Management review should determine whether the BCMS remains suitable, adequate and effective and what needs to change. It is not simply a presentation of document-completion percentages. Leadership needs evidence of continuity exposure, capability, performance, material change and actions requiring decision.
What this means in practice
A useful review combines management-system inputs with an operational view of important services. Show the required recovery target, minimum service, latest demonstrated capability, evidence date and material gap. That makes resource and risk decisions clearer than reporting only whether a plan was reviewed this year.
Decision and evidence map
| Area | Practical question | Evidence |
|---|---|---|
| Context/change | What changed in organization, obligations, sites, technology or suppliers? | Change and context review |
| Objectives/performance | Are BCMS objectives and important capabilities being achieved? | KPI trends and exceptions |
| Audit/nonconformity | Where is the management system weak or recurring? | Audit findings and effectiveness status |
| Exercises/incidents | What did real or simulated disruption prove? | Recovery timings, decisions and lessons |
| Capability gap | Which services cannot currently meet recovery requirements? | Requirement-versus-capability register |
| Resources/improvement | What must leadership fund, prioritize, accept or change? | Decisions, owners and due dates |
Practical implementation checklist
- Prepare only metrics and evidence that support decisions.
- Highlight significant changes since the previous review.
- Show overdue high-risk actions and repeat findings separately.
- Compare business recovery requirements with demonstrated technology/supplier capability.
- Record resource decisions, changes, risk acceptances and improvement actions.
- Assign owners and dates to outputs rather than recording discussion only.
- Trigger additional review after material incidents or transformation when needed.
Worked example
A dashboard shows 100% current plans but also shows that three critical services have four-hour RTOs while their latest end-to-end recovery tests took six to nine hours. A useful management review prioritizes those capability gaps, assigns funding/owners and records any interim risk acceptance instead of declaring the program green based on plan currency.
Common mistakes
- Treating management review as a slide presentation with no decisions.
- Reporting activity completion without capability evidence.
- Hiding failed or expired recovery tests behind green plan status.
- Recording accepted risks without an accountable authority or review date.
- Waiting for an annual meeting despite a major incident or transformation.
Governance, review and improvement
The organization chooses an appropriate planned frequency, but significant change and emerging exposure should not wait for the calendar. Retain review inputs, decisions and actions so there is evidence that leadership actively directs improvement and resource allocation.
Authoritative references
BCM.Center paraphrases standards and guidance; use the official publication for authoritative wording and current status.
- ISO 22301:2019 — BCMS requirements
- ISO 22301:2019/Amd 1:2024 — Climate action changes
- ISO 22313:2020 — Guidance on use of ISO 22301
- ISO/CD 22301 — Edition 3 under development
Frequently asked questions
Who should attend management review?
Leadership responsible for the BCMS scope, supported by BCM and relevant business/support owners who can provide evidence and make decisions.
Is an annual meeting enough?
It can form part of the process, but material change and continuity exposure may require earlier review.
What should the output include?
Decisions and actions about suitability/effectiveness, improvements, resources, changes and material continuity risk.
Can an existing risk committee perform it?
Potentially, if the forum covers the required BCMS purpose and evidence and records relevant decisions.
Which metrics are strongest?
Important-service coverage, requirement-versus-demonstrated capability, exercise results, supplier/DR gaps and corrective-action trends.