The four phases of the Deming Cycle are Plan, Do, Check, and Act. The Deming Cycle, also known as

the PDCA cycle, is a four-step model for continuous improvement of processes, products, or services.

The cycle was developed by Dr. W. Edwards Deming, a pioneer of quality management, and is based

on the scientific method of problem-solving. The four phases of the Deming Cycle are1:

Plan: Identify the problem or opportunity, analyze the root causes, and establish the objectives and

measures for improvement.

Do: Implement the planned solution, test the results, and collect data for evaluation.

Check: Compare the actual results with the expected results, identify the gaps and deviations, and

analyze the effectiveness and efficiency of the solution.

Act: Take corrective or preventive actions to close the gaps and prevent recurrence, standardize the

solution, and communicate and document the lessons learned. The Deming Cycle is a dynamic and

iterative process that can be applied to any type of process, product, or service. The cycle helps to

ensure that the improvement is based on facts and data, and that the improvement is monitored and

evaluated for further improvement. The Deming Cycle is also aligned with the structure and content

of ISO 22301, the international standard for business continuity management systems (BCMS). ISO

22301 follows the Plan-Do-Check-Act approach to establish, implement, maintain, and improve a

BCMS that enables an organization to prepare for, respond to, and recover from disruptive

incidents2. Reference:

PDCA (Plan-Do-Check-Act) Cycle in ISO 9001 Requirements - Advisera

ISO 22301:2019 - NQA, page 9

Governance is the initiative of Business Continuity Management that is a regulatory system that

controls an organization and its activities. Governance refers to the set of policies, processes, roles,

and responsibilities that define how an organization is directed and managed. Governance ensures

that the organization’s objectives, strategies, and operations are aligned with the expectations and

needs of its stakeholders, such as customers, employees, regulators, and shareholders. Governance

also provides oversight and accountability for the organization’s performance, risks, compliance, and

continuity.

Business Continuity Management (BCM) is a key component of governance, as it enables the

organization to protect its critical assets and functions, and to respond and recover from disruptive

incidents. BCM helps the organization to maintain its reputation, resilience, and value in the face of

uncertainty and crisis. BCM also supports the organization’s compliance with relevant laws,

regulations, standards, and best practices, such as ISO 22301, the international standard for business

continuity management systems.

Therefore, governance is the initiative of Business Continuity Management that is a regulatory

system that controls an organization and its activities, by providing direction, oversight, and

accountability for the organization’s continuity and resilience. Reference:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management, Section 1.1:

What is Business Continuity Management?, Page 4

ISO 22301 Auditing eBook, Chapter 2: Introduction to ISO 22301, Section 2.1: What is ISO 22301?,

Page 9

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.1: Context

of the Organization, Page 13

ISO 22301 Auditing eBook, Chapter 3: Business Continuity Management System, Section 3.2:

Leadership, Page 16

The Do phase in the PDCA cycle consists of operation, which means implementing and operating the

business continuity policy, controls, processes, and procedures that have been planned in the

previous phase. The Do phase also involves establishing the necessary resources, competencies,

awareness, communication, and documentation to support the effective operation of the business

continuity management system (BCMS). The Do phase aims to ensure that the organization is

prepared to respond to and recover from disruptive incidents in a timely and effective

manner. Reference: ISO 22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.

A quality audit verifies that the BCM programme activities are adequately managed through

conformance to the BCMS requirements, policies, and procedures. It also evaluates the effectiveness

and efficiency of the BCMS processes and the continual improvement of the BCMS performance. A

quality audit can be internal or external, depending on the source of the audit. Reference: ISO 22301

Auditing eBook, page 19 1; ISO 22301:2019, clause 9.2 2

The Incident Management Structure (IMS) is a framework for organizing and managing the response

to a disruptive incident. The IMS defines three levels of management activities: strategic, tactical,

and operational. The strategic level is responsible for setting the overall direction and objectives of

the response, as well as allocating resources and coordinating with external stakeholders. The

tactical level is responsible for implementing the strategic decisions and managing the operational

teams. The tactical level also monitors the situation and reports to the strategic level. The

operational level is responsible for executing the specific tasks and actions required to achieve the

objectives of the response. The operational level also provides feedback to the tactical level on the

progress and issues encountered. Reference:

