3.3 Organizational Roles, Responsibilities, and Authorities

3.3 Organizational Roles, Responsibilities, and Authorities

Executive Summary: A Business Continuity Management System cannot function without unambiguous organizational structures. ISO 22301:2019 Clause 5.3 requires Top Management to ensure that responsibilities and authorities for relevant BCMS roles are formally assigned, documented, communicated, and understood throughout the organization. This entails establishing a clear command-and-control response architecture (Strategic, Tactical, Operational), establishing clear legal and financial delegations (such as the authority to declare a disaster), and embedding a detailed RACI governance model across the BCMS lifecycle.

---

1. ISO 22301 Clause 5.3 Requirements

Clause 5.3 establishes that Top Management must ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization. Specifically, Top Management must assign responsibility and authority for:

• Conformity (Clause 5.3a): Ensuring that the BCMS conforms to the requirements of ISO 22301.
• Performance Reporting (Clause 5.3b): Reporting on the performance of the BCMS to Top Management (forming the core of the Management Review under Clause 9.3).

In addition to these overarching requirements, the operational standard (Clause 8.4.2) requires organizations to establish a formal incident management structure with defined responsibilities and authorities to respond to disruptions.

---

2. Key BCMS Governance & Operational Roles

A mature BCMS spans two operational modes: Steady-State Programme Management (routine maintenance, BIA, testing, auditing) and Disruption Response (crisis invocation, tactical recovery, emergency operations).

+-------------------------------------------------------------------------+
|                         BCMS ROLE ARCHITECTURE                          |
+-------------------------------------------------------------------------+
|  STEADY-STATE GOVERNANCE               |  DISRUPTION RESPONSE (3-TIER)  |
|  - Executive Sponsor (Board/C-Suite)   |  - Strategic: CMT (Gold)       |
|  - Steering Committee (BCSC)           |  - Tactical: IRT / BCT (Silver)|
|  - BC Manager / Lead Implementer       |  - Operational: ERT / DRP      |
|  - Departmental BC Coordinators        |    (Bronze)                    |
|  - Internal Audit Team                 |                                |
+-------------------------------------------------------------------------+

Detailed Role Profiles

1. Executive Sponsor (Top Management Representative)

• Profile: A member of the Board, CEO, COO, or CRO with executive decision-making and budget authority.
• Steady-State Duties: Chairs the Business Continuity Steering Committee; secures capital and operating funds; presents BCMS status to the Board; authorizes policy updates.
• Crisis Duties: Serves as the ultimate executive escalation point; liaises with government officials, regulatory bodies, and major investors.

2. Business Continuity Steering Committee (BCSC)

• Profile: Multi-disciplinary committee comprising business unit directors (Operations, IT, InfoSec, Legal, HR, Finance, Facilities, Corporate Comms).
• Steady-State Duties: Evaluates and signs off on BIA and Disruption Risk Assessment results; prioritizes continuity strategy investments; approves the annual exercise schedule; reviews internal audit nonconformities.

3. Business Continuity Manager / Lead Implementer

• Profile: The designated professional responsible for the day-to-day management of the BCMS programme.
• Steady-State Duties: Facilitates BIA and risk assessment workshops across departments; coordinates the drafting and updating of BCPs; designs, facilitates, and evaluates exercises; monitors BCMS KPIs; coordinates certification and internal audits.
• Crisis Duties: Acts as Chief of Staff or Technical Advisor to the Crisis Management Team; tracks recovery milestones; logs crisis timeline for post-incident analysis.

4. Departmental Business Continuity Coordinators (Champions)

• Profile: Operational managers embedded within each business unit (e.g., Accounts Payable Lead, Logistics Supervisor, Customer Support Manager).
• Steady-State Duties: Gathers BIA dependency data for their department; maintains local departmental recovery procedures and call trees; ensures team members complete continuity awareness training.
• Crisis Duties: Serves as the localized incident leader; coordinates departmental staff relocation, remote work transitions, or alternate processing.

