Which one of the following initiative of Business Continuity Management is a regulatory system that controls an organization and its activities?

Governance is the formal framework of rules, relationships, systems, and processes by which an organization is directed, controlled, and held to account. In the context of Business Continuity Management (BCM), governance establishes the policies, roles, responsibilities, and authority needed to manage the Business Continuity Management System (BCMS). It acts as the internal regulatory system that ensures BCM activities are consistently performed, monitored, and aligned with the organization's strategic objectives and legal obligations. This framework provides the structure for decision-making and control over the BCMS, making it the correct answer.

A. Leadership provides the vision, commitment, and resources for BCM, but it is not the regulatory system of control itself; rather, it enables and directs the governance framework.

B. Good Business Practice is a descriptor for BCM, signifying its value to organizational resilience, but it is not the specific system that controls the organization's activities.

D. Long Range Focus is a strategic perspective or an outcome of a mature BCM program, not the governing mechanism that controls its implementation and operation.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements. Clause 5, "Leadership," particularly 5.1 (c) and 5.3, establishes the foundation for governance by requiring top management to ensure the BCMS is integrated into business processes and that roles, responsibilities, and authorities are assigned and communicated. This integration and assignment of authority are core components of a governance system.

2. Herbane, B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History, 52(6), 978-997. This paper discusses how the need for improved corporate governance has been a primary driver for the formalization of BCM, framing it as a necessary control mechanism for organizational resilience (p. 989). DOI: https://doi.org/10.1080/00076791.2010.511185

3. Smallman, C. (2019). Business continuity and crisis management: A review of the past, a look at the present, and a glimpse of the future. Continuity & Resilience Review, 1(1), 4-20. This review highlights that effective BCM is underpinned by a strong governance structure that provides oversight and ensures accountability, distinguishing it from day-to-day management or leadership actions (Section: "The Role of Governance"). DOI: https://doi.org/10.1108/CRR-03-2019-0003