ISO 22313:2020 - Guidance on Business Continuity Management Systems 5.3: 5.3 Roles, responsibilities and authorities

Guidance for top management to settle and make known who is responsible for what within the BCMS and with what authority. One member of top management answers for the BCMS and is responsible for it; a body such as a steering committee can be set up to oversee implementation and continuing monitoring; and representatives are named, whatever else they do, with the role, duties and authority to keep the BCMS in line with the business continuity policy, to report its performance to top management as input to review and improvement, to spread awareness of continuity across the whole organization and to make sure the incident response procedures work. The management representative can carry a specific title (business continuity manager or specialist, resilience manager), can have other duties and can come from anywhere in the organization; functions or sites can nominate people to help implement, and their roles, accountabilities, duties and authority are written into job descriptions and into appraisal, reward and recognition arrangements. Table 3 sets out example duties for the top management representative, the business continuity manager, the business continuity management team and functional representatives; each duty sits with a role that has an owner, and all BCMS roles, duties and authorities are defined, recorded and audited.