Objective
Ensure the BCM program has approved scope, accountable roles, Board oversight and sufficient resources.
Control Activity
Compliance coordinates an annual review of BCM context, scope, responsibilities and resources. The review confirms that: the external context is documented (political and regulatory environment, economic and technological environment, social and cultural factors, natural and environmental risks, competitive pressures); the internal context is documented (products and services, resources, organizational structure, dependencies); and interested parties are identified (regulators, clients, employees, suppliers, insurers, auditors). The review verifies that Board of Directors responsibilities are assigned (approves BCM policy, reviews plans annually, ensures resource allocation, oversees audits and corrective actions), Department Head responsibilities are assigned (identify critical functions, maintain sub-plans, ensure staff training), and Employee responsibilities are assigned (participate in training and drills, execute BCM responsibilities). The review confirms that internal and external audits are conducted annually and findings are reviewed by the Board with corrective actions tracked. Material gaps, exclusions and resource constraints are documented, assigned and presented to management and the Board for decision.
Evidence
- Expected evidence: Approved BCM scope and responsibility record
- Expected evidence: Resource assessment
- Expected evidence: Board review or approval minutes
- Expected evidence: Escalation and remediation records
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: inspect the annual governance pack and sample unresolved actions for timely escalation and closure
- Testing frequency: annual and after material organizational or regulatory change
Relationships
- Requirement: REQ-IT-006 Maintain Business Continuity Management
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-BCM-001 Govern BCM Context Responsibilities and Resources
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Business Continuity Manual version 1.0.