Where nonconformities and improvement opportunities come from

A key strength of Clause 10, and a point auditors pay close attention to, is that nonconformities and improvement opportunities are not limited to what a certification auditor finds. In a well-run BCMS, most of them surface internally, through:

• Real incidents: an actual disruption tests the BCMS under genuine conditions and almost always reveals something the plan did not anticipate.
• Exercises and tests: planned tests of continuity plans, whether tabletop exercises or full simulations, are designed precisely to surface gaps before a real event does.
• Internal audits and management review: the structured evaluation activities of Clause 9 that routinely feed findings into Clause 10.
• Monitoring and measurement: BCMS performance indicators falling short of what was expected.

Lessons learned: closing the loop from incidents and exercises

One of the most important practical aspects of Clause 10 is the discipline of post-incident and post-exercise review — capturing what actually happened (or what an exercise revealed), and feeding those lessons back into the BCMS through the corrective action process described above. An incident or exercise that is not followed by a structured review, and a review that is not followed by any actual change to plans, procedures or training, means the organisation is not extracting the value that the exercise or the incident response effort has already paid for.

In practice, this lessons-learned loop tends to include a few consistent elements: a debrief soon after the incident or exercise while details are fresh, a record of what worked and what did not, a judgement on whether any gap found is significant enough to warrant a corrective action, and — where it is — a corrective action that goes through the same reaction, root cause, implementation and effectiveness-review sequence as any other nonconformity. The link between "what we observed in the exercise" and "what we changed in the plan" is exactly what auditors look for as evidence that Clause 10 is functioning, rather than being a paperwork formality.

10.2 Continual improvement

Clause 10.2 requires the organisation to continually improve the suitability, adequacy and effectiveness of the BCMS. Unlike 10.1, it is not triggered by a specific nonconformity — it is the ongoing expectation that the BCMS gets better over time, drawing on inputs from across the whole standard: audit results, exercise and test outcomes, incident lessons learned, management review decisions, and changes in the organisation's context.

Auditors typically test this by asking for concrete examples of how the BCMS has actually changed as a result of learning — a specific plan revision traced back to a specific exercise finding, or a specific recovery objective revised after a real incident — rather than a general statement that improvement is valued.

Common audit findings on Clause 10

Across BCMS audits, a handful of recurring weaknesses tend to show up in how organisations handle Clause 10:

• Corrections without root cause analysis: the immediate symptom from an incident or exercise is fixed, but nobody asks why it happened, so the same gap resurfaces in the next test.
• No effectiveness review recorded: a corrective action is marked closed as soon as it is implemented, with no later check that it actually worked.
• Exercise findings not converted into corrective actions: a test report lists gaps, but there is no traceable link showing those gaps were evaluated and, where warranted, acted on.
• Nonconformity records that only reflect external audit findings: a healthy BCMS should show internally-raised nonconformities too; a register with none is itself a signal to auditors.
• Continual improvement treated as a paperwork exercise: an improvement statement exists in the manual, but it has no traceable connection to actual incidents, exercise results or management review outputs.

Where Clause 10 fits alongside document management is where AI assistants such as IgeraIndustria can be genuinely useful in day-to-day operation: rather than searching through separate incident reports, exercise debriefs and plan revisions to check whether a lesson was actually actioned, teams can ask a direct question and get an answer sourced from the organisation's own BCMS documents, with the exact source cited — helping close the loop between what was learned and what was changed, and keeping the evidence trail an auditor will ask for readily available.

Frequently asked questions about ISO 22301 Clause 10

What is the difference between a correction and a corrective action under Clause 10.1?

A correction is the immediate fix for the nonconformity itself — restoring a failed system, updating an outdated contact list. A corrective action goes further: it investigates why the nonconformity happened and implements changes to prevent it recurring. Clause 10.1 expects both, not one instead of the other.

Do exercise findings always need a formal corrective action?

Not automatically — corrective actions should be appropriate to the effects of the nonconformity encountered, which is a matter of judgement rather than a fixed rule. A minor observation with negligible impact may only need a note in the exercise report. A gap that would have materially affected the organisation's ability to recover warrants a documented corrective action following the full reaction, root cause, implementation and effectiveness-review sequence.

How does Clause 10 relate to Clause 9 (Performance evaluation)?

Clause 9 is where nonconformities and improvement opportunities are typically identified — through monitoring and measurement, internal audit, and management review. Clause 10 is where the organisation acts on what Clause 9 surfaces. The two clauses work as a pair: a weak Clause 9 usually means there is little for Clause 10 to act on.

Why does ISO 22301 place such emphasis on exercises and tests feeding into improvement?

Because a continuity plan that has never been tested carries an unknown amount of risk. Exercises and tests are the structured way an organisation finds out, under controlled conditions, whether its plans actually work — and Clause 10 is what ensures the findings from those exercises translate into real changes rather than being logged and left unaddressed.

Is continual improvement under 10.2 actually assessed during an audit?

Yes. Auditors generally look for a traceable link between a specific input — an exercise result, an incident, a management review decision — and a specific, verifiable change to the BCMS. A BCMS that reads identically cycle after cycle, despite having run exercises or experienced incidents in between, raises the question of whether improvement is happening in substance rather than only in the policy wording.

Who is responsible for making sure lessons learned actually get actioned?

Ownership varies by organisation, but the BCMS typically assigns clear responsibility — often to a business continuity manager or coordinator — for tracking corrective actions raised from incidents and exercises through to closure and effectiveness review. Without a named owner and a tracking mechanism, lessons-learned items tend to be recorded but not followed through.

Does Clause 10 apply the same way to small organisations as to large ones?

The requirement applies regardless of size, but the scale of the process should match the organisation. A smaller organisation may manage its nonconformity register and lessons-learned log as a simple, well-maintained spreadsheet, while a larger one may need a more structured system — what matters to an auditor is evidence that the reaction, root cause, action and effectiveness-review sequence is genuinely followed, not the sophistication of the tooling.

Expert ISO 22301 · IgeraIndustria editorial team