in the pack.

14. Does the review pack include exercise and test results (Clause 8.5)?

    • Expected evidence: The exercise reports issued since the last review, with scenarios, results, findings, and corrective actions.
    • Red flag: No exercises conducted; or all exercises "passed" with no findings (a red flag for exercise realism).

15. Does the review pack include actual disruption and incident performance?

    • Expected evidence: Incident reports with impact, RTO/RPO achieved vs target, lessons learned, and corrective actions.
    • Red flag: No incidents reported (unlikely for any organisation of meaningful size, investigate whether incidents are being suppressed); or incidents with no BCMS performance assessment.

16. Does the review pack include supplier and partner continuity performance?

    • Expected evidence: A supplier-continuity section showing Tier-1 suppliers, their continuity evidence, their incidents, and the organisation's contingency.
    • Red flag: No supplier section; or supplier evidence that is stale (older than one cycle).

17. Does the review pack include improvement opportunities and lessons learned?

    • Expected evidence: A forward-looking section identifying improvement opportunities from staff, exercises, incidents, audits, and benchmarking.
    • Red flag: No improvement section; or improvements that are vague ("improve culture") with no specifics.

Output quality (decisions, not just discussion)

18. Does the review produce an explicit judgement on suitability?

    • Expected evidence: The minutes record top management's judgement on whether the BCMS is still suitable, with reasoning.
    • Red flag: No explicit suitability judgement; or a judgement with no reasoning.

19. Does the review produce an explicit judgement on adequacy?

    • Expected evidence: The minutes record top management's judgement on whether the BCMS is still adequate, with reasoning.
    • Red flag: No explicit adequacy judgement.

20. Does the review produce an explicit judgement on effectiveness?

    • Expected evidence: The minutes record top management's judgement on whether the BCMS is effective, with reasoning drawn from the inputs.
    • Red flag: No explicit effectiveness judgement; or "effective" with no reference to the negative evidence.

21. Does the review produce decisions on continual improvement (Clause 10.2)?

    • Expected evidence: Specific improvement actions with owners, deadlines, and resource commitments.
    • Red flag: No improvement decisions; or vague improvements ("better training") with no owner or resources.

22. Does the review produce decisions on BCMS changes (Clause 6.3)?

    • Expected evidence: Specific change decisions (scope, policy, objectives, strategy, plans) managed under the planned-changes process.
    • Red flag: No change decisions across multiple cycles; or change decisions with no implementation plan.

23. Does the review produce resource commitments (Clause 7.1)?

    • Expected evidence: Specific resource allocations (people, budget, technology, supplier) tied to the decisions.
    • Red flag: Decisions with no resources; or resources that are "subject to budget" with no budget owner.

24. Does the review direct action on unachieved objectives?

    • Expected evidence: For each unachieved objective (per Q11), a specific action, revision, corrective action, or scope change.
    • Red flag: Unachieved objectives silently dropped; or "will try harder" with no action.

Closed-loop action tracking

25. Is there an action tracker for review decisions?

    • Expected evidence: A controlled register (Excel or GRC platform) listing each decision, owner, deadline, status, evidence of completion, and effectiveness verification.
    • Red flag: No tracker; or a tracker that is updated only before the next review.

26. Are overdue actions escalated?

    • Expected evidence: An escalation log or minutes showing overdue actions reported to the chair or the board committee.
    • Red flag: Overdue actions with no escalation; or a pattern of overdue actions across multiple cycles.

27. Is effectiveness verified for completed actions?

    • Expected evidence: For each completed action, a documented effectiveness check (e.g., the next exercise shows the corrective action worked).
    • Red flag: Actions closed with no effectiveness verification; or effectiveness assumed rather than tested.

Documented information and integration

28. Are the review minutes retained as documented information under Clause 7.5?

    • Expected evidence: Controlled minutes with version numbers, approval, and storage in the BCMS document repository.
    • Red flag: Minutes on a personal drive; or no version control; or minutes missing for one or more cycles.

29. Are the review outputs reported to the board committee (where applicable)?

    • Expected evidence: Board-committee minutes or papers that reference the BCMS review and its key decisions.
    • Red flag: No board-committee reporting; or reporting that is so summarised it loses the decisions.

30. Is the management review integrated with the regulatory compliance cycle (where applicable)?

    • Expected evidence: The review pack references and is referenced by the RBI/SEBI/IRDAI/CERT-In/DPDP compliance returns; the review's decisions align with the regulatory agenda.
    • Red flag: The BCMS review and the regulatory compliance cycle are separate processes with no integration; or the regulatory returns are filed without the BCMS review's evidence.

Metrics and KPIs

This section defines 15 KPIs for measuring the performance of the management review itself. These are process KPIs (is the review working as a process?) and outcome KPIs (is the review improving the BCMS?). They are distinct from the BCMS operational KPIs (RTO/RPO achievement, exercise pass rate, etc.) which are inputs to the review, not measures of the review. The BCM Manager should report these KPIs in the input pack, they are the meta-measure of whether the review itself is effective.

Process KPIs (is the review working as a process?)

Output KPIs (is the review producing action?)

Outcome KPIs (is the review improving the BCMS?)

The dashboard sample

The BCM Manager should maintain a one-page dashboard reporting these 15 KPIs, trended over the past 3–5 cycles. The dashboard is the first slide of every input pack, it tells top management at a glance whether the review process itself is healthy. Deteriorating trends in the process KPIs (on-time rate, attendance, decision rate) are the early warning that the review is becoming a ritual; deteriorating trends in the outcome KPIs (implementation rate, objective achievement, recurring nonconformities) are the early warning that the review's decisions are not changing the BCMS.

Common Pitfalls / Audit Failures

This section names the most common anti-patterns in Clause 9.3 implementation, the failures that recur across Indian organisations and that certification auditors find most frequently. Each is given a memorable name (the better to recognise it), a description, and the treatment.

"The Noted Review"

The pattern: Every input is "noted." Every judgement is "endorsed." Every decision is "continue as is." The minutes read like a stamp-collection of approvals, with no challenge, no dissent, and no change. The review is a ritual that consumes executive time and produces nothing.

Why it happens: The chair does not challenge (because challenge is uncomfortable and the BCM is a colleague); the contributors do not report negative evidence (because negative evidence is unwelcome); the top-management attendees are not engaged (because they have not read the pack); and the review has no consequences (because the board committee does not scrutinise the quality of the review).

The treatment: The chair's job is to challenge, not ratify. The first question on each input should be "what is this telling us?" not "do we accept this?" The minutes must record the discussion, not just the conclusion. The certification auditor's test is to look for decisions and challenges in the minutes, if there are none, the review is a Noted Review.

"The BCM Team Review"

The pattern: The only attendees are the BCM Manager, the IT/DR lead, and maybe the CISO. The CEO "sent apologies." The review is, in substance, a BCM team meeting dressed up as a management review.

Why it happens: The CEO is busy; the BCM team does not want to "waste the CEO's time"; the CEO delegated attendance to the CISO; the charter does not require top-management attendance.

The treatment: The charter specifies the quorum, including at least one named top-management role. The chair is a named C-suite executive. The certification body checks attendance. A review without top management is not a 9.3 review, regardless of how thorough the BCM team's discussion was.

"The Once-A-Year-Tick-Box"

The pattern: The review is conducted once a year, two weeks before the certification surveillance audit, with a pack assembled in the preceding week. The same pack is reused each year with the dates changed. No one reads it. The audit passes because the review happened, not because it was any good.

Why it happens: The review is treated as a compliance artefact for the certification body, not as a governance process for the organisation.

The treatment: The review is calendar-anchored to a governance milestone (the board's annual risk report, the regulatory compliance certificate), not to the certification audit. The certification body's auditor should ask "when in your governance calendar does this review sit?", if the answer is "two weeks before your visit," that is the Once-A-Year-Tick-Box.

"The Stale Pack"

The pattern: The input pack contains evidence that is months or years out of date, the BIA is from three years ago, the last exercise report is from eighteen months ago, the supplier list has not been updated since the BCMS was established, the regulatory update section misses the last two regulations.

