4.2 Competence, Training, and Awareness

4.2 Competence, Training, and Awareness

Executive Summary: A Business Continuity Management System is only as resilient as the people who design, maintain, and execute it. Clause 7 of ISO 22301:2019 establishes the operational support mechanisms necessary to sustain the BCMS. Top Management must provision adequate resources across five dimensions (Clause 7.1), systematically ensure and evaluate the competence of all personnel performing continuity roles (Clause 7.2), and build a pervasive culture of awareness so that every worker understands their role in safeguarding organizational resilience (Clause 7.3).

---

1. ISO 22301 Clause 7.1: Provisioning BCMS Resources

Under Clause 7.1, the organization must determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the BCMS. Resource determination is not a one-time project estimate; it is an ongoing governance obligation.

The Five Dimensions of BCMS Resources

+-------------------------------------------------------------------------+
|                    THE FIVE BCMS RESOURCE DIMENSIONS                    |
+-------------------------------------------------------------------------+
| 1. HUMAN RESOURCES      | Dedicated BC managers, crisis leads, champions|
| 2. FINANCIAL BUDGET     | OpEx for tooling, CapEx for recovery infra    |
| 3. PHYSICAL & LOGISTICAL| Alternate sites, EOC command facilities, power|
| 4. TECHNOLOGICAL & ICT  | Automated mass notification, cloud DR, backups|
| 5. KNOWLEDGE & TIME     | Operating time for drills, TNA, documentation |
+-------------------------------------------------------------------------+

1. Human Resources: Defining appropriate staffing levels, ensuring backup personnel (deputies) for all critical recovery roles, and securing specialized external expertise where internal capacity is insufficient.
2. Financial Capital: Securing dedicated operational expenditure (OpEx) for annual training, certification audits, software licensing, and capital expenditure (CapEx) for redundant equipment and recovery facilities.
3. Physical & Logistical Infrastructure: Emergency Operations Centers (primary and secondary EOCs), backup power generation (generators, UPS), mobile recovery units, and emergency survival supplies.
4. Technology & Communications: Redundant telecommunications lines, out-of-band satellite/cellular communications, enterprise mass notification systems (ENS), and secure off-site data repositories.
5. Organizational Knowledge & Operating Time: Ensuring that business unit personnel are formally allocated working hours (e.g., 5–10% FTE) away from their daily operational duties to participate in BIA data collection, plan maintenance, and multi-hour exercise simulations.

---

2. ISO 22301 Clause 7.2: The Competence Lifecycle

Clause 7.2 focuses on ensuring that individuals performing work under the organization's control who affect business continuity performance possess the necessary competence. In ISO terminology, competence is defined as the "ability to apply knowledge and skills to achieve intended results."

The Four Mandatory Requirements of Clause 7.2 (a-d)

+-------------------------------------------------------------------------+
|                     THE CLAUSE 7.2 COMPETENCE CYCLE                     |
+-------------------------------------------------------------------------+
|  7.2a: DETERMINE COMPETENCE                                             |
|  Identify required education, training, skills, and experience for each |
|  BCMS role (BC Manager, Crisis Team, Recovery Leads, First Responders). |
+-------------------------------------------------------------------------+
|  7.2b: ASSESS EXISTING COMPETENCE (TNA)                                 |
|  Compare existing workforce capabilities against requirements to identify|
|  competence gaps across departments.                                    |
+-------------------------------------------------------------------------+
|  7.2c: TAKE ACTION & EVALUATE EFFECTIVENESS                             |
|  Deliver training, mentoring, or hiring, and evaluate whether the action|
|  actually achieved the required capability.                             |
+-------------------------------------------------------------------------+
|  7.2d: RETAIN DOCUMENTED EVIDENCE                                       |
|  Maintain auditable records of qualifications, certifications, training |
|  logs, and exercise performance reviews.                                |
+-------------------------------------------------------------------------+

Conducting a Training Needs Analysis (TNA)

A Training Needs Analysis (TNA) is a structured, analytical investigation to determine the gap between current employee capabilities and the required competence standards defined in BCMS role profiles.

