Implementing ISO22301 on a Limited Scope

[Hala0]

Hi everybody,

My organization has decided no implementing a BCMS (on a limited) scope with the goal of applying for the ISO22301 certification. This is my first time preparing a plan for an ISO implementation and I would appreciate it if someone would give their inputs.

We have chosen one product to be the scope of the BCMS, is that ok or doable? i.e. plan for the continuity of the production operations and supporting functions of Product XYZ.

And how would the implementation be scaled down? The guidelines address the whole organization, should I mainly the Production of XYZ alone? for example, “the context” here will address the organization as a whole or just the identified scope?

Do you have any advice or similar experiences to share?

Here some background information about my organization that might help me understand the bigger picture.

• Largish size organization that has 5 business units –each operating in a different industry
• Most of the business is project-based with big customers and long term
• High level of supplier dependence
• Mainly operate in one HQ (including the productions facilities) but some projects require teams to operate on the customers’ premises or under the customer's control

Thank you all,
Hala

 

[Richard Regalado]

Hello Hala.

If the entire operations went down except for the process that makes product XYZ, can the company survive?
What is the revenue share of product XYZ?
What contractual, legal or regulatory requirements will be affected if you do not continue the other products?
Can your business continue with just product XYZ?

These are questions you need to answer when deciding the scope for your BCMS.

Regards,

 

[dimitrz]

Yes , One Product or service is fine to start off with.
However you would be able to justify that decision to your Certification body, One reason could be that a business continuity impact to that product can seriously jeopardize the existence of your organization whereas your company can take hit if other portfolio products have continuity issues.

Since you mentioned that your company is project based it quite common for you to have a BCM program in place to safeguard a critical project and to meet contractual obligations to your customer/client.

It is always better to discuss the same with your proposed certification partner to get their view point , so as to avoid shocks / surprises at latter stage.

Note : I have a feeling the way you described your company , that even if you go with one product / project the BCM may still cover all your departments but its just an assumption