Why it happens: The year-round evidence pipeline does not exist; the BCM Manager assembles the pack from whatever is at hand; no one checks the freshness of the evidence.

The treatment: The charter specifies the maximum age of each input (BIA refreshed every 12–24 months; exercise results from the last cycle; regulatory updates from the last quarter). The BCM Manager flags stale inputs in the pack and directs them to corrective action. The certification body checks the dates on the source evidence.

"The All-Green Dashboard"

The pattern: Every metric is green. Every exercise passed. Every objective is on track. Every audit finding closed. There are no nonconformities. The BCMS is, on paper, perfect.

Why it happens: Negative evidence is suppressed (because it is unwelcome); the metrics are defined so loosely that they cannot fail; the exercises are designed so they cannot fail; the audits are shallow so they do not find anything.

The treatment: The certification auditor's test is to look for negative evidence, and if there is none, to investigate why. A real BCMS, in a real organisation, has failed exercises, missed metrics, recurring findings, and near-misses. The absence of negative evidence is itself a major finding, it means the BCMS is not being honestly measured. The chair's job is to surface the negative evidence, not to suppress it.

"The Decision That Was Not a Decision"

The pattern: The minutes record "decisions" that are vague ("improve awareness training"), unowned ("the BCM team to follow up"), undated ("in due course"), and unresourced ("subject to budget"). These are not decisions, they are aspirations. At the next review, the same "decisions" are re-committed, because nothing happened.

Why it happens: The chair does not enforce the decision format (specific, owned, dated, resourced); the contributors do not want to be held accountable; the organisation's decision-making culture is consensus-driven and avoids commitment.

The treatment: Every decision must pass the SMART test (Specific, Measurable, Achievable, Relevant, Time-bound) plus the Owner test (one named owner) and the Resource test (resources committed). The certification body checks the decisions against this test.

"The Broken Loop"

The pattern: Decisions are made, but the action tracker is not maintained. At the next review, no one knows what happened to the last review's decisions. The same decisions are re-made, because there is no institutional memory.

Why it happens: The BCM Manager does not maintain the tracker (because it is not in their job description or because they are overwhelmed); the chair does not ask for the tracker at the next review (because they have forgotten); the action tracker is a spreadsheet on someone's personal drive that is lost when they leave.

The treatment: The action tracker is a controlled document under Clause 7.5, owned by the BCM Manager, stored in the BCMS document repository. The first agenda item of every review is the action-status report. The certification body traces decisions across cycles.

"The Federation Illusion"

The pattern: The organisation claims a federated review model (monthly operational + quarterly executive + annual complete), but only the monthly operational review actually happens. The annual complete review is a one-page summary of the monthly reviews, with no top-management engagement and no three-part judgement.

Why it happens: The federation was designed for the certification audit, not for governance; the operational reviews are real but the strategic review is a fiction.

The treatment: The certification body checks that the annual complete review is genuinely complete, full input set, top-management attendance, three-part judgement, full output set. A summary of operational reviews is not a complete review.

"The Wrong Three-Part Judgement"

The pattern: The minutes record a judgement, but it conflates suitability, adequacy, and effectiveness into a single "the BCMS is fine", without distinguishing the three questions. Or the judgement addresses effectiveness (are we achieving outcomes?) but not suitability (does the BCMS still fit?) or adequacy (is it sufficient?).

Why it happens: The three-part test is not understood; the chair uses "suitable, adequate, effective" as a single phrase rather than three distinct questions.

The treatment: The minutes record three separate judgements, each with reasoning. The certification body's test is to ask "what is your judgement on suitability? on adequacy? on effectiveness?", and if the answers are identical, the review has not engaged with the distinction.

"The Regulator Was Not in the Room"

The pattern: For regulated entities, the BCMS review and the regulatory compliance cycle are separate processes. The review does not consume the regulatory compliance evidence, and the regulatory returns are filed without the review's evidence. The two processes drift apart, and the regulator's supervisory findings are a surprise to the review body.

Why it happens: The BCM function and the compliance function are separate; the review charter does not include regulatory compliance as an input; the regulatory calendar and the review calendar are misaligned.

The treatment: The review charter includes regulatory compliance performance as a mandatory input. The review calendar is aligned with the regulatory compliance calendar (so the review consumes the latest regulatory return and the next return is informed by the review's decisions). The certification body checks the integration.

Illustrative Scenario 1: Failure

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Disclaimer: The following is a fictional, composite scenario written for teaching. The Bank, its management review and every internal detail below are invented and describe no real organisation.

The setting

A large Indian private-sector bank, call it the Bank, had invested significantly in business continuity since the RBI Cyber Security Framework (2016). It had a board-approved BCP/DR policy, a documented BIA, an active-active data centre architecture, a quarterly exercise programme, and ISO 22301 certification. On paper, its BCMS was mature. The board's Risk Management Committee (RMC), constituted under SEBI LODR Reg. 21, received a quarterly BCM update. The internal audit function (Clause 9.2) audited the BCMS annually. The management review (Clause 9.3) was conducted annually, in the form of a 30-minute agenda item at the November executive committee meeting, with a 12-slide pack prepared by the BCM team.

The pattern of the review

Over three years, the review followed a consistent pattern. The BCM Manager presented the pack. The CEO and the executive committee listened. The slides were almost entirely green, RTO/RPO achieved, exercises passed, audit findings closed, supplier continuity confirmed. The three-part judgement was a single sentence: "The BCMS remains suitable, adequate, and effective." The decisions were consistent: "continue the current programme; no changes recommended." The minutes were filed. The RMC received a one-paragraph summary. No decisions were made. No resources were committed. No changes were authorised. The review was, in the terms of §13.1, a Noted Review, and, in the terms of §13.5, an All-Green Dashboard.

Beneath the green dashboard, several things were happening that the review did not surface:

• The BIA was three years old. The bank had launched multiple new digital products (a new mobile banking app, a new UPI integration, a new credit-card platform) since the BIA was last refreshed. The RTO for these new products had never been formally set; the BIA's RTOs applied to the legacy systems.
• The exercise programme tested the legacy systems and the active-active failover, both of which worked. The new digital products had never been included in an exercise. Their failover had never been tested.
• The supplier-continuity register listed the bank's traditional IT vendors. The cloud providers and SaaS platforms that the new digital products depended on were not in the register. Their continuity terms had not been reviewed.
• Two of the last three exercises had surface findings (manual procedures outdated, comms tree stale) that were logged as corrective actions but had not been closed. The corrective-action register showed them as "in progress" for eighteen months.
• The internal audit (9.2) had flagged the stale BIA and the untested new products as an OFI (Opportunity for Improvement), a softer finding than a nonconformity, in each of the last two cycles. The OFI had been "accepted" by management but not acted on.
• The regulatory landscape was shifting, with new cyber-incident reporting and IT-governance expectations from CERT-In and the RBI on the horizon. The review never scanned it.

The disruption

One Saturday, a power failure at the Bank's primary data centre took net banking and card systems dark for about half a day. It was the third significant outage in two years. The active-active failover did not work as designed for the new digital products, because their failover had never been tested. The BIA's RTO of 4 hours was missed; the actual recovery took 8–12 hours. Customers could not access accounts, make payments, or use cards during a peak period. Social media and press coverage were severe. The regulator was notified.

The regulatory response

Within weeks, the RBI restricted the Bank's new digital launches and new card issuance pending an external IT audit. The restrictions took more than a year to lift fully. The RBI's action was explicitly framed not as an IT operations issue but as a board-level governance failure, the regulator's view was that repeated outages indicated a systemic governance deficiency that the board and top management should have identified and corrected.

