Where does disruption sit on the risk map, and what numbers express its impact?
Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, disruption is an operational risk. The BIA gives the CRO three answers needed to assess impact: which activities are critical, how long a disruption can last before it becomes intolerable (MTPD), and which resources and suppliers they depend on. The BIA sets the recovery order and is the load-bearing wall of the whole system; a shallow BIA leaves every later plan without foundation. Winners runs the BIA in ERM risk language and shares the scenario library with the enterprise risk map. The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
Who signs off RTOs and RPOs, and how does the CRO avoid targets that cannot be met?
They are derived from the BIA's impact analysis, decided by management, and then checked against existing recovery capability; if the capability cannot deliver them, it becomes an investment decision and should be reported together with the gap. A common mistake is drawing the target after the arrow lands: copying an attractive RTO with no capability behind it.
The CRO can use RTO attainment as one source of KRIs: the target, the result measured in exercises, the gap and the deadline for improvement, tracked on the same risk map.
We already have a BCP. Why do the committee and customer audits still not accept it?
A BCP is a plan document; ISO 22301 is a complete management system covering the BIA, strategy, plans, exercises and continual improvement, and it can be certified by a third party on a 3-year cycle. Audits and customer due diligence treat exercise records as the litmus test of whether the system is real; a BCP without exercise records effectively does not exist in a review.
The standard requires exercises at planned intervals and after significant changes; the practical baseline is at least one full exercise a year plus scenario-based tabletop exercises, and the records of review and improvement after an exercise matter as much as the exercise itself.
Which scenarios should exercises cover, and how do the results go into the annual risk report?
Scenarios come from the critical activities and dependencies found in the BIA: people, systems, suppliers and sites. The ERM service page also lists cyber extortion as a high-impact risk and plans a dual-track BCM/IT-DRP response with ISO 31000 × ISO 22301.
Article 15 of the principles requires reporting at least once a year. ISO 22301 output can go straight in:
- BIA results and recovery order → impact assessment of operational risk
- Exercise records and improvement tracking → evidence that controls work
- Internal audit and management review → implementation for the year
Every Winners project runs at least one tabletop exercise and one functional exercise, and the records serve as evidence for certification and customer questionnaires.
How long does it take, and which steps cannot be compressed?
As listed on the service page: four phases, usually 4–7 months; about 3–5 months with ISO 27001 in place.
- Scope and BIA (4–6 weeks)
- Strategy and plans (4–6 weeks)
- Exercises and correction (4–8 weeks)
- Audit and certification (3–6 weeks): internal audit, management review, corrective action, and support through stage 1 and stage 2 audits
The BIA and the exercises cannot be compressed.
How does Winners Consulting help CROs with ISO 22301?
- One set of scenarios: the BIA is run in ERM risk language and shares its scenario library with the enterprise risk map
- Method: built around clause 8 of 22301, with the BIA done using ISO/TS 22317; backup and ICT redundancy documents shared with ISO 27001
- Evidence: every project runs at least one tabletop and one functional exercise; a customer questionnaire evidence pack is delivered
- Separate roles: certification is done by a third-party body; Winners Consulting is the consultant and does not certify
- Who leads: vice-president and director-level consultants lead the work personally end to end, never outsourced
ISO 22301 business continuity, Choosing an ISO 22301 consultant, ISO 22301 budget and timeline, ERM consulting. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports