What does the business impact analysis (BIA) need from HR?
The BIA identifies core business processes, assesses the financial loss and the maximum tolerable period of disruption (MTPD), and sets recovery priorities; the dependencies to identify include people, systems, suppliers and sites. HR should provide:
| Item | Content |
|---|---|
| Critical roles | Which roles each critical activity needs to run |
| Minimum staffing | The fewest people needed to recover within the tolerable period |
| Skills and authority | Which tasks need specific skills, licences or sign-off authority |
| Substitute sources | Deputies, support from other sites, external staff |
| Single points of dependency | Tasks only one person can do |
Business continuity management is an overall framework covering people, processes and technology; if the BIA is shallow, every plan built on it has no foundation.
How should key people and deputies be arranged so that no task depends on one person?
Use the BIA to find single points of dependency, then work through them in recovery-priority order:
- Name deputies: assign a first and second deputy for each critical role and write them into the business continuity plan, not just in a manager's head
- Deputies have done it: rotation, cross-training, or having the deputy perform the task in an exercise, with records
- Document procedures: write critical tasks down as procedures so deputies have something to follow
- Spread people out: avoid concentrating people in the same critical role at one site or on one shift
- Pre-approve access: approve the system access deputies will need in advance and record activation and removal, sharing the process with ISO 27001 access management
Exercises are the evidence auditors trust most: a business continuity plan with no exercise records is treated as if it does not exist.
When work is suspended for a typhoon or earthquake, can we require employees to come in? How are attendance and pay handled?
Under the Ministry of Labor's Guidelines on Attendance Management and Wage Payment When Natural Disasters Occur, and the Ministry's explanations:
- Not attending: where the head of any jurisdiction covering the workplace, the residence or the necessary commuting route has announced a suspension of work, and the worker's absence is not attributable to the worker, the employer may not treat it as absence without leave or lateness, may not force the worker to use personal or other leave, and may not force make-up work, withhold a full-attendance bonus, dismiss the worker or take other adverse action; the day's wages should preferably not be deducted
- Working as usual: if the business needs specific workers to attend, this must be agreed in advance between employer and worker, with the union's consent where there is a union, or the labor-management meeting's consent where there is not; besides paying the day's wages, the employer should preferably pay extra and provide transport, a transport allowance or other necessary help
The CHRO should list in the business continuity plan in advance which roles must attend, whether the consent steps are done, transport and safety arrangements, and the extra pay rate. The Ministry also stresses that safety comes first when deciding whether workers attend.
If recovery needs employees to work overtime or give up leave, what does the law require?
Taiwan's Labor Standards Act has specific rules for natural disasters, incidents and emergencies:
| Situation | Rule | Procedure |
|---|---|---|
| Extending hours (Article 32(4)) | Where a natural disaster, incident or emergency makes it necessary for workers to work beyond normal hours, the employer may extend working hours | Notify the union within 24 hours of the start of the extension; where there is no union, report to the local competent authority for the record; give appropriate rest afterwards |
| Suspending leave (Article 40) | Where the employer considers continued work necessary, it may suspend the leave set out in Articles 36 to 38 | Pay double wages for the suspended leave and give compensatory leave afterwards; within 24 hours afterwards, report the reasons in detail to the local competent authority for approval |
Whether a shutdown caused by ransomware or a system failure counts as an "emergency" depends on the case and should be confirmed by legal counsel. The business continuity plan can prepare templates for notifying the union or the authority in advance, with an owner and a deadline.
In a pandemic or disaster, staff switch to working from home or another site. How are attendance records and security handled?
Attendance records: not limited to clocking in. Under Article 21 of the Enforcement Rules of the Labor Standards Act, attendance records include sign-in books, time cards, card readers, access cards, biometric systems, computer attendance systems or any other tool that can reliably record attendance times; the Ministry of Labor also explains that employer and worker may agree on the recording method that suits both. Attendance records must still be kept for five years and record attendance daily to the minute (Article 30(5) and (6) of the Labor Standards Act).
Security: remote access, company devices and data taken off-site should be designed together with ISO 27001 controls. ISO 22301 and 27001 share the Annex SL structure, and the 27001 controls for information security during disruption and ICT readiness (A.5.29/5.30) connect directly with 22301, so an integrated implementation can share documents and audits.
Should HR take part in business continuity exercises? How often?
Yes. The business continuity plan includes crisis communication procedures; notifying employees, emergency contact lists and confirming staff safety all depend on HR data and processes.
- Frequency: the standard requires exercises at planned intervals and after significant changes; the practical baseline is at least one full exercise a year plus scenario-based tabletop exercises
- People scenarios: add scenarios such as "key people cannot come in", for example half the staff at a site cannot attend or the only person who knows a system cannot be reached, to test whether deputies and redeployment work
- Records: the post-exercise review and improvement records matter as much as the exercise itself
Customers rarely ask whether something will go wrong; they ask how fast you can keep supplying after it does. Whether people can be in place is part of that answer.
How does Winners Consulting help the CHRO with ISO 22301?
Winners Consulting's VP- and director-level consultants lead the work end to end, never outsourced, and hold ISO 22301 lead auditor qualifications.
- BIA: built around clause 8 of 22301, using ISO/TS 22317 for the BIA, completed together with business units to set recovery order
- Integration: share backup and ICT redundancy documents with ISO 27001
- Exercises: every project runs at least one tabletop exercise and one functional exercise, and the records serve as evidence for certification and customer questionnaires
- Certification: certification is carried out by a third-party body, and we accompany you; we deliver an evidence pack for customer questionnaires
- Timeline (as listed on the service page): the four phases usually take 4 to 7 months, or about 3 to 5 months with ISO 27001 in place; the BIA and exercise phases cannot be compressed
Further reading: ISO 22301 business continuity management, How to choose an ISO 22301 consultant, ISO 22301 budget and timeline.
How other roles see this service
- CEOISO 22301 for the CEO: how long can a site be down, and who signs off the RTO?
- CISOCISO guide to ISO 22301: ICT recovery, RTO and exercises
- CROISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- CFOCFO implementing ISO 22301: disruption losses, RTO investment and budgeting
Other services for this role
- GDPR and ISO 27701 for the CHRO: employee data, transfers and monitoring
- Trade secrets for the CHRO: what evidence to keep at hiring, non-compete and exit
- ISO 37001 for the CHRO: designing integrity training, whistleblowing and discipline
- The EU AI Act for the CHRO: AI in recruitment, performance and workforce management
- CHRO guide to AI transformation: generative AI rules, AI literacy and reskilling
- CHRO guide to ISO 27001: screening, NDAs, training, discipline and offboarding
- CHRO guide to HR systems: employee data, e-attendance and organizational change