The Clause 9.3 root cause

The root cause of the disruption was not the power failure (an operational event), it was the management review (a governance failure). Specifically:

1. Suitability was not genuinely assessed. The review never asked whether the BCMS scope still fit the Bank as it now was, a bank with a fast-growing digital product portfolio that the BCMS did not cover. The "suitable" judgement was an assertion, not an evidence-based conclusion.
2. Adequacy was not genuinely assessed. The review never asked whether the BIA, the RTO/RPO targets, the exercise programme, and the supplier controls were sufficient for the current risk environment. The BIA was three years stale; the new products were untested; the supplier register was incomplete. The "adequate" judgement was an assertion.
3. Effectiveness was not honestly assessed. The All-Green Dashboard suppressed the negative evidence, the unclosed corrective actions, the OFIs from internal audit, the untested new products. The "effective" judgement was uninformed.
4. The closed loop was broken. The corrective actions from previous exercises and audits were logged but not closed. The review did not track them. The same findings recurred and were the direct cause of the failed failover.
5. Top management was not engaged. The 30-minute agenda item did not allow the depth of challenge the BCMS required. The CEO and executive committee relied on the green dashboard; the BCM team did not surface the red evidence; the RMC received a summary that lost the detail.
6. Regulatory drift was not tracked. The review did not assess the Bank's readiness for the regulatory changes that were on the horizon.

The lessons for Clause 9.3

This case is the canonical illustration of why Clause 9.3 exists and what happens when it fails. The BCMS existed. The plans existed. The exercises happened. The audits happened. The certification was current. But the management review was a ritual, and the ritual did not catch the atrophy that was happening beneath the green dashboard. The regulator's action, framed as a governance failure, not an IT failure, is exactly the framing that Clause 9.3 is designed to enforce: continuity is a board-level accountability, and the management review is the process by which the board discharges it.

The specific Clause 9.3 lessons:

• The review must challenge, not ratify. A green dashboard with no negative evidence is a red flag, not a comfort.
• The three-part judgement must be evidence-based, not asserted. "Suitable, adequate, effective" without reasoning is not a judgement; it is a phrase.
• The BIA currency is a review input. A stale BIA is a review finding, not merely a BCM team task.
• The exercise programme must cover the current scope. Untested new products are a review finding.
• Corrective actions must close. An action register with eighteen-month-old "in progress" items is a review finding.
• Internal audit OFIs are review inputs. An OFI that recurs across cycles must be escalated to a nonconformity and addressed.
• Regulatory drift is a mandatory review input. The review must assess the regulatory horizon, not just the current compliance status.
• The review must produce decisions. A review with no decisions, no resources, and no changes is a Noted Review, and a Noted Review is a finding waiting to happen.

Illustrative Scenario 2: Success

Disclaimer: The following is a fictional, composite scenario set during the December 2015 Chennai floods, which were real. The Firm, its management review, its decisions and its results are invented and describe no real organisation.

The setting

A large Indian IT-services and outsourcing firm, call it the Firm, had a large workforce across multiple delivery centres, with Chennai as one of its largest hubs. The Firm had a mature BCMS, anchored by its exposure to global financial-services customers (whose contractual continuity clauses were stringent), its experience with the 2009 H1N1 pandemic (which had driven pandemic-continuity investment), and its own enterprise risk-management discipline. The management review of the BCMS was conducted semi-annually, chaired by the Chief Operating Officer, with the CEO attending the annual review. The board's Risk Management Committee received the review outputs. The Firm was ISO 22301 certified.

The maturity of the review (the 9.3 foundation)

The Firm's management review was, in the terms of this guide, an L4 (mature) review. Specifically:

• The charter was board-aligned. The review was anchored in the COO's governance calendar, with the RMC receiving the outputs. The charter specified the input set, the output set, and the decision-rights matrix.
• The year-round evidence pipeline existed. The BCM Programme Office maintained a continuous evidence base, monthly metrics, quarterly exercise reports, annual BIA refresh, annual regulatory scan, real-time supplier monitoring.
• The input pack was structured and honest. The pack included negative evidence (failed component tests, supplier incidents, customer-audit findings) and the three-part judgement engaged with it.
• The federation was real. Monthly operational reviews (BCM Programme Office + delivery-centre heads), quarterly executive reviews (COO + business-unit heads), semi-annual COO-chaired complete reviews, and an annual CEO + RMC strategic review.
• The closed loop was enforced. The action tracker was maintained, overdue actions were escalated, and effectiveness was verified at the next cycle.

A specific decision from a review approximately eighteen months before the flood is illustrative. The review had identified single-site concentration risk in Chennai, too many critical delivery operations in one geography. The review had directed a multi-site strategy: capacity in Pune, Hyderabad, and Noida was expanded; cross-site staff training was initiated; the BIA was refreshed to test recovery assumptions with work-from-anywhere and cross-site failover; and the exercise programme was revised to include a multi-site failover scenario. The decision was owned by the COO, resourced over eighteen months (capacity expansion, training, exercise programme), and tracked to closure. The next exercise (approximately six months before the flood) tested the cross-site failover and identified further improvements, which were also tracked to closure.

The disruption

In November–December 2015, record monsoon flooding submerged Chennai. Several of the Firm's delivery centres in the city were affected. Tens of thousands of employees could not reach the offices; power and connectivity were disrupted; the supply network (transport, food, vendor staff) was disrupted. For most organisations in Chennai, this was a catastrophic continuity event. Banks closed branches; back-office operations halted; insurance claims spiked.

The response

The Firm invoked its BCP. Specifically:

• Cross-site failover. The work that could be moved to Pune, Hyderabad, and Noida was moved, within hours, not days. The capacity investment from the eighteen-month-old review decision paid off immediately.
• Work-from-anywhere. Employees who could not reach any office but had power and connectivity worked from home. The earlier investment in remote-work infrastructure (VPN capacity, remote access, collaboration tools) was used at scale.
• Employee safety first. The Firm's first priority was employee safety, those in flood-affected areas were contacted, those who needed help received it, and no employee was required to travel through dangerous conditions. The people-continuity dimension (Clause 8.2 people impact, ISO/TS 22330) was tested and held.
• Customer communication. The Firm proactively communicated with each affected customer, the impact, the recovery plan, the expected recovery time. The customer communication playbook (Clause 8.4) was tested and held.
• Continuous adjustment. As the flood evolved, the BCM team adjusted the response, adding capacity where bottlenecks emerged, re-prioritising work, and managing customer expectations in real time.

The Chennai operations were largely restored within approximately one week. Critically, the Firm held its full-year revenue guidance and told investors that its BCP had absorbed most of the financial impact. The customer impact was minimal; no major customer contract was lost as a result of the flood.

What the mature review bought

The Firm's BCMS investment, driven by the management review's decisions, paid off:

• Investment (over ~18 months): capacity expansion, cross-site training, exercise programme, and remote-work infrastructure, a specific, resourced decision of the management review.
• Loss avoided: The Firm's revenue at risk during the Chennai shutdown (had it not been able to failover) was substantial. The customer-contract risk (had major customers experienced service failure and invoked penalty clauses or moved to competitors) was larger. The reputational risk (had the Firm been seen as unable to manage a known hazard in a known location) was larger still.
• Guidance held: The Firm's ability to publicly reaffirm its revenue guidance, in a quarter when many Chennai-based organisations were issuing profit warnings, was a direct competitive outcome of the BCMS.
• Customer confidence: Multiple global financial-services customers cited the Firm's flood response in subsequent contract renewals and expansions, the BCMS was a sales asset, not just a cost centre.

Even on conservative assumptions, the return was a multiple of the investment within one quarter, and larger over the following years as customer confidence turned into business.

The Clause 9.3 lesson

The Firm's success was not luck. It was not the heroism of the BCM team during the flood (though there was heroism). It was the eighteen months of management-review-driven investment that preceded the flood. Specifically:

• The review identified the concentration risk (a suitability and adequacy question).
• The review directed a multi-site strategy (a Clause 8.3 change, authorised under Clause 6.3).
• The review committed the resources (Clause 7.1).
• The review revised the exercise programme (Clause 8.5) to test the new strategy.
• The review tracked the corrective actions from the exercise to closure (Clause 10.1).
• The next review verified the effectiveness of the changes.

The flood was the real-world test. The BCMS passed, not because the plans were brilliant, but because the management review had driven the organisation to invest in the capabilities the plans required. This is what a mature Clause 9.3 looks like: a governance process that identifies the strategic risks, commits the resources to address them, and verifies the effectiveness of the investment, before the disruption tests it.

