This summer, 2026, we’ve seen many disastrous wildfires around the world, including in the UK and Europe where we have not previously been familiar with managing such events.
The heat may have also caused other resource intensive incidents including several train derailments and increased health emergencies.
Although these are civil emergencies, there is a lot we can learn from ISO 22301, the standard for business continuity management.
Business Impact Analysis
The first thing that came to my mind was clause 8.2 Business impact analysis and risk assessment. When building a BCMS I find this drives the whole programme, because it requires the organisation to take a structured approach to identifying the impacts and risks on its operations.
Therefore, firstly, you must understand why the organisation exists: its objectives, and then which activities directly contribute to delivering on those objectives then, later, which activities indirectly contribute.
Through this deep understanding the organisation can identify the risks that disrupt those activities and the impact if these were to occur.
You might be surprised which disrupted activities have the most impact and where you could tolerate disruption for longer. The exercise helps to decide on strategies, solutions and prioritise resources.
When to Trigger a Business Continuity Response
Clause 8.4 of the standard sets out the “Response Structure” which includes reference to “defined thresholds that justify initiation of a formal response”, which should be contained within business continuity plans.
I find that this can be one of the most difficult things to document and commit to for two reasons:
- You can’t plan for every eventuality, meaning you need some flexibility to activate the plan,
- As a disruption escalates, and the business starts to feel the pain, competing priorities can influence decisions.
There are several ways to define a threshold including the period of time an activity is disrupted, the extent to which a service is degraded or third-party requirements such as the need for regulatory filings.
All of these things require clear roles and responsibilities to be assigned to those within the authority to “activate an appropriate business continuity response”
Detecting a Disruption
To activate an effective response, there needs to be methods for detecting when a disruption occurs and procedures for warning and communicating to relevant interested parties.
Some interested parties can be instrumental in alerting the organisation to an issue, for example the met office, the media or the government warning system.
While other interested parties play a key role in the activation of the plan and implementation of business continuity procedures.
Clause 8.4.3 of the standard addresses warning and communication in more detail.
Conclusion
While it can be difficult to plan for every eventuality, the lack of planning inevitably leads to a more severe disruption and longer recovery.
The recent wild fires around the world demonstrate how fast moving and unpredictable events can test business continuity and governmental procedures, with plans needing to be adapted during the incident.
In the case of the UK government, taking advice from the emergency services (an interested party) and using the national emergency system to issue advice.
Assent’s ISO 22301 Consultants can help you implement a management system, achieve certification or work solely on your business continuity plan, embedding international best practises. Contact us to get started!
Is Climate Change a Relevant Issue to your Management System?
In 2024 ISO published two changes to the harmonised structure for management systems, both in clause 4, context of the organisation.
- “The organisation shall determine whether climate change is a relevant issue.”
- “NOTE: Relevant interested parties can have requirements related to climate change.”
These changes apply to ISO 22301 and other management systems. Recent event may lead us to reconsider our response to this requirement.
Read more: Incorporating Climate Change within the Context of your Management System
