Which of the following outlines the management hierarchy of the organization?

The corporate structure (or organizational structure) outlines the management hierarchy, reporting lines, roles, and responsibilities within an organization. Understanding this structure is a critical requirement in ISO 22301 when establishing the context of the organization. It dictates how decisions are made, how resources are allocated, and how business continuity governance is applied across different levels of the enterprise. Auditors review the corporate structure to ensure that BCMS roles and authorities are appropriately assigned and communicated.

B. Corporate Service: Incorrect because this refers to internal support functions (e.g., IT, HR, Facilities), not the hierarchical management framework of the organization.
C. Corporate Improvement: Incorrect as this relates to continuous improvement methodologies (like the Plan-Do-Check-Act cycle), not the structural hierarchy.
D. Corporate Defences: Incorrect because this refers to security controls, risk mitigation strategies, and protective measures, not the organizational chart or management hierarchy.

1. International Organization for Standardization. (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements. Clause 4.1 (Understanding the organization and its context) and Clause 5.3.

2. PECB. (2021). ISO 22301 Lead Auditor Training Course. Section: Context of the Organization.