Non-compliance can often lead to undesirable outcomes.

The statement is fundamentally true within the context of any management system, including ISO 22301. Non-compliance refers to the failure to act in accordance with legal, regulatory, contractual, or other requirements to which an organization subscribes. The ISO 22301 standard explicitly requires an organization to identify these compliance obligations and integrate them into its Business Continuity Management System (BCMS). The primary purpose of this is to avoid the "undesirable outcomes" associated with non-compliance, which can include legal penalties, financial losses, contractual liabilities, reputational damage, and the inability to continue operations. Therefore, managing compliance is a critical risk mitigation activity.

B. False: This is incorrect. The entire framework of a BCMS is built on identifying risks and requirements to prevent negative impacts. Ignoring compliance obligations directly exposes an organization to predictable and often severe undesirable outcomes.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Clause 9.1.2, "Evaluation of compliance": This clause mandates that "The organization shall plan, establish, implement and maintain a process for evaluating compliance with applicable legal and regulatory requirements...". The implicit purpose of this evaluation is to identify and rectify non-compliance to prevent its negative consequences.

Clause 10.1, "Nonconformity and corrective action": This section requires an organization, when a nonconformity occurs, to react by "dealing with the consequences." This directly links non-compliance (a type of nonconformity) with undesirable outcomes that must be managed.

2. Ruzic-Dimitrijevic, L., & Glusac, D. (2015). The Role and Importance of the Implementation of Business Continuity Management System (BCMS) in Organizations in the Financial Sector. International Review, (3-4), 61-69.

Page 63: The paper discusses that a key driver for implementing a BCMS is "compliance with legal and regulatory requirements." It highlights that failure to comply can lead to sanctions and loss of business license, which are clearly undesirable outcomes. This reinforces the direct link between non-compliance and negative consequences.

3. Herbane, B. (2019). Rethinking business continuity management. Business Horizons, 62(5), 553-563. https://doi.org/10.1016/j.bushor.2019.07.008

Section 3.1, "The regulatory imperative": This section explains that regulatory pressure is a significant driver for BCM adoption. It states, "Non-compliance can result in fines, reputational damage, and even imprisonment for senior managers." This directly supports the assertion that non-compliance leads to undesirable outcomes.