The contrast with Illustrative Scenario 1 is the contrast between a review that produced decisions (Illustrative Scenario 2) and a review that produced nothing (Illustrative Scenario 1). Same clause, same ISO 22301, same certification, opposite outcomes. The difference was leadership engagement, honest evidence, and the discipline of the closed loop. That is what Clause 9.3 is for.

Multi-Framework Mapping

Clause 9.3, the top-management review, is a universal management-system requirement. Every major governance, operational-resilience, and continuity framework has an equivalent clause. This section maps ISO 22301 Clause 9.3 to its counterparts in ISO 27001, SOC 2, NIST SP 800-34, NIST CSF 2.0, FFIEC BCM Booklet, DORA, APRA CPS 230, MAS TRM, RBI Master Direction, SEBI CSCRF, IRDAI Guidelines, and the Companies Act / SEBI LODR. The mappings use real clause, article, and paragraph numbers so the cross-reference is verifiable. This is the mapping a certification body or a regulator will use to assess whether your 9.3 process also satisfies your other obligations.

Mapping table

How to use the mapping

The mapping enables an integrated governance regime: a single management review, consuming a single evidence base, producing outputs that satisfy multiple obligations. For an Indian listed entity in a regulated sector (e.g., a listed bank), a single complete annual review, aligned with the RMC cycle, consuming the RBI/SEBI/IRDAI compliance evidence, and producing decisions that address all applicable frameworks, can satisfy ISO 22301 9.3, ISO 27001 9.3, DORA Art 6(5) (for EU-facing operations), the RBI board-oversight expectation, the SEBI RMC expectation, the IRDAI compliance expectation, and the Companies Act §134(3)(n) duty simultaneously. The cost saving (one review vs five) is significant; the quality improvement (integrated evidence vs siloed evidence) is larger.

The integration test

The certification body and the regulator will each test their own framework's requirements. The integration test is: does the single review demonstrably address each framework's requirements, with traceable evidence? The minutes should cross-reference each framework's input/output expectations. The action tracker should tag each action with the frameworks it satisfies. The board-committee reporting should reference the integrated review. If the integration is genuine, the organisation has one governance process serving multiple obligations; if the integration is superficial (each framework has its own review, separately), the organisation has the cost and inconsistency of multiple processes.

Implementation Roadmap

This section provides a phased implementation roadmap for Clause 9.3, tiered by the organisation's current maturity. The roadmap assumes the BCMS itself is established (Clauses 4–8) and the monitoring (9.1) and internal audit (9.2) are in place, 9.3 is the apex, and it depends on the foundation. If the foundation is weak, the roadmap begins by shoring up the foundation before building the review.

The maturity-curve approach

The roadmap is structured as a maturity curve: L1 (ad hoc) → L2 (defensible) → L3 (established) → L4 (mature) → L5 (advanced). Each level has a defined state, a typical timeline, an investment range (in INR), and the specific actions to advance. The organisation should assess its current level honestly (a self-assessment using §22) and pursue the next level, not the level three steps ahead. Attempting to leap from L1 to L4 typically produces a review that looks mature but is theatre.

Phase 1: From L1 to L2 (0–3 months), Establish a defensible review

Starting state (L1): The review either does not happen, or happens ad hoc as an agenda item in an operations meeting. No charter, no structured input pack, no decisions, no action tracking. The BCMS is operated but not strategically reviewed.

Target state (L2): A defensible single-cycle management review has been conducted. A charter exists. The input pack addresses the ISO 22301 input categories. Top management attended. The minutes record the three-part judgement and at least one decision. An action tracker exists.

Actions:

1. Draft the management review charter (use toolkit doc 01); have it approved by the CEO.
2. Define the input set (use the §7 Step 3 checklist); assign a source owner to each input.
3. Set the review date; calendar it; send the CEO's invitation.
4. Build the first input pack (assemble what exists; flag what is missing).
5. Conduct the review (use the §7 Step 4 agenda); have the CEO chair; minute the discussion, the three-part judgement, and the decisions.
6. Establish the action tracker (toolkit doc 10); log every decision.
7. Retain the minutes as a controlled document (Clause 7.5).

Resourcing: primarily BCM Manager time and external facilitation if needed; no technology investment required, office tools suffice. Timeline: 4–8 weeks.

Phase 2: From L2 to L3 (3–12 months), Build the year-round pipeline and the closed loop

Starting state (L2): A defensible review has been conducted once. The charter exists but may not be board-aligned. The input pack was assembled manually for the first review. The action tracker exists but may not be rigorously maintained.

Target state (L3): A year-round evidence pipeline is in place, with defined production cadences for each input. The review is federated (monthly operational + quarterly executive + annual complete). The action tracker is rigorously maintained, with escalation and effectiveness verification. The review is aligned with the board-committee cycle (for listed entities) and the regulatory compliance cycle.

Actions:

1. Define the year-round evidence pipeline (input by input, with owner, cadence, format).
2. Establish the monthly operational review (BCM team + activity owners).
3. Establish the quarterly executive review (COO + business-unit heads).
4. Align the annual complete review with the RMC / Audit Committee cycle.
5. Integrate the regulatory compliance evidence into the input pack (RBI returns, SEBI compliance, IRDAI compliance, DPDP breach logs, CERT-In reporting performance).
6. Tighten the action tracker: every action has an owner, a deadline, an escalation path, and an effectiveness-verification field.
7. Conduct the second complete review; this time, the pack should be the output of the pipeline, not a manually assembled document.

Resourcing: BCM Programme Office capacity, possibly 1 additional FTE; office-tool optimisation; possible light GRC tooling if the organisation is at the upper end of this band. Timeline: 6–12 months.

Phase 3: From L3 to L4 (12–24 months), Mature the review into a strategic governance process

Starting state (L3): The review is established and federated. The pipeline works. The closed loop works. But the review may still be operationally focused rather than strategically focused, it reviews whether the BCMS is working, not whether it is the right BCMS.

Target state (L4): The review is a strategic governance process. It produces demonstrable strategic decisions (scope changes, strategy revisions, major resource commitments). It integrates with ISO 27001 and the regulatory cycles. It uses a category-level GRC SaaS or BCM-specialist platform for the evidence pipeline and action tracking. The board committee actively engages with the review's outputs.

Actions:

1. Deepen the three-part judgement: each of suitability, adequacy, effectiveness is addressed explicitly, with reasoning, in every cycle.
2. Integrate with ISO 27001 9.3 (if the organisation is ISO 27001 certified), single review, dual scope.
3. Select and implement a category-level GRC SaaS or BCM-specialist platform (the evidence pipeline outgrows office tools at this level).
4. Establish the decision-rights matrix (which decisions the review body can make vs which require board ratification).
5. Begin benchmarking the BCMS maturity against sector peers (BCI Horizon Scan, DRI benchmarks, industry forums).
6. Tighten the regulatory integration: the review's outputs flow into the RBI/SEBI/IRDAI compliance returns, and the compliance returns flow into the review's inputs.

Resourcing: a GRC/BCM platform subscription; a BCM Programme Office of 1–2 FTE; board-committee reporting overhead; benchmarking and external facilitation. Timeline: 12–24 months.

Phase 4: From L4 to L5 (24–36 months), Integrate across the operational-resilience governance regime

Starting state (L4): The review is mature for the BCMS. But it may coexist with separate reviews for ISO 27001, for regulatory compliance, for enterprise risk, and for cyber, each with its own evidence base, its own cadence, and its own board reporting.

Target state (L5): The BCMS review is one node in a federated operational-resilience governance regime. A single evidence repository serves all the governance cycles. A unified action tracker serves all the governance bodies. The board committee receives an integrated operational-resilience report. The BCMS review's inputs and outputs are cross-referenced across frameworks.

Actions:

1. Consolidate the evidence repositories (BC + ISMS + regulatory compliance) into a single IRM-grade platform (an enterprise IRM suite).
2. Unify the action tracker across all governance domains.
3. Align the governance calendars (BC review, ISMS review, RMC, Audit Committee, regulatory returns) into a single annual governance calendar.
4. Develop an integrated board-committee report that synthesises the operational-resilience posture across all frameworks.
5. Begin advanced practices: predictive analytics on the evidence base; external benchmarking; participation in industry-wide exercises; contribution to regulatory consultations.