1. Step 1: Role Definition & Profiling: Identify every role influencing BCMS performance (e.g., Gold Strategic Crisis Team, Silver Tactical Recovery Team, Bronze Operations Leads, Internal Auditors, General Staff).
2. Step 2: Baseline Competence Mapping: Establish minimum qualification criteria across four foundational pillars: Education, Training, Skills, and Experience.
3. Step 3: Gap Assessment: Conduct interviews, review past exercise debriefs, and assess incident response logs to identify performance deficiencies.
4. Step 4: Training Programme Formulation: Design tailored learning roadmaps (e.g., PECB ISO 22301 Lead Implementer certification for BC Managers; media handling training for Crisis Spokespersons; fire warden drills for facility marshals).

BCMS Competence Matrix Blueprint

---

3. Evaluating the Effectiveness of Training (Clause 7.2c)

A critical audit requirement in ISO 22301:2019 is that organizations must evaluate the effectiveness of the actions taken to acquire competence. Simply presenting an employee sign-in sheet or course completion certificate proves attendance, not competence.

The Kirkpatrick Four-Level Evaluation Model for BCMS

Lead Implementers utilize the globally recognized Kirkpatrick framework to structure training effectiveness evaluations:

+-----------------------------------------------------------------------------+
|              KIRKPATRICK EVALUATION FRAMEWORK FOR BCMS                      |
+---+-----------------+-------------------------------------------------------+
| 1 | Reaction        | Participant satisfaction surveys post-training.       |
| 2 | Learning        | Post-course exams, quizzes, or skill demonstrations.  |
| 3 | Behavior        | Observed application of BCP procedures during drills. |
| 4 | Results         | Measurable reduction in RTO, drill error rates, etc.  |
+---+-----------------+-------------------------------------------------------+

• Level 1 (Reaction): Immediate post-training survey measuring whether participants found the material relevant and actionable.
• Level 2 (Learning): Post-training knowledge assessment (e.g., scoring ≥ 80% on a standardized crisis protocol examination).
• Level 3 (Behavior - Critical for ISO 22301): Evaluating whether personnel successfully execute their documented recovery responsibilities during simulated exercises (Clause 8.5) or real operational disruptions.
• Level 4 (Results): Quantifiable organizational impact—e.g., 40% faster crisis notification cascade, 100% compliance with BIA deadlines, or zero downtime violations during failovers.

---

4. ISO/TS 22330: Managing the People Aspects of Business Continuity

ISO/TS 22330 (Security and resilience — Business continuity management systems — Guidelines for people aspects of business continuity) provides vital supplementary guidance for Clause 7.2 and 7.3. While traditional disaster recovery focuses on IT servers and facilities, ISO/TS 22330 emphasizes that people are the most critical asset and the most vulnerable component during a crisis.

Key Principles of ISO/TS 22330 for Lead Implementers

1. Duty of Care & Life Safety: The safety and physical well-being of employees, contractors, and visitors always takes absolute priority over operational recovery.
2. Psychological & Emotional Resilience: Preparing personnel for the trauma, stress, and cognitive fatigue of acute crises. Establishing Employee Assistance Programmes (EAP), psychological first aid, and post-incident debriefings.
3. Family Support Considerations: Staff cannot focus on recovering company systems if their families are in danger. Organizations must provide emergency contact channels, shelter assistance, or flexible protocols during widespread regional disasters (e.g., hurricanes, pandemics).
4. Succession Planning & Deputy Coverage: Establishing a minimum "three-deep" succession rule for critical operational and crisis command roles to survive key-person incapacitation or mass absenteeism.

---

5. ISO 22301 Clause 7.3: Fostering Organizational Awareness

While Competence (7.2) applies to individuals performing specific continuity roles, Awareness (7.3) applies universally to all persons doing work under the organization's control (including full-time staff, part-time workers, temporary contractors, and outsourced personnel).

Mandatory Awareness Elements under Clause 7.3 (a-e)

Under ISO 22301:2019, every person must be aware of:

1. The business continuity policy (7.3a): Understanding what the policy stands for and where to access it.
2. Their contribution to the effectiveness of the BCMS (7.3b): Understanding how their individual role supports organizational survival and customer protection.
3. The benefits of improved business continuity performance (7.3c): Higher job security, enhanced customer trust, safer workplace, and business reputation.
4. The implications of not conforming with BCMS requirements (7.3d): Increased safety hazards, prolonged operational downtime, financial losses, regulatory fines, and disciplinary consequences for negligence.
5. Their role and responsibilities during disruptions (7.3e): Knowing exactly what to do when an evacuation alarm sounds, how to report an incident, where to report, and how to receive emergency notifications.

