Which of the following document is owned by executive management and sets the purpose of BCM in an organisation?

The Business Continuity Policy is the foundational document owned and authorized by top (executive) management. According to ISO 22301, this policy sets the purpose, direction, and intentions of the Business Continuity Management System (BCMS). It demonstrates leadership commitment, aligns with the organization's strategic objectives, establishes the framework for setting business continuity objectives, and mandates the implementation of the BCM programme across the organization.

B. Business Process Policy: This is not a standard BCMS document recognized by ISO 22301 and does not define the overarching purpose of BCM.
C. Register: A register (e.g., risk register or incident register) is an operational tool for recording data, not a strategic document setting the BCM purpose.
D. Worksheet: A worksheet is an administrative or analytical tool used during processes like the BIA, lacking the executive authority and strategic scope of a policy.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, Clause 5.2 (Management system policy).

2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301, Clause 5.2 (Business continuity policy).