Resourcing: an enterprise IRM suite; a standing BCM Programme Office of 2–5 FTE; integrated governance overhead. Timeline: 24–36 months. This level is appropriate for large, regulated, or systemically important organisations; a growing company may rationally choose to remain at L4.

The 30/90/180-day quick-start plan

For an organisation starting from L1, the following 30/90/180-day plan establishes a defensible L2 review quickly:

Days 0–30 (establish):

• Draft the charter (toolkit doc 01).
• Define the input set and assign source owners.
• Set the review date (target: day 60–75).
• Issue the CEO's calendar invitation.

Days 31–90 (prepare and conduct):

• Collect inputs from source owners (days 31–60).
• Consolidate the input pack; flag gaps; brief the CEO (days 60–70).
• Conduct the first review (day 75).
• Issue the minutes (day 80).
• Establish the action tracker (day 90).

Days 91–180 (build the pipeline):

• Define the year-round evidence pipeline (cadences, owners, formats).
• Begin the monthly operational review cadence.
• Plan the next complete review (target: month 12).
• Begin aligning the review with the regulatory compliance cycle.

This plan produces a defensible L2 review in approximately 90 days and positions the organisation for L3 within the first year.

FAQ

Q1. Our CEO says they "review the BCMS informally all the time." Does that satisfy Clause 9.3?

No. The clause requires a planned, scheduled, minuted review at defined intervals, with a structured input set and structured outputs. An informal ongoing awareness is valuable, but it is not a substitute for the formal review. The certification body will look for the minutes, the input pack, and the decisions, not for a claim of informal awareness. The informal awareness supports the formal review (the CEO is better prepared), but it does not replace it.

Q2. Can we combine the ISO 22301 management review with the ISO 27001 management review?

Yes, and for most organisations holding both certifications, this is the recommended approach. The two clauses (ISO 22301 9.3 and ISO 27001 9.3) have the same structure, the same three-part test, and substantially overlapping inputs and outputs. A single complete review, with a combined input pack covering both BCMS and ISMS, and combined outputs addressing both, satisfies both clauses, provided the scope, the inputs, and the outputs demonstrably cover both management systems. The certification bodies (one for each, or the same body if dual-certified) will each test their own clause's requirements against the combined review.

Q3. How often must the management review happen? Is annual the minimum?

The clause says "at planned intervals", it does not specify a number. However, ISO 22313:2020 (the companion guidance) and certifier practice treat at least annually as the minimum defensible cadence. For regulated entities (RBI-regulated, SEBI-regulated, IRDAI-regulated), the regulatory cadence is typically more frequent, the SEBI LODR RMC meets at least twice a year, and the BCMS review should align. For fast-changing organisations (rapid growth, frequent M&A, technology shifts), a semi-annual or quarterly complete review may be appropriate. The certification body's test is whether the cadence is planned, documented, and adhered to, not whether it exceeds any specific threshold.

Q4. What if we had no disruptions during the period? Is that a problem?

It is not a problem, but it is a limitation to acknowledge. The input pack should note that no significant disruptions occurred during the period and acknowledge that the absence of real-world evidence is a limitation on the effectiveness judgement. The review should then rely more heavily on the exercise results (the controlled-discovery mechanism) and the near-miss reports. A pattern of "no disruptions, no exercises, no near-misses" across multiple cycles is a red flag, it usually means incidents are not being reported, not that they are not happening.

Q5. Our internal audit (9.2) found no nonconformities. Does that mean our BCMS is perfect?

It may mean that, or it may mean the audit was shallow, the auditors were not independent, or the scope was narrow. A defensible audit will report a mix of conformities (the things that work), opportunities for improvement (things that work but could be better), and nonconformities (things that fail). A finding set with no nonconformities across multiple cycles is itself a red flag, either the BCMS is exceptionally mature (and the audit should be deepening its scope to find the harder issues) or the audit is not looking hard enough. The management review should question an all-green audit as rigorously as it questions an all-green exercise.

Q6. Must the board conduct the review, or can the CEO conduct it?

The clause requires top management, which is the person or group that directs and controls the organisation at the highest level. For most companies, that is the CEO and the executive committee (not necessarily the board). However, for regulated entities, the Indian regulatory architecture (Companies Act §134(3)(n), §177; SEBI LODR Reg. 21; RBI Master Direction) makes the board (or its delegated committee) the accountable body for continuity risk. In practice, the BCMS management review is conducted by the CEO/executive committee and reported to the board committee (RMC, Audit Committee) for ratification and oversight. The board committee's engagement is the test of whether the review is strategically connected to governance.

Q7. Our action tracker shows several overdue actions from the last review. How do we handle this in the next review?

Report them honestly. The action-status report is the first agenda item (per §7 Step 4). For each overdue action, the owner explains the reason for slippage and proposes a recovery plan (a revised deadline, additional resources, or a scope reduction). The review body decides whether to accept the recovery plan or to escalate. A pattern of overdue actions across multiple cycles is a finding, it signals that the review's authority is not respected, that the decisions were unrealistic, or that the organisation's execution capacity is insufficient. The review must address the root cause, not just the symptoms.

Q8. Do we need to retain the review minutes for a specific period?

The clause does not specify a retention period, it requires the review results to be retained as documented information under Clause 7.5. The retention period should align with the longest applicable regulatory look-back. For Indian regulated entities: RBI supervisory cycles are typically five years; SEBI inspection windows are similar; the Companies Act and SEBI LODR effectively require listed entities to retain board-level records for the foreseeable regulatory horizon. A defensible default is five years (the typical supervisory cycle), with longer retention for regulated entities. The retention period is documented in the document-control procedure.

Q9. Can we use a template from another organisation or from the internet for our review?

You can use a template as a starting point, but the review must be your review, tailored to your organisation's context, scope, risk environment, and regulatory obligations. A generic template that does not address your specific prioritised activities, your specific regulatory regime, or your specific risk landscape is not a defensible review. The toolkit templates (docs 01–17) are designed to be customised, they provide the structure, you provide the content.

Q10. What is the single most common Clause 9.3 finding?

The single most common finding is "management review conducted without genuine top-management engagement", manifested as a review attended only by the BCM team, a review with no decisions, a review with an all-green dashboard and no negative evidence, or a review whose minutes record "all noted, continue as is." The treatment is always the same: the chair must be a named top-management executive, the review must produce specific decisions with owners and resources, and the input pack must include honest negative evidence. If your review produces no decisions and no challenges, it is the most common finding waiting to happen.

Industry-Specific Requirements

Clause 9.3 is universally applicable, but its industry flavour varies significantly. The inputs, the cadence, the board-committee integration, and the regulatory reporting differ by sector. This section addresses the five sectors most relevant to Indian growing companies.

BFSI (banks, NBFCs, insurers, payment system operators)

The regulatory overlay. BFSI is the most heavily regulated sector for BCMS management review in India. The applicable instruments: RBI Master Direction on IT Governance (7 Nov 2023) for banks/NBFCs; RBI Cyber Security Framework (2 Jun 2016); SEBI CSCRF (20 Aug 2024) for SEBI-regulated entities; SEBI BCP/DR for MIIs (22 Mar 2021) for market infrastructure; IRDAI Information and Cyber Security Guidelines 2023 for insurers; and, for payment system operators, RBI's cyber-resilience and digital-payment-security expectations. All require board-approved BCP/DR policy with periodic board review.

The review body. For BFSI, the review body is the board (or its IT/Risk committee), not merely the executive committee. The RBI's supervisory expectations and the SEBI/IRDAI frameworks make the board the accountable body. The BCMS management review should be aligned with the board committee's cycle and should produce decisions that are ratifiable by the board.

The cadence. At least semi-annual for the complete review (aligned with the board committee cycle); quarterly or monthly for the operational sub-reviews. The SEBI LODR RMC (for listed entities) meets at least twice a year; the BCMS review should feed into it.