ISO 22301 Auditing eBook, Chapter 4: Incident Response and Recovery, Section 4.2: Incident

Management Structure1

ISO 22320:2018(en), Security and resilience — Emergency management — Guidelines for incident

management2

The Check phase of the PDCA cycle is the phase that determines potential issues pertaining to the

management of the BCMS. The Check phase involves monitoring and evaluating the performance

and effectiveness of the BCMS and identifying any gaps, nonconformities, risks, or opportunities for

improvement. The Check phase also involves collecting and analyzing data and information related

to the BCMS, such as the results of audits, reviews, tests, exercises, surveys, and feedback. The Check

phase provides valuable input for the Act phase, where corrective and preventive actions are taken

to address the issues and improve the BCMS. Reference: : ISO 22301 Auditing eBook, page 11 : ISO

22301:2019, clause 9.1 : Business continuity and ISO 22301 - Qudos : ISO 22313:2020(en), Security

and resilience ? Business continuity …

A formal management system is a type of management system that provides the means for

organizations to improve internal controls and management competence. A formal management

system is a documented system that defines the policies, objectives, processes, procedures, roles,

responsibilities, and resources for managing a specific aspect of the organization’s performance. A

formal management system is based on a recognized standard or framework that specifies the

requirements and best practices for achieving the desired outcomes and performance. A formal

management system also includes mechanisms for monitoring, measuring, reviewing, and improving

the system’s effectiveness and efficiency. A formal management system helps the organization to

demonstrate its commitment and capability to meet the expectations and needs of its stakeholders,

such as customers, regulators, employees, suppliers, etc. A formal management system also helps

the organization to identify and manage the risks and opportunities that may affect its performance

and continuity. Examples of formal management systems are ISO 22301 for business continuity

management, ISO 9001 for quality management, ISO 14001 for environmental management, ISO

27001 for information security management, etc. Reference:

ISO 22301 Auditing eBook, Chapter 1: Introduction to Business Continuity Management Systems,

Section 1.1: Management System Concepts1

What is a management system?2

ISO - Management system standards3

Crisis communication is the process of managing the flow of information during and after a crisis

situation that threatens the reputation, operations, or survival of an organization. It aims to protect

the organization’s shareholder value and long-term reputation by maintaining trust and confidence

among its stakeholders. According to the ISO 22301 Auditing eBook, crisis communication is one of

the key elements of a business continuity management system, as it enables the organization to

communicate effectively with its internal and external parties, such as employees, customers,

suppliers, media, regulators, and the public. Effective crisis communication can help the organization

to minimize the negative impacts of a crisis, restore normal operations as soon as possible, and

enhance its resilience and reputation in the long run. Reference: ISO 22301 Auditing eBook, pages

16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, and 27.

Adopting the BCMS optimizes the organization’s business continuity capability by enabling it to

identify, prevent, prepare for, respond to, and recover from disruptive events. The BCMS provides a

systematic approach to plan, implement, operate, monitor, review, maintain, and improve the

organization’s ability to protect its critical functions and deliver its products and services at an

acceptable level of performance during and after a disruption. The BCMS also helps the organization

to enhance its resilience, reduce its risks, improve its reputation, and increase its customer

satisfaction. Reference: ISO 22301:2019, Clause 1; ISO 22301 Auditing eBook, Chapter 1.1.

The Do step in the PDCA cycle implements the previous selected controls to meet the control

objectives. According to the ISO 22301 Auditing eBook, the Do step involves implementing and

operating the business continuity policy, controls, processes, and procedures that have been planned

in the previous step. The Do step also includes establishing the necessary resources, competencies,

awareness, communication, and documentation to support the effective operation of the business

continuity management system (BCMS). The Do step aims to ensure that the organization is prepared

to respond to and recover from disruptive incidents in a timely and effective manner. Reference: ISO

22301 Auditing eBook, pages 9, 10, 11, 22, 23, and 24.