The scope of the Business Continuity Management System (BCMS) should be reviewed if:

The scope of the Business Continuity Management System (BCMS) is fundamentally determined by the organization's context, including its objectives, obligations, and internal and external environments. According to ISO 22301, the standard upon which the BCI Good Practice Guidelines are based, any change to the internal or external operating context must be considered during management reviews. Such changes, like new products, markets, regulations, or organizational structure, can directly impact the boundaries and applicability of the BCMS, necessitating a formal review of its scope to ensure it remains relevant, appropriate, and effective in meeting the organization's needs.

A. A new professional's appointment may bring new ideas, but personnel changes alone are not a formal trigger for a strategic scope review, which is driven by organizational needs.

B. Exercise findings typically lead to tactical updates of plans and procedures within the existing scope, not a fundamental reassessment of the BCMS's boundaries.

D. Poor personnel engagement is a cultural or awareness issue to be addressed through training and communication, not by altering the strategic scope of the BCMS.

1. ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 4.3

"Determining the scope of the business continuity management system

" states that when determining the scope

the organization must consider the external and internal issues referred to in Section 4.1 ("Understanding the organization and its context").

Section 9.3.2

"Management review inputs

" explicitly lists "changes in external and internal issues that are relevant to the business continuity management system" as a required input for management review

which is the formal process for evaluating the BCMS's continuing suitability

adequacy

and effectiveness

including its scope.

2. Business Continuity Institute (BCI)

"Good Practice Guidelines (GPG)

2018 Edition."

Professional Practice 1 (PP1): Policy and Programme Management

Section 3.3

"Determining the Scope of the BCMS

" explains that the scope is defined by the organization's context. It states

"The scope of the BCMS is influenced by the organization’s strategic objectives

culture

structure

products and services

supply chains

stakeholder relationships

and the external environment in which it operates." A change to any of these contextual factors would warrant a review.

Professional Practice 1 (PP1): Policy and Programme Management

Section 3.6

"Management Review

" aligns with ISO 22301

indicating that a key input for the review is "any changes to the internal and external context of the organization."