Which of the following document is owned by executive management and sets the purpose of BCM in an organisation?

The Business Continuity Policy is the formal, high-level document that articulates an organization's intentions and direction for its Business Continuity Management System (BCMS). According to ISO 22301, it is the responsibility of top management (executive management) to establish, implement, and maintain this policy. The policy provides the framework for setting business continuity objectives, states the organization's commitment to BCM, and defines the overall purpose, scope, and governance of the BCM program. It serves as the foundational document from which all other BCM activities are derived and authorized.

B. Business Process Policy: This policy governs general business process management and improvement, not the specific purpose and framework for ensuring continuity during a disruption.

C. Register: A register is an operational record or list, such as a risk register or asset register, used for tracking items. It is not a strategic policy document.

D. Worksheet: A worksheet is a tactical tool used for data collection and analysis, such as in a Business Impact Analysis (BIA), not a high-level governance document.

1. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

Section 5.2, "Policy": This clause explicitly states, "Top management shall establish a business continuity policy..." It details that the policy must be appropriate to the purpose of the organization and provide a framework for setting business continuity objectives. This directly links the policy to executive management and its role in setting the purpose of BCM.

2. Heng, G. (2014). From BCM plan to BCMS: A new paradigm for business continuity. Journal of Business Continuity & Emergency Planning, 7(3), 232–244.

Page 236, "Leadership": The article discusses the critical role of top management in line with ISO 22301, stating, "Top management demonstrates leadership and commitment by... establishing the business continuity policy and business continuity objectives." This reinforces that the policy is the instrument through which executive management sets the BCM's purpose.

3. Abid, S. Z., & Ahmad, M. N. (2014). A framework for implementing business continuity management (based on ISO 22301). International Journal of Computer Science and Information Security, 12(10), 36-42.

Page 38, Section 3.2, "Leadership": The paper highlights that a key requirement of the leadership clause in ISO 22301 is the establishment of the business continuity policy by top management, which defines the organization's commitment and provides a framework for the BCMS.