The sector-specific inputs. In addition to the standard ISO 22301 input set, the BFSI review should consume: RBI inspection findings and supervisory letters; SEBI inspection findings (for MIIs and SEBI-regulated entities); IRDAI compliance certificate and inspection findings (for insurers); CERT-In incident-reporting performance (6-hour clock); DPDP breach-notification performance; the UPI/payment-rail performance data (for payment system operators); and the interbank/ecosystem exercise results (e.g., the RBI-orchestrated cyber drills).

The HDFC lesson. The HDFC Bank case (§14) is the canonical BFSI lesson: repeated digital outages treated by the regulator as a board-level governance failure, with a regulatory ban on new digital products as the consequence. The lesson for the management review is that the regulator views continuity as a board accountability, and the review is the process by which the board discharges it.

Healthcare (hospitals, pharma, medical devices)

The regulatory overlay. Healthcare continuity is regulated by a patchwork in India: the Clinical Establishments Act; the NDMA guidelines (for hospital disaster plans); the DPDP Act (for patient-data availability); the Drug and Cosmetics Act (for pharma GMP continuity); and, for accredited hospitals, NABH standards (which include disaster-management and continuity requirements). For pharma, the USFDA/EUDRALEX inspection regime (for export-focused firms) effectively requires continuity for GMP operations.

The review body. For a hospital, the review should be conducted by the medical superintendent / chief medical officer and the hospital's executive committee, with the board (or the hospital's governing council) receiving the outputs. For a pharma manufacturer, the review should be conducted by the head of operations and the quality head, with the executive committee and the board's audit committee receiving the outputs.

The sector-specific inputs. In addition to the standard inputs, the healthcare review should consume: patient-safety incident reports (including continuity near-misses, e.g., the EMR was down and clinical staff reverted to paper); clinical-system availability metrics (EMR, PACS, LIS); GMP-continuity metrics (for pharma, production stoppage events, deviation reports); the hospital disaster-plan exercise results (mass-casualty drills, evacuation drills); and the medical-device cybersecurity posture (for device manufacturers).

The AIIMS lesson. The AIIMS Delhi ransomware (November 2022) is the canonical healthcare continuity failure: the e-Hospital system encrypted, primary and secondary database servers encrypted, OPD/admissions/billing/labs reverted to paper for approximately two weeks, and a Delhi Police cyber-terrorism case. The lesson for the management review is that clinical continuity is a patient-safety issue, the review must address the tested clinical failover (not just the IT DR), and the absence of offline immutable backups is a review finding, not merely an IT task.

IT/ITeS and SaaS

The regulatory overlay. IT-services and SaaS firms face customer-contractual continuity obligations (often more stringent than regulatory obligations), DPDP obligations (as Data Processors for customer data and Data Fiduciaries for their own), and, for firms serving EU financial-services customers, DORA (which requires the ICT third-party provider to support the financial entity's BCP/DR). For firms serving the Indian government, the MeitY cloud-empanelment BCP/DR requirements apply.

The review body. The review is typically conducted by the CEO/COO and the executive committee, with the customer-facing leadership (for IT-services) or the product/technology leadership (for SaaS) as key contributors. The board's audit committee or RMC receives the outputs.

The sector-specific inputs. In addition to the standard inputs, the IT/ITeS review should consume: customer SLA performance (availability against contractual commitments); customer audit findings (each major customer audits the firm's BCMS); the multi-tenant cloud availability posture (for SaaS); the supply-chain security posture (the SolarWinds lesson, vendor-administered tooling); the DORA conformity posture (for EU-facing firms); and the workforce-continuity posture (key-person risk, the Akasa Air pilot-exodus lesson applied to engineering talent).

The Wipro lesson. The Wipro phishing breach (2019), where attackers compromised employee accounts and pivoted through Wipro to target its outsourcing customers, is the canonical lesson that for IT-services firms, the customer's BC plan depends on the vendor's identity security. The management review must address the supplier-continuity posture from the customer's perspective: what would happen to the customer's operations if the firm's services were disrupted?

Manufacturing (automotive, chemicals, electronics)

The regulatory overlay. Manufacturing continuity is regulated by the OSH Code 2020; the NDMA guidelines (Chemical Disaster Guidelines 2007, for hazardous industry); the Environmental Impact Assessment requirements; and, for export-focused firms, the customer's supply-chain continuity requirements (especially automotive Tier-1s, where the Just-In-Time supply chain imposes near-zero tolerance for disruption). For chemical/hazardous industry, the NDMA on-site and off-site emergency plans are statutory.

The review body. The review is typically conducted by the head of operations/manufacturing and the plant directors, with the executive committee receiving the outputs. For hazardous industry, the on-site emergency plan review (statutory under NDMA) should be integrated with the BCMS management review.

The sector-specific inputs. In addition to the standard inputs, the manufacturing review should consume: production-continuity metrics (lines down, units lost, recovery time); supply-chain continuity metrics (single-source dependencies, supplier incidents, the Go First/Pratt & Whitney lesson); industrial-safety metrics (the LG Polymers and Maruti Manesar lessons); OT/IT segmentation metrics (for connected manufacturing, the ransomware-on-OT risk); and the environmental-incident near-misses (for hazardous industry).

The LG Polymers lesson. The LG Polymers styrene gas leak (May 2020, Visakhapatnam), with 12–13 fatalities, thousands exposed, a ₹50 crore NGT interim penalty, is the canonical lesson that for hazardous industry, continuity is a safety issue, not merely an operational issue. The management review must address the on-site emergency plan's currency, the off-site coordination with district authorities, and the safety-critical maintenance backlog.

Government and public sector

The regulatory overlay. Government continuity is governed by the Disaster Management Act 2005; the NDMA guidelines (the DMP template for ministries/departments); the CERT-In Directions (for all government ICT); and the MeitY cybersecurity and cloud requirements. For critical-infrastructure operators (power, telecom, transport, financial-market infrastructure), the IT Act §70A (NCIIPC) obligations apply.

The review body. For a government department, the review is conducted by the department's secretary (or the head of the department) and the senior leadership, with the ministry receiving the outputs. For a PSU or government company, the review is conducted by the CEO/MD and the board, with the administrative ministry receiving the outputs.

The sector-specific inputs. In addition to the standard inputs, the government review should consume: the DMP review cycle (the NDMA DMP template provides the structure); the critical-infrastructure dependency analysis (power, telecom, the Mumbai 2020 blackout lesson); the CERT-In compliance posture (the 6-hour clock, the 180-day logs); and the e-governance continuity posture (the digital-service dependencies).

The Mumbai blackout lesson. The Mumbai power-grid blackout (October 2020), with the cyber-link attribution contested between Maharashtra (citing "cyber sabotage") and the Union Power Ministry (citing "human error"), is the canonical lesson that for infrastructure-dependent industries, continuity must account for both physical (grid power) and cyber (grid-cyber) risks. The management review must address the upstream infrastructure dependencies, not merely the organisation's own BCMS.

Maturity Model

This section provides the detailed maturity model for Clause 9.3, with five levels. The model is the self-assessment tool, read each level's description honestly, identify the level that best describes your current state, and pursue the next level. Maturity advancement is cumulative: each level builds on the previous one; you cannot skip levels without producing theatre.

Level 1: Ad hoc / Absent

Description. The management review either does not happen, or happens ad hoc as an agenda item in an operations meeting. No charter. No structured input pack. No decisions. No action tracking. The BCMS is operated by specialists but is not strategically reviewed by top management.

Typical indicators. No minutes (or minutes that are a one-line "BCP discussed"); the BCM Manager has never presented to the CEO; the board has never received a BCMS report; the BIA is years old and has never been reviewed; exercises happen but their findings are not escalated.

Typical cost. None, because the review is not conducted. The hidden cost is the unmanaged risk of a BCMS that has atrophied without anyone noticing.

The single step to L2. Draft a charter; set a date; build the first input pack; conduct the first review with the CEO in the chair.

Level 2: Defensible (single cycle)

Description. A defensible management review has been conducted at least once. A charter exists, approved by top management. The input pack addresses the ISO 22301 input categories (though some may be thin). Top management attended. The minutes record the three-part judgement and at least one decision. An action tracker exists (though it may be a simple spreadsheet).

