Contracting the decision question and engagement boundary

A continuity engagement starts with an organizational decision, not a promise to produce a ready-made plan. A sponsor may ask for “guaranteed continuity and a file proving compliance with the standard.” That sentence contains three different requests: a desired service level during disruption, an advisory deliverable, and a conformity judgement that cannot follow merely from writing documents. Ask which service the sponsor is considering protecting, what interruption is tolerable for that service, and who can accept the remaining risk. If the decision owner is unidentified, do not invent one. Record the authority gap and make designation of an owner a condition for a recommendation.

At the opening meeting, separate organizational purpose, decision question, evidence scope, and limits of opinion. A regional distributor's purpose might be to fulfil hospital orders when its main site stops. An actionable question is: “Can current dispatch arrangements sustain a defined minimum of urgent orders during the first 24 hours of a main-site outage, and, if not, which feasible alternative should be funded?” Relevant evidence includes order logs, inventory capacity, carrier terms, access to an alternate warehouse, and records of previous transfers. The deliverable compares options under explicit assumptions. It is not a certificate of conformity with ISO 22301. This distinction identifies what can be shown, what remains a hypothesis, and what management must decide.

The consultant needs a sponsor who authorizes access, a service owner who explains operational consequences, and approval holders who can fund a change. Do not merge their authority. An IT manager may describe how long the ordering platform takes to restore but cannot alone decide how much delay in hospital supply is acceptable. A finance manager may set a spending limit but cannot by that fact establish that a manual dispatch method is safe or lawful in every jurisdiction. For each stakeholder, record the decision they can make, the evidence they hold, and when their confirmation is required. If accounts conflict, retain both with dates and context until tested; seniority is not a substitute for evidence.

Express scope in operational terms. Inclusion names the services, sites, time horizon, and relevant dependencies, including dependencies operated by another organization. Exclusions might cover local legal compliance review, penetration testing, or a certification audit. Excluding a supplier from organizational control does not remove its effect on delivery. The carrier remains a dependency in the analysis, while contract changes require the supplier relationship owner. Nor should an exclusion quietly hide a critical service. Tell the sponsor how the exclusion limits the conclusion and seek an informed decision on the boundary.

The engagement charter should grade evidence quality. Actual orders describe typical volume better than recollection, but the dataset may omit refused orders or unrecorded channels. A supplier proposal proves what it offers, not performance in a widespread incident. A successful daytime switch does not prove a night-shift switch time. Attach source, date, scope, caveat, and resolution owner to each significant assertion. Where decisive evidence is missing, write a conditional recommendation such as “test alternate-warehouse capacity for emergency orders before contracting” instead of stating unproven capability as fact.

A decision note should state the requested decision, service and minimum outcome to protect, scenarios to test, evidence present and missing, preliminary options, comparison criteria, approval authority, deliverable, and date. In this case, 92% same-day delivery does not prove that urgent orders are protected; the average combines categories with different consequences. Nor do 38 urgent cases prove that every delay originated at the warehouse. Match order identifiers, timestamps, and reasons for delay. Specify an evidence acceptance test: reconcile a defined sample of orders with delivery records, document outage periods, and have the service owner confirm the definition of “urgent.” If access is denied, restrict the opinion to evidence gaps and testable options.

Finally test whether the engagement is answerable. Can authorized evidence distinguish one option from another? Can the decision maker act on the result within the agreed period? Will a reader understand the opinion's limits? If any answer is no, amend the question or evidence access before starting impact analysis. ISO's public page describes the broad BCMS framework, while BCI's public overview describes system establishment, analysis, solution design, and validation practices. Neither public overview supplies every requirement of a paid standard or authority for the consultant to declare conformity. This lesson therefore teaches a traceable advisory decision method, not a reproduction of protected clauses or preparation for an external credential.