                 +---------------------------------------------+
                 |     MANDATORY AWARENESS ELEMENTS (7.3)      |
                 +---------------------------------------------+
                                        |
        +-----------------+-------------+-------------+-----------------+
        |                 |                           |                 |
        v                 v                           v                 v
+---------------+ +---------------+           +---------------+ +---------------+
|  BC POLICY    | | CONTRIBUTION  |           | IMPLICATIONS  | | ROLE DURING   |
|  AWARENESS    | | & BENEFITS    |           | OF NON-       | | DISRUPTIONS   |
|  (Clause 7.3a)| | (7.3b, 7.3c)  |           | CONFORMITY    | | (Clause 7.3e) |
|               | |               |           | (Clause 7.3d) | |               |
+---------------+ +---------------+           +---------------+ +---------------+

Developing an Enterprise Resilience Culture

Building awareness is an active, ongoing cultural campaign rather than a once-a-year compliance email.

• Onboarding Integration: 100% of new hires undergo mandatory business continuity awareness training within their first 30 days.
• Gamified Drills & Competitions: Hosting annual "Business Continuity Awareness Weeks" featuring desktop escape rooms, emergency kit giveaways, and tabletop trivia.
• Multi-Channel Micro-Learning: Distributing short, engaging 2-minute video snippets on intranet portals, dynamic digital signage across facilities, and regular phishing/safety simulation tests.
• Open Incident Reporting Culture: Encouraging employees to report near-misses, vulnerabilities, and operational bottlenecks without fear of retribution (psychological safety).

---

6. Worked Scenario: Apex Health Logistics

Background

Apex Health Logistics manages cold-chain pharmaceutical distribution to 250 hospitals across North America. During an unannounced winter blizzard, the company experienced a major delivery breakdown. Several regional warehouse supervisors failed to activate backup generators, drivers were unaware of alternate blizzard transport routes, and key managers could not log into the emergency notification tool, causing critical vaccine shipments to spoil.

Root Cause Analysis (Clauses 7.1, 7.2, 7.3)

The subsequent post-incident review revealed severe support failures:

• Competence Gap (7.2): Warehouse leads had never received hands-on generator switchover training; training records consisted solely of sign-in sheets from a lecture given 4 years prior.
• Awareness Failure (7.3): Drivers did not know the cold-chain emergency procedures and believed BCP was solely an executive management responsibility.
• Resource Shortfall (7.1): No secondary operator credentials were provided for the emergency notification system.

Remediation Action Plan

The Lead Implementer deployed an integrated Clause 7 overhaul:

1. Comprehensive TNA & Role Profiling (7.2a/b): Redefined competence profiles for all 18 warehouse directors and 300 logistics personnel. Implemented mandatory practical certification.
2. Hands-On Simulation & Kirkpatrick Level 3 Evaluation (7.2c): Replaced passive lectures with mandatory physical generator failover drills and cold-chain route re-routing exercises. Evaluated participants based on speed and operational accuracy.
3. Culture & Awareness Campaign (7.3): Launched mandatory mobile micro-learning modules for drivers, detailing their critical contribution to patient life safety and hospital continuity.
4. Documented Evidence (7.2d): Integrated training records, practical drill evaluation rubrics, and certifications into the central HR Information System.

Outcome

During the following winter season, when a major ice storm knocked out grid power across 3 states, Apex facilities achieved 100% generator failover within 8 minutes, rerouted all 45 critical medical consignments without temperature excursions, and maintained full hospital deliveries. The subsequent ISO 22301 surveillance audit praised Apex's competence framework as a model of organizational resilience.

---

7. Exam Warning Traps & Auditing Pitfalls

[!WARNING] PECB Exam Trap 1 (Training vs. Competence): On the exam, questions frequently test whether providing a training course is sufficient to satisfy Clause 7.2. It is NOT. ISO 22301 explicitly mandates that the organization must evaluate the effectiveness of the training taken (Clause 7.2c) and retain documented evidence (Clause 7.2d).

[!CAUTION] PECB Exam Trap 2 (Scope of Awareness): If a question asks whether external contractors, temporary warehouse workers, or outsourced call center agents need to be included in the BCMS awareness programme, the answer is YES. Clause 7.3 applies to "persons doing work under the organization's control", not merely permanent, salaried staff.

[!NOTE] Auditor Evidence Verification: During a certification audit, auditors will randomly sample employee names from organizational charts and interview them to test Clause 7.3 awareness. If an employee cannot explain what the BC policy is or what their role is during a building evacuation/disruption, a nonconformity will be cited.