Typical indicators. One or two cycles of minutes on file; the CEO or COO chaired; the input pack covers the standard categories; at least one decision per cycle has an owner and a deadline; the action tracker is maintained between cycles (though possibly only in the weeks before the next review).

Typical resourcing. BCM Manager time; possible external facilitation for the first cycle; office tools.

The single step to L3. Build the year-round evidence pipeline; establish the federated review cadence; tighten the action tracker with escalation and effectiveness verification.

Level 3: Established (federated, with a pipeline)

Description. A year-round evidence pipeline is in place, with defined production cadences for each input. The review is federated (monthly operational + quarterly executive + annual complete). The action tracker is rigorously maintained, with escalation and effectiveness verification. The review is aligned with the regulatory compliance cycle and the board-committee cycle.

Typical indicators. Monthly operational reviews on the calendar; quarterly executive reviews on the calendar; the annual complete review on the board's calendar; the input pack is the output of the pipeline, not a manually assembled document; the regulatory compliance evidence is integrated into the pack; the action tracker is maintained continuously, not just before reviews; overdue actions are escalated.

Typical resourcing. BCM Programme Office capacity of approximately 1 FTE; office-tool optimisation; possible light GRC tooling at the upper end of this band.

The single step to L4. Deepen the three-part judgement; integrate with ISO 27001 and the regulatory cycles; select and implement a category-level GRC SaaS or BCM-specialist platform; establish the decision-rights matrix.

Level 4: Mature (strategic governance)

Description. The review is a strategic governance process. It produces demonstrable strategic decisions, scope changes, strategy revisions, major resource commitments, not just operational adjustments. It integrates with ISO 27001 9.3 (single review, dual scope) and with the regulatory compliance cycle. It uses a category-level GRC SaaS or BCM-specialist platform for the evidence pipeline and action tracking. The board committee actively engages with the review's outputs.

Typical indicators. Strategic decisions in the minutes (not just operational); the review's decisions demonstrably change the BCMS scope/strategy/resources; the GRC/BCM platform aggregates evidence across frameworks; the board-committee papers reference the review's outputs; benchmarking against sector peers; predictive trends in the dashboard.

Typical resourcing. A GRC/BCM platform subscription; a BCM Programme Office of 1–2 FTE; board-committee reporting; external facilitation; benchmarking.

The single step to L5. Integrate across the operational-resilience governance regime (BC + ISMS + regulatory); consolidate the evidence repositories; unify the action tracker; align the governance calendars.

Level 5: Advanced (integrated operational-resilience governance)

Description. The BCMS review is one node in a federated operational-resilience governance regime. A single evidence repository serves all the governance cycles. A unified action tracker serves all the governance bodies. The board committee receives an integrated operational-resilience report. The review's inputs and outputs are cross-referenced across frameworks. The organisation contributes to industry-wide exercises and regulatory consultations.

Typical indicators. A single enterprise IRM platform serves BC, ISMS, regulatory compliance, enterprise risk, and cyber; a unified governance calendar aligns all the review bodies; an integrated board-committee report synthesises the operational-resilience posture; the organisation participates in industry-wide exercises (e.g., RBI-orchestrated cyber drills, sector TLPT exercises); the organisation benchmarks its maturity externally and contributes to standards development.

Typical resourcing. An enterprise IRM suite; a standing BCM Programme Office of 2–5 FTE; integrated governance overhead; industry participation.

Who should target L5. Large, regulated, or systemically important organisations, banks, insurers, MIIs, large IT-services firms, critical-infrastructure operators. A growing company may rationally choose to remain at L4; L5 is an investment that pays off at scale and in regulated environments.

The maturity self-assessment

Score the organisation on each of the following dimensions, from 1 (L1) to 5 (L5):

1. Charter and cadence. Is there a charter, and is the review conducted at planned intervals?
2. Top-management engagement. Does top management attend, chair, and decide?
3. Input completeness. Does the pack address every ISO 22301 input category?
4. Input honesty. Does the pack include negative evidence?
5. Three-part judgement. Are suitability, adequacy, and effectiveness each addressed explicitly with reasoning?
6. Decision quality. Are decisions specific, owned, dated, and resourced?
7. Action tracking. Is the closed loop maintained, with escalation and effectiveness verification?
8. Federation. Is the review federated across the governance calendar?
9. Board-committee integration. Does the review flow into the board committee (RMC, Audit Committee)?
10. Regulatory integration. Does the review consume and produce regulatory compliance evidence?
11. Tooling. Is the evidence pipeline supported by appropriate tooling (office tools at L2, GRC SaaS at L4, enterprise IRM at L5)?
12. Multi-framework integration. Does the review serve ISO 27001, RBI/SEBI/IRDAI, and DPDP simultaneously?

The average score is the approximate maturity level. The lowest-scoring dimensions are the priority improvement areas. Pursue the next level overall, not the level three steps ahead.

Emerging Trends

The management review is evolving, driven by technology, regulation, and the changing risk landscape. This section identifies the trends that are reshaping Clause 9.3 practice over the next three to five years.

Climate change (Amendment 1:2024)

ISO 22301:2019 Amendment 1:2024 added climate change to Clauses 4.1 and 4.2 (4.1: determine whether climate change is a relevant issue; 4.2: interested parties can have climate-related requirements), so climate-related changes in context belong in the management review inputs (9.3). Indian organisations are increasingly exposed to climate-driven disruptions: the Chennai floods (2015), the Kerala floods (2018), Cyclone Fani (2019), Cyclone Amphan (2020), Cyclone Michaung (2023), and the accelerating frequency of extreme-weather events. The management review must assess whether the BCMS accounts for climate as a context issue (4.1) and as a stakeholder expectation (4.2), and direct BIA and strategy updates where the climate exposure has changed. This is a new input category for the review, and most Indian organisations have not yet integrated it.

Operational resilience as the successor discipline

Operational resilience, the ability of an organisation to deliver its critical operations through disruption, is converging from BC, DR, third-party risk, cyber, and operational risk into a single integrated discipline. The regulators (DORA, APRA CPS 230, the UK PRA/FCA, the US FFIEC) are driving this convergence. The management review is the natural integration point: a single review that consumes the BC + ISMS + regulatory + supplier + cyber evidence and produces integrated operational-resilience decisions. This trend is pushing mature organisations toward L5 (the integrated governance regime) faster than the maturity curve would otherwise suggest.

AI-assisted governance

AI is beginning to assist the management review, not to replace the judgement of top management, but to support the evidence synthesis. Category-level GRC platforms are introducing AI-assisted features: anomaly detection in metric trends, natural-language querying of the evidence base, draft-pack generation from the federated evidence, minute-taking with action extraction, and predictive analytics on corrective-action closure. The benefit is consistency and depth (the AI surfaces anomalies a human reviewer would miss); the risk is over-reliance (the AI's synthesis must be verified, not accepted). Over the next 3–5 years, AI-assisted governance will move from emerging to standard practice, particularly for large organisations with substantial evidence bases.

Regulatory convergence on the BIA triple

The BIA triple, Maximum Tolerable Period of Disruption (MTPD, also called Maximum Acceptable Outage), Recovery Point Objective (RPO), and Minimum Business Continuity Objective (MBCO), is converging across regulators. APRA CPS 230 para 37 restates it as "maximum disruption period / maximum data loss / minimum service levels." DORA Articles 11(5) and 12(6) mandate the BIA and the per-function RTO/RPO. The RBI Master Direction requires documented RTO/RPO for critical systems. The management review must address the BIA triple as the foundation of adequacy, and must assess whether the organisation's MTPD/RPO/MBCO are still right given the current risk environment. This regulatory convergence makes the BIA-refresh decision one of the most consequential outputs of the review.

