Management review
The management review is one record per period in which the executive team, the RMC and the BCP head review the risk and continuity position and decide what to do. The system pulls the inputs; the decisions become action items.
Who uses it: executives, the RMC and the BCP head. See Roles and permissions.
Inputs, pulled read-only
Section titled “Inputs, pulled read-only”| Input | From |
|---|---|
| Open and overdue actions | The action register |
| Red KRIs | Observations and breaches |
| Tier 2–3 losses | Materiality tiers — the most material losses |
| Exercise results | The exercise log in BCP Core |
| BIA approvals due | Approval and versions |
Holding the review
Section titled “Holding the review”- Open the period’s review record. The inputs are already in place.
- Go through each input.
- Record each decision with its owner and due date.
- Close the review. Each decision becomes an action item in the action register; the record keeps who attended, who recorded it and when.
What the system does or refuses
Section titled “What the system does or refuses”- One review record per period.
- Inputs are read-only. They cannot be edited in the review; a correction is made in the register the input comes from.
- Every decision becomes an action item.
- Who recorded the review is stamped — see Who-filed is stamped.
Standards
Section titled “Standards”The management review serves COSO ERM Review & Revision and ISO 22301 cl. 9.3 — see Standards mapping.