Competence for ISO 22301 Business Continuity
ISO 22301 Clause 7.2
This sub-clause requires the organisation to determine and provide the competence of people whose work affects business continuity performance, and retain documented evidence.
ISO 22301 Clause 7.2 - Competence
Clause 7.2 is one of the documented information clauses in ISO 22301. The standard expects the organisation to be able to demonstrate that the people running the BCMS, responding to disruptions or carrying out activities that affect continuity performance are actually qualified to do so. This applies as much to the named members of the response team as it does to the staff working in prioritised activities.
What ISO 22301 Clause 7.2 Requires
The clause requires four things. First, determine the competence required of people doing work under the organisation's control that affects business continuity performance. Second, ensure those people are competent on the basis of appropriate education, training or experience. Third, where applicable, take action to acquire the necessary competence and evaluate the effectiveness of the action. Fourth, retain appropriate documented information as evidence of competence.
The phrase "where applicable" matters. If a competence gap is identified, action has to follow - training, hiring, mentoring, redeployment - and the effectiveness of that action has to be evaluated. Just sending people on a course is not enough on its own.
Defining Competence for Continuity Roles
For ISO 22301, the competence requirements that need particular attention are usually those of the response team. The Business Continuity Lead, the incident management team, the heads of prioritised activities, and the staff who would be at the front line of recovery - all of these need to be competent for the role they are expected to play. That competence might come from professional qualifications (such as those offered by the Business Continuity Institute), from internal training, from previous experience, or from participation in exercises.
A staff competency matrix that maps people to roles and lists the training and experience they bring to each is the simplest way to handle this. For ISO 22301 specifically, make sure the matrix covers the response team roles and that there is a clear line from the named individual to the evidence of their competence.
I want to see documented evidence of competence for the people in continuity-critical roles. That can be training records, certificates, induction records or competency matrices. If a Business Continuity Lead has been in post for two years and has no evidence of any continuity-related training or experience, I will want to understand how the competence requirement has been determined and met.
Practical Compliance Guidance
The ER2 Staff Training Competency Matrix records the competencies held by staff and the gaps to be addressed. F-Q4 Staff Induction and F-Q6 Staff Annual Review provide the supporting evidence of training and ongoing competence assessment. The IMS manual describes the overall approach to competence and how it applies to the BCMS.
| alphaZ document | How to use it |
|---|---|
| ISO 22301 Toolkit | The full set of policies, procedures, registers and plans that build a BCMS to the requirements of the standard. |
| ER2 Staff Training Competency Matrix | The matrix that records the competencies held by staff and the training and experience that supports them, including BCMS roles. |
| F-Q4 Staff Induction | The induction form used to record initial training including business continuity awareness and role-specific responsibilities. |
| F-Q6 Staff Annual Review | The annual review record that captures ongoing competence assessment and identifies development needs. |
Subscribers to alphaZ have access to all of these documents and supporting material. Find out more about the alphaZ subscription.
