11.4 Preventive Action, Change Monitoring & Documenting Improvements

Domain 6 — Continual improvement of a BCMS based on ISO 22301 — carries 10 of the 80 exam questions (12.5%), all at the evaluation level. Section 10.3 covered nonconformity handling, root cause analysis, and management review outputs. Section 11.3 covered long-term governance and the certification cycle. Three Domain 6 competencies remain, and each contains a distinct trap:

• "Ability to determine the corrective and preventive actions to treat nonconformities"
• "Ability to monitor change factors"
• "Ability to gather inputs to continual improvement and maintain and update documented information", with the associated knowledge statement "Knowledge of documenting the improvements"

---

1. Preventive Action: The Clause That Isn't There

This is the single most reliable trap in Domain 6, because the PECB competency statement and the current standard appear to disagree.

ISO 22301:2012 had a distinct preventive action clause, inherited from the old ISO management-system template. ISO 22301:2019 does not. When the standard was rewritten to the Annex SL harmonized structure, the preventive action clause was deliberately removed and its function absorbed into Clause 6.1, Actions to address risks and opportunities.

The reasoning, and the point the exam wants you to articulate: a management system that identifies risks during planning and acts on them is a preventive system. Preventive action was never a separate activity to be performed after the fact — it was the whole purpose of planning. Bolting it on as a reactive clause implied the opposite.

So Clause 10 of ISO 22301:2019 reads:

There is no 10.3, and no preventive action clause anywhere in the standard.

Holding both framings

PECB's Domain 6 competency nonetheless says "corrective and preventive actions." This is not an error in the blueprint — it reflects that preventive action remains a live implementation concept even though it is no longer a standalone requirement. The Lead Implementer is expected to be able to:

• Explain that ISO 22301:2019 has no preventive action clause, and say where the function went (Clause 6.1)
• Still determine and apply preventive measures in practice, distinguishing them from corrective ones

The three terms, precisely

A worked illustration:

The Year 1 surveillance audit finds that the alternate work site contract expired four months ago and was never renewed.

• Correction: Renew the contract immediately. The gap is closed; nothing has been learned.
• Corrective action: Root cause analysis shows no contract in the BCMS resource inventory has a renewal owner or a diarised expiry alert. Add expiry dates and named owners for all continuity-critical contracts, with automated 90-day alerts. Recurrence is now prevented.
• Preventive action: No nonconformity has occurred regarding supplier insolvency — but horizon scanning identifies that the alternate site provider is loss-making. Qualify a second provider before any failure occurs. This is Clause 6.1 territory, not Clause 10.1.

The exam discriminator: corrective action always looks backwards from something that happened; preventive action always looks forwards at something that has not. And "we fixed it" is a correction, not a corrective action — the most frequently tested confusion in the entire standard.

---

2. Monitoring Change Factors

A BCMS is a set of assumptions about the organization: which activities matter, how long they can be down, what they depend on, and who recovers them. Every one of those assumptions decays. Change factor monitoring is the discipline of detecting decay before a disruption does.

Clause 10.1 requires the organization to determine whether similar nonconformities exist or could potentially occur, and Clause 6.3 requires that changes to the BCMS be carried out in a planned manner. Together they make change monitoring a requirement, not an optional maturity practice.

Making monitoring systematic

Monitoring fails when it depends on someone remembering. Three mechanisms make it structural:

1. Embed BCMS triggers in existing governance. The change advisory board, project gate reviews, procurement onboarding, and HR leaver processes all already exist. Add a mandatory BCMS-impact question to each. A cloud migration that reaches production without anyone asking whether the RPO is still achievable represents a process failure, not an individual one.
2. Define review triggers alongside review cycles. Documents carry both a periodic review date and event triggers — "review on any change of scope, any new critical supplier, or any material incident."
3. Assign horizon scanning explicitly. Regulatory and threat-landscape monitoring must have a named owner and a reporting route into the management review, or it will not happen.

Change factor monitoring outputs feed Clause 9.3.2 as a mandatory management review input — changes in external and internal issues relevant to the BCMS.

---

3. Gathering Improvement Inputs and Documenting Improvements

The inputs

Continual improvement is not a mood; it is fed by identifiable sources, and an implementer should be able to list them:

Continual, not continuous

ISO uses continual improvement deliberately. Continuous implies uninterrupted, unbroken change. Continual means recurring, stepwise improvement with periods of consolidation between increments — which is what management systems actually do and can sustain. An organization that stabilises a new process for two quarters before improving it again is conforming to Clause 10.2, not failing it.

Documenting the improvements

PECB lists "Knowledge of documenting the improvements" as a distinct knowledge statement, and the reason is practical: an improvement that leaves no trace cannot be demonstrated. At surveillance and recertification, the auditor asks how the BCMS has improved since the last visit. "We have made lots of small improvements" is not evidence; a maintained record is.

Minimum documented information for an improvement:

Two document-control obligations follow from Clause 7.5.3 and are routinely failed:

• Every improvement that changes a document must move that document's version, with the change recorded and the superseded version controlled. An improved procedure circulating alongside three uncontrolled older copies has created a nonconformity while trying to fix one.
• Downstream artefacts must be swept. Changing the incident escalation threshold means updating the incident response plan, the affected BCPs, the action cards, the awareness materials, and the exercise scenarios. Partial propagation is one of the most common minor nonconformities at surveillance.

The improvement register — alongside the corrective action log and the exercise programme — is the evidence base that proves Clause 10.2 conformity. It is also, in practice, the first artefact an experienced surveillance auditor asks to see.

---

4. Worked Implementation Scenario: A Logistics Operator's Improvement Cycle

Context. A certified logistics operator completes its Year 1 surveillance audit with one minor nonconformity: the after-action report from its June functional exercise recorded four findings, of which two had no assigned owner.

Correction. The BCMS Manager assigns owners to the two orphaned findings within a week. The immediate gap is closed.

Corrective action. Root cause analysis using the 5 Whys reveals that the AAR template contains an owner field but the post-exercise workflow has no gate requiring the field to be populated before the report is issued. The corrective action adds a mandatory completeness check to the exercise coordinator's checklist and configures the tracking tool to reject an AAR with unassigned findings. This eliminates the cause.

Preventive action (Clause 6.1, not 10.1). The same review notes that the corrective action log has the identical weakness — entries can be created without owners — although no nonconformity has yet arisen there. Because this is a potential nonconformity rather than an actual one, the fix is registered as a risk treatment under Clause 6.1, and the same validation is applied to the corrective action log.

Change factor monitoring in the same cycle. The operator's horizon scanning flags two changes: a planned WMS migration to a SaaS platform in Q3, and the acquisition of a regional competitor with two additional depots. Both trigger BCMS review — the migration invalidates the current dependency map and the achievable RPO, and the acquisition expands the scope boundary and the interested party matrix.

Documenting the improvements. All of it is recorded in the improvement register: source (surveillance NC 2026-01 and horizon scanning), description, rationale, owner, and the documents updated — exercise procedure v3.1 to v3.2, corrective action procedure v2.4 to v2.5, BCMS scope statement v4.0 to v5.0, dependency map v6.2 to v7.0. Awareness materials and the exercise scenario library are swept for consistency.

Outcome. At Year 2 surveillance the auditor samples the improvement register, traces the exercise finding through root cause to the workflow control and to the verified absence of recurrence across three subsequent exercises, and closes the prior nonconformity as effectiveness-verified rather than merely completed. The auditor records the register as a strength.

---

5. PECB Exam Warning Traps & Implementation Pitfalls