5. Crisis Management Team (CMT / Strategic / Gold)

• Profile: Senior executives (CEO, COO, General Counsel, Head of Comms, HR Director, CIO).
• Crisis Duties: Assesses high-level impact; manages brand reputation, media, and public relations; declares enterprise-level disaster; authorizes extraordinary financial expenditures; manages stakeholder communication.

6. Incident Response / Business Continuity Teams (IRT / BCT / Tactical / Silver)

• Profile: Mid-level operational leaders, facilities managers, IT leads, supply chain managers.
• Crisis Duties: Executes tactical recovery workflows; coordinates physical relocation to alternate sites; manages IT disaster recovery failover; coordinates critical resource distribution.

7. Emergency Response Teams (ERT / Operational / Bronze)

• Profile: On-site first responders, floor wardens, security officers, first aiders.
• Crisis Duties: Immediate life safety protection, facility evacuation, headcounts, initial hazard containment, interfacing with municipal emergency services (fire, police, medical).

---

3. Defining Authority Levels and Emergency Delegations

One of the most dangerous operational failure modes in a crisis is decision paralysis caused by unclear authority. Top Management must pre-define and legally document specific authority delegations before an incident occurs:

               +---------------------------------------------+
               |      CRITICAL EMERGENCY AUTHORITY LEVELS    |
               +---------------------------------------------+
                                      |
        +-----------------+-----------+-----------+-----------------+
        |                 |                       |                 |
        v                 v                       v                 v
+---------------+ +---------------+       +---------------+ +---------------+
| DISASTER      | | RECOVERY      |       | EMERGENCY     | | SUCCESSION &  |
| DECLARATION   | | CONTRACT      |       | FINANCIAL     | | ALTERNATES    |
| AUTHORITY     | | INVOCATION    |       | DELEGATION    | | (2/3-DEEP)    |
+---------------+ +---------------+       +---------------+ +---------------+

1. Authority to Declare a Disaster / Crisis

• Thresholds & Criteria: Clearly specified operational triggers (e.g., facility inaccessible for >2 hours, core ERP offline for >1 hour, physical safety hazard).
• Designated Primary & Alternates: The primary authority (e.g., Incident Commander or COO) and named alternates (e.g., Deputy Operations Director) empowered to declare a disaster if the primary is unreachable within 15 minutes.

2. Authority to Invoke Third-Party Recovery Contracts

• Contract Invocations: Formal authority to trigger contractual clauses with commercial hot-site providers, mobile recovery trailer services, external cybersecurity incident response retainers, or emergency cloud burst capacity.
• Financial Implications: Recognizing that invoking standby contracts often triggers non-refundable declaration fees (e.g., $25,000–$100,000), authorizers must be pre-cleared to execute these without board approval.

3. Emergency Financial Delegations

• Standard procurement approval chains (which may require multiple executive approvals over several days) must be bypassed during a declared disruption.
• Pre-Authorized Emergency Limits: e.g., CMT Lead up to $500,000; Incident Commander up to $100,000; Facility Lead up to $25,000 for emergency lodging, equipment rental, or emergency supplies.

4. Succession Planning (The Rule of Two/Three)

• Redundancy Principle: Every critical BCMS role (Governance, Lead Implementer, CMT, IRT) must have at least two designated, trained alternates (Primary, Secondary, Tertiary).
• Competence Alignment: Alternates must undergo the same training, hold the same system access rights, and participate in annual exercises.

---

4. The 3-Tier Incident Management Hierarchy

ISO 22301 (alongside ISO 22320 for incident management) advocates a modular, three-tier response hierarchy, commonly referred to as the Gold-Silver-Bronze or Strategic-Tactical-Operational structure:

---

5. Comprehensive RACI Matrix across the BCMS Lifecycle

A RACI Matrix eliminates role ambiguity by categorizing participation across five key stakeholder groups:

• R (Responsible): The "doer" who completes the task.
• A (Accountable): The sole decision-maker who holds final ownership (only one 'A' per task).
• C (Consulted): The subject matter expert whose input is sought.
• I (Informed): The stakeholder kept updated on progress.

| ISO 22301 Lifecycle Stage / Activity | Top Management | BC Steering Comm. (BCSC) | Lead Implementer / BC Mgr | Departmental Coordinators | Internal Audit Team | | :--- | :---: | :---: | :---: | :---: | :---: | | | Context & Scope Definition (Clauses 4.1, 4.3) | A | C | R | C | I | | Establishing the BC Policy (Clause 5.2) | A | C | R | I | I | | Resource Allocation & Budgeting (Clause 5.1c) | A | C | R | I | I | | Conducting BIA & Risk Assessment (Clause 8.2) | I | A | R | R | I | | Designing Continuity Strategies (Clause 8.3) | I | A | R | C | I | | Developing BCPs & DRPs (Clause 8.4) | I | I | A | R | I | | Planning & Conducting Exercises (Clause 8.5) | I | C | A / R | R | I | | Monitoring, Measurement & KPIs (Clause 9.1) | I | A | R | C | I | | Planning & Conducting Internal Audits (Clause 9.2)| I | I | I | C | A / R | | Conducting Management Review (Clause 9.3) | A | R | R | I | I | | Managing Corrective Actions (Clause 10.1) | I | A | R | R | I |

---

6. Implementation Scenario: LogiTrans Global's Role Clarification

Context

LogiTrans Global, an international freight logistics firm, experienced a severe ransomware attack that encrypted their central dispatch platform. During the first four hours of the incident, complete operational paralysis ensued:

1. The IT Systems Lead hesitated to disconnect the primary datacenter network because only the CIO had the formal authority to shut down core operations, and the CIO was on an international flight.
2. The Customer Support Director hired a temporary call center on emergency credit, only to have the expense rejected by Procurement.
3. The local facility supervisor refused to invoke the secondary hot-site contract because declaration fees ($50,000) exceeded their personal signing authority.

Remediation Action Plan

Following a post-incident investigation, the Lead Implementer restructured Clause 5.3 roles and authorities:

1. Pre-Delegated Disaster Declaration: Formalized an Emergency Declaration Matrix empowering the Incident Commander (or designated on-duty alternate) to isolate networks and invoke secondary sites if recovery exceeds 60 minutes.
2. Emergency Financial Authority: Implemented pre-approved emergency spending limits ($100,000 for Tactical Leads; $500,000 for CMT) activated automatically upon formal disaster declaration.
3. Succession Redundancy: Established a 3-deep alternate structure for all CMT and Tactical roles, complete with automated emergency notification escalation if the primary does not respond within 10 minutes.

Outcome

In the subsequent annual cyber crisis simulation, when the primary Incident Commander was simulated as unavailable, the secondary alternate assumed command within 5 minutes, declared the disruption, engaged the standby incident response retainer, and successfully authorized emergency cloud capacity within the target 2-hour RTO.

---

7. Exam Warning Traps & Implementation Pitfalls

[!WARNING] PECB Exam Trap 1: The Single-Point-of-Failure Leader. If an exam scenario describes a BCMS where all emergency decisions, plan activations, and declarations rest solely on one individual without documented, trained alternates, this represents a severe nonconformity under Clause 5.3 and Clause 8.4.

[!CAUTION] PECB Exam Trap 2: Misunderstanding the Role of Internal Audit in RACI. On the exam, remember that Internal Auditors must remain independent (Clause 9.2 / ISO 19011). An auditor can NEVER be Responsible (R) or Accountable (A) for designing, implementing, or operating the BCMS. They are strictly responsible for auditing the system.

[!NOTE] Command Structure Separation: Ensure clear separation between the Crisis Management Team (Strategic) dealing with enterprise reputation and media, and the Incident Response Team (Tactical) dealing with hands-on process restoration. Conflating these two leads to operational confusion during exercises and live crises.