ISO 22301 Clause 9: Performance Evaluation
ISO 22301:2019 Clause 9 requires organisations to monitor, measure, analyse and evaluate their Business Continuity Management System (BCMS), run a planned internal audit programme, and conduct management review at planned intervals. Because business continuity plans exist for disruptions that, with any luck, rarely occur, most of this evidence has to come from exercises and tests rather than from real incidents. Auditors treat a BCMS with no exercise record and no management review minutes as unable to demonstrate effectiveness, regardless of how well the plans read on paper.
What Clause 9 actually asks for
Clause 9 of ISO 22301:2019 sits inside the standard's "check" stage and is split into three sub-clauses: 9.1 Monitoring, measurement, analysis and evaluation; 9.2 Internal audit; and 9.3 Management review. Together they form the feedback loop that tells an organisation whether its business continuity management system is actually working, not just whether it exists on paper.
9.1 requires the organisation to decide what needs to be monitored and measured, the methods used, when monitoring takes place, when results are analysed, and who is responsible. Crucially, the clause also requires that the methods chosen produce comparable and reproducible results, and that documented information is retained as evidence.
9.2 requires internal audits at planned intervals to check whether the BCMS conforms to the organisation's own requirements and to the requirements of ISO 22301, and whether it is effectively implemented and maintained. This includes defining an audit programme, audit criteria and scope for each audit, selecting auditors who are objective and impartial, reporting results to relevant management, and retaining audit evidence.
9.3 requires top management to review the BCMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The standard sets out specific inputs the review must consider — including the status of actions from previous reviews, changes in external and internal issues relevant to the BCMS, information on BCMS performance (including trends in nonconformities, monitoring and measurement results, audit results, and exercise and test outcomes), and opportunities for continual improvement — and specific outputs, including decisions on improvement opportunities and any need for changes to the BCMS.
The core challenge: measuring a system built to prevent things that rarely happen
Most management system standards can lean on operational data — nonconformities, customer complaints, defect rates — that accumulates naturally through day-to-day business. Business continuity is different by design. A BCMS exists to handle disruptions the organisation hopes to avoid, and a well-run business may go years without invoking a plan for real. That is a good outcome operationally, but it leaves Clause 9 with little raw material if the organisation waits for a genuine incident to generate evidence.
ISO 22301 resolves this by treating exercises and tests as the primary evidence base for performance evaluation, not a substitute for it. Clause 8.5 requires the organisation to exercise and test its business continuity procedures, and the outputs of that exercising programme — what was tested, what worked, what didn't, how gaps were closed — feed directly into the monitoring and measurement required by 9.1 and into the performance data reviewed under 9.3. In other words, exercises are not a separate "nice to have" alongside Clause 9; they are how an organisation without recent real incidents demonstrates that its BCMS actually functions.
This has a practical implication that is easy to underestimate: an organisation cannot treat Clause 9 as a documentation exercise completed once a year before a certification audit. Monitoring and measurement need a rhythm — defined metrics, defined intervals, and a record that is built up over time — precisely because there is no steady stream of incident data to fall back on.