Which phase in PDCA cycle assesses the effectiveness of the BCMS against requirements of the business continuity policy?

The "Check" phase of the Plan-Do-Check-Act (PDCA) cycle is dedicated to performance evaluation. According to ISO 22301, this phase involves monitoring, measuring, analyzing, and evaluating the Business Continuity Management System (BCMS). Activities such as internal audits and management reviews are conducted during this phase to assess the performance and effectiveness of the BCMS against the organization's business continuity policy, objectives, and other requirements. This assessment provides the necessary input for corrective actions and continual improvement, which are addressed in the "Act" phase.

A. Plan: This phase involves establishing the BCMS policy, objectives, and processes; it is about setting up the framework, not assessing its effectiveness.
B. Do: This phase focuses on implementing and operating the established BCMS policy, controls, and procedures; it is the execution stage.
D. Act: This phase involves taking actions to continually improve the BCMS based on the results of the "Check" phase, such as implementing corrective actions.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 9, "Performance evaluation": This clause details the requirements for the "Check" phase. Section 9.1 states, "The organization shall evaluate the business continuity performance and the effectiveness of the BCMS." This clause also covers internal audits (9.2) and management reviews (9.3), which are key activities for assessing effectiveness.

Clause 0.3, "Plan-Do-Check-Act (PDCA) model": This section explicitly maps the standard's clauses to the PDCA cycle, assigning Clause 9 to the "Check" stage.

2. Abid, S., & Mir, A. (2021). A framework for the implementation of ISO 22301: The case of a public sector organization in a developing country. International Journal of Disaster Risk Reduction, 54, 102039.

Section 3.2, "The PDCA Cycle": The paper describes the "Check" phase as where "the organization monitors and measures processes against policies, objectives, and requirements and reports the results. This is done through internal audits and management reviews to ensure that the BCMS achieves its intended outcomes." This directly supports that assessment occurs in the "Check" phase. DOI: https://doi.org/10.1016/j.ijdrr.2021.102039

3. University of Manchester. (n.d.). Business Continuity Management. Information Governance Office.

In its documentation on implementing a BCMS based on ISO 22301, the university outlines the PDCA cycle. The "Check" phase is described as the stage for "Monitoring and reviewing performance against business continuity policy and objectives," which aligns with the function of assessing effectiveness.