Ecosystem and supply-chain continuity

The management review is expanding its scope from the organisation's own BCMS to the continuity of the ecosystem on which it depends. The CDK Global ransomware (2024), an industry SaaS backbone going down for two weeks, is the canonical lesson that an industry standardising on one SaaS is a systemic concentration risk. The management review must address the ecosystem-level continuity posture: the cloud provider's region architecture, the SaaS vendor's BCP terms, the payment-rail's resilience (the UPI outage lesson), the telecom backbone, and the power grid. The review is the governance checkpoint where ecosystem dependencies are surfaced and directed to risk treatment.

Board-level operational-resilience oversight

The Indian regulatory architecture is converging on the principle that operational resilience (and its BCMS component) is a board-level oversight duty, not delegable to management alone. The Companies Act §134(3)(n), SEBI LODR Reg. 21, the RBI Master Direction, and the IRDAI Guidelines all make the board the accountable body. This trend is pushing the BCMS management review up the governance chain, from the BCM team (L1) to the executive committee (L2–L3) to the board committee (L4–L5). Over the next 3–5 years, the board's engagement with the BCMS review will deepen, and the review's outputs will become more visible in board reporting and in the board's risk disclosures.

The DPDP effect

The DPDP Act 2023 (and the DPDP Rules 2025) makes loss of availability a reportable breach and requires safeguards against it (§8(5)) and creates a breach-notification duty (§8(6)) with penalties up to ₹250 crore. This is changing the management review: the review must now consume DPDP compliance performance (breach-notification timeliness, data-availability incidents, Significant Data Fiduciary audit findings) as a mandatory input, and must direct corrective action where the DPDP posture is deficient. For Significant Data Fiduciaries, the Data Audit obligation (under the DPDP Rules 2025) is effectively a sector-specific management review of the data-continuity posture. The DPDP effect will deepen over the next 3–5 years as enforcement matures and as the Data Protection Board begins to act.

References and Further Reading

This section lists the primary sources referenced in this guide, organised by category. All sources are Tier 1 (authoritative, standards, regulators, filings) or Tier 2 (strong secondary, practitioner bodies, deep references).

Standards and companion guidance

• ISO 22301:2019 Security and resilience, Business continuity management systems, Requirements (second edition) + Amendment 1:2024 (Climate action changes, Clauses 4.1 and 4.2). ISO/TC 292.
• ISO 22313:2020 Security and resilience, Business continuity management systems, Guidance on the use of ISO 22301. ISO/TC 292. (Companion guidance; the clause-by-clause how-to.)
• ISO 22300:2021 Security and resilience, Vocabulary (third edition; current). [Note: the 2018 edition is withdrawn.]
• ISO/TS 22317:2021 Security and resilience, Business continuity management systems, Guidelines for business impact analysis (second edition; current). [Note: the 2015 edition is withdrawn.]
• ISO/TS 22318:2021 Security and resilience, Business continuity management systems, Guidelines for supply chain continuity management (second edition; current).
• ISO/TS 22330 Security and resilience, Business continuity management systems, Guidelines for people aspects of business continuity.
• ISO/TS 22331:2018 Security and resilience, Business continuity management systems, Guidelines for business continuity strategy.
• ISO 22316:2017 Security and resilience, Organizational resilience, Principles and attributes.
• ISO/IEC 27001:2022 Information security management systems, Requirements (Clause 9.3 management review; A.5.29 ICT readiness for security; A.5.30 ICT readiness for continuity).
• ISO/IEC 17021-1:2015 + IAF Mandatory Documents (the rule-set governing all ISO 22301 audits).

Indian regulations and regulators

• Companies Act 2013, Section 134(3)(n) (board's report on risk-management policy) and Section 177 (Audit Committee, including §177(4)(vii) on internal financial controls and risk management). Ministry of Corporate Affairs, mca.gov.in.
• SEBI Listing Obligations and Disclosure Requirements (LODR) Regulations, 2015, Regulation 21 (Risk Management Committee). Securities and Exchange Board of India, sebi.gov.in.
• RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/DOR/STR/REC/43/04.10.001/2023-24, issued 7 November 2023, effective 1 April 2024). Reserve Bank of India, rbi.org.in.
• RBI Cyber Security Framework in Banks (DBS.CO/CSITE/BC.11/33.01.001/2015-16, 2 June 2016). Reserve Bank of India.
• RBI Master Directions on Outsourcing of Information Technology Services (10 April 2023). Reserve Bank of India.
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024). Securities and Exchange Board of India.
• SEBI Guidelines for Business Continuity Plan and Disaster Recovery of Market Infrastructure Institutions (SEBI/HO/MRD1/DTCS/CIR/P/2021/33, 22 March 2021). Securities and Exchange Board of India.
• IRDAI Information and Cyber Security Guidelines, 2023 (24 April 2023). Insurance Regulatory and Development Authority of India, irdai.gov.in.
• CERT-In Directions under Section 70B(6) of the IT Act, 2000 (No. 20(3)/2022-CERT-In, 28 April 2022). Indian Computer Emergency Response Team, cert-in.org.in.
• Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, enacted 11 August 2023) + Digital Personal Data Protection Rules, 2025. Ministry of Electronics and Information Technology, meity.gov.in.
• Disaster Management Act, 2005 (Act No. 53 of 2005) + NDMA Guidelines (Chemical Disasters 2007; DMP template for Ministries/Departments). National Disaster Management Authority, ndma.gov.in.
• Information Technology Act, 2000 (including §43, §65, §66, §70, §70A, §70B, §72, §84A).

Global frameworks (mapped in §16)

• NIST Special Publication 800-34 Rev 1 Contingency Planning Guide for Federal Information Systems (May 2010, updated November 2010). National Institute of Standards and Technology.
• NIST Cybersecurity Framework 2.0 (NIST.CSWP.29, 26 February 2024), Govern function (GV.OC, GV.RM, GV.RR).
• FFIEC IT Examination Handbook, Business Continuity Management Booklet (November 2019, OCC 2019-57 / FRB SR 19-13 / FDIC FIL-71-2019). Federal Financial Institutions Examination Council.
• Regulation (EU) 2022/2554 Digital Operational Resilience Act (DORA) (14 December 2022; applies from 17 January 2025), Article 5(2), 6(5), 6(6), 11(5), 12(6), 19, 25, 26, 30, 35(8). European Parliament and Council.
• APRA Prudential Standard CPS 230 Operational Risk Management (effective 1 July 2025), paragraphs 15, 19–22, 25–26, 32, 34–37, 39–42, 44–45. Australian Prudential Regulation Authority.
• MAS Technology Risk Management Guidelines (18 January 2021), Sections 8 and 11. Monetary Authority of Singapore.
• HKMA Supervisory Policy Manual TM-G-2 (Business Continuity Planning) and OR-2 (Operational Resilience).

Practitioner bodies and data reports

• Business Continuity Institute (BCI) BCI practitioner guidance (Edition 7.0, launched 31 October 2023).
• DRI International DRI professional-practice framework (living framework, drii.org/resources/professionalpractices).
• BCI Horizon Scan 2025 ("Complex and Interconnected Risk") and BCI Horizon Scan 2024, the most-citable BCM industry datasets, published by the BCI.

Incident anchors referenced

• HDFC Bank repeated digital outages and RBI action (2018–2020; RBI order 2 December 2020). Sources: finextra.com; livemint.com; RBI public statements.
• Cognizant Chennai floods response (December 2015). Sources: Cognizant official statements; press coverage.
• AIIMS Delhi ransomware (23 November 2022). Sources: thehindu.com; the government's reply in Parliament (December 2022).
• LG Polymers styrene gas leak, Visakhapatnam (7 May 2020; NGT interim penalty ₹50 crore). Sources: NGT Joint Monitoring Committee report; thehindu.com.
• Wipro phishing breach (reported April 2019). Sources: krebsonsecurity.com.
• Mumbai power-grid blackout (12 October 2020; cyber link contested). Sources: WRPC report; Recorded Future; press coverage of Maharashtra vs Union Power Ministry positions.
• CrowdStrike/Windows global outage and IndiGo cancellations (19 July 2024). Sources: thehindu.com.

This guide is part of Singahi's clause-by-clause ISO 22301:2019 series for growing companies. ISO 22301:2019's clause text is copyrighted and is not reproduced; the requirement is paraphrased throughout. It is general guidance, not legal or certification advice.