The collection of corporate information provides evidence on the state of organizational preparedness.

The statement is correct. Within the framework of ISO 22301, the collection of corporate information is fundamental to demonstrating organizational preparedness. A Business Continuity Management System (BCMS) requires extensive documented information, including business impact analyses, risk assessments, continuity plans, and exercise reports. This collection of information serves as objective evidence for performance evaluation, internal audits, and management reviews. By analyzing this data, an organization can verify the effectiveness of its BCMS, identify areas for improvement, and provide assurance to stakeholders that it is prepared to manage disruptive incidents.

B. False: This is incorrect. Without the systematic collection of corporate information, there would be no verifiable evidence to assess the state of preparedness, making it impossible to conform to ISO 22301 requirements for monitoring, measurement, and review.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 9.1, Monitoring, measurement, analysis and evaluation: States, "The organization shall retain appropriate documented information as evidence of the results [of monitoring and measurement]." This directly links collected information to evidence of performance.

Clause 9.2, Internal audit: The audit process is designed to "provide information on whether the business continuity management system conforms to... the requirements of this document." This is achieved by collecting and evaluating evidence (corporate information).

Clause 9.3, Management review: Requires top management to review "information on the performance and effectiveness of the business continuity management system," which is derived from collected corporate data.

2. Heng, G. M. (2021). Business Continuity Management: A Standards-Based Approach. The Institute of Internal Auditors Research Foundation.

Chapter 4, Performance Evaluation: Discusses how performance evaluation (Clause 9) relies on gathering data and information. It states, "The organization needs to determine what to monitor and measure... and retain documented information as evidence of the results." (Paraphrased from discussion on Clause 9.1).

3. Bajgoric, N. (2014). Business continuity management: A systemic framework for implementation. Kybernetes, 43(2), 156-177.

Section: Continuous improvement of BCM: The paper emphasizes that the BCM lifecycle, aligned with ISO 22301, involves a "monitoring and reviewing" phase which relies on collecting information from tests, exercises, and real incidents to provide evidence for improving preparedness. (DOI: https://doi.org/10.1108/K-06-2013-0115)