Why Future Managers Should Understand ISO 22301: Business Continuity Is a Management Responsibility

Preparing management students for a world where disruptions have become part of everyday business.

10/19/20267 min read

Most management students learn how organizations plan, set objectives, allocate resources, manage employees and measure performance.

These are essential skills. But there is another question future managers must be prepared to answer:

What happens when normal business operations suddenly become impossible?

A company loses access to its systems. A supplier stops delivering critical materials. A severe storm closes the workplace. A cyberattack interrupts customer transactions. A major service provider experiences an outage.

Who decides what happens next?

In many organizations, the answer is not immediately clear.

Employees may turn to IT, facilities, security or senior management. Each department may have its own procedures, but the organization still needs someone who understands business priorities, coordinates the response and makes decisions.

This is why business continuity management deserves a stronger place in management education.

One international standard provides a particularly useful framework: ISO 22301 - Security and resilience: Business continuity management systems - Requirements.

What Is ISO 22301?

ISO 22301 establishes requirements for a Business Continuity Management System (BCMS).

It helps organizations prepare for disruptive incidents, maintain essential activities during interruptions and recover in a structured manner.

The current published edition is ISO 22301:2019, with Amendment 1 issued in 2024 addressing climate change considerations. A future revision is under development.

Unlike standards focused specifically on information technology or cybersecurity, ISO 22301 addresses continuity across the organization.

It considers the people, processes, facilities, suppliers, information and technologies needed to deliver products and services.

Its application is not restricted to large corporations or particular industries.

Manufacturers, financial institutions, hospitals, universities, retailers, logistics companies and public-sector organizations can all benefit from its principles.

An organization does not necessarily need ISO 22301 certification to apply its concepts. However, understanding the standard helps managers recognize what a systematic approach to business continuity should include.

Why Future Managers Need This Knowledge

Business continuity has traditionally been associated with emergency planning, security departments or specialized risk management functions.

That view is too narrow.

Consider a retail company whose payment processing system becomes unavailable.

The technical team is responsible for investigating the system failure. But the store manager must decide whether sales can continue, how employees should respond to customers, whether alternative payment methods are available and when the situation requires escalation.

A university experiencing a major technology outage faces different problems.

Faculty may lose access to teaching platforms. Students may be unable to submit assignments. Administrative employees may have difficulty accessing records.

The response requires decisions about academic schedules, communication, temporary procedures and priorities.

Neither situation can be resolved through technical expertise alone.

Managers must understand how to protect the delivery of essential services while an underlying problem is being addressed.

ISO 22301 provides a useful foundation for developing that capability.

Seven Lessons Future Managers Can Learn From ISO 22301

1. Understand Which Business Activities Are Critical

Not all business activities have the same importance during a disruption.

ISO 22301 emphasizes Business Impact Analysis (BIA), a process that identifies activities supporting products and services and assesses the consequences of their interruption over time.

A manager should be able to answer:

Which activities must continue?
How long can each activity remain interrupted?
What would happen to customers, employees or suppliers?
Which resources are essential?
What must be restored first?

For example, if a financial institution loses several applications, restoring the employee travel reimbursement system may be less urgent than restoring payment processing.

Business priorities must guide recovery decisions.

Management lesson: Learn to distinguish critical operations from activities that can temporarily be delayed.

2. Understand Operational Dependencies

Modern organizations depend on complex relationships involving employees, technology, buildings, information and external service providers.

A company may appear fully operational while depending on one supplier that has no reliable backup.

A hospital may have alternative electricity arrangements but remain vulnerable to an interruption in a critical medical supply.

A manager needs to understand how dependencies affect the ability to continue delivering services.

This requires cooperation across departments.

Procurement understands supplier arrangements. IT understands systems. Human resources understands workforce availability. Operations understands essential processes.

Management must connect that information.

Management lesson: A business continuity plan is only as reliable as the assumptions about the resources it depends on.

3. Prepare to Make Decisions Under Pressure

During a serious disruption, managers rarely have complete information.

They may need to decide whether to suspend operations, relocate employees, activate alternative arrangements or communicate with customers before the full cause of an incident is known.

The quality of those decisions depends partly on preparation.

ISO 22301 emphasizes assigned responsibilities, response structures, documented procedures and coordinated communication.

Managers should know their decision-making authority and understand when issues must be escalated.

They should also know how to communicate when normal channels are unavailable.

Management lesson: Crisis decision-making should not begin with an argument over who has authority to act.

4. Recognize That Business Continuity Is About People

Technology failures receive considerable attention, but people remain central to operational recovery.

Employees need clear instructions, appropriate training and reliable communication.

Managers must consider workforce availability, safety, workload and the practical difficulties employees may encounter during disruptions.

For example, a company may have a perfectly functional remote-working infrastructure but still be unable to maintain essential operations if critical employees are unavailable or cannot access necessary information.

Continuity planning must therefore consider human capacity as well as systems and facilities.

Management lesson: The effectiveness of a continuity plan depends on employees understanding their responsibilities and having the resources to carry them out.

5. Learn How to Test Business Continuity Arrangements

An approved business continuity plan does not prove that an organization is prepared.

Recovery arrangements must be exercised and evaluated.

ISO 22301 requires a structured exercise programme to validate business continuity strategies and solutions.

A manager may participate in tabletop exercises, simulated operational disruptions or recovery tests.

Consider a logistics company that plans to redirect orders to another warehouse if its primary distribution centre closes.

Has the alternative warehouse been tested? Can it handle the additional volume? Do employees know the process? Can suppliers deliver to the alternative location?

A written procedure cannot answer these questions.

Management lesson: Preparedness must be demonstrated through practical exercises, not assumed from documentation.

6. Connect Business Continuity With Reputation and Stakeholder Confidence

A disruption can have consequences long after normal operations resume.

Customers may question the organization's reliability. Employees may lose confidence in management. Suppliers may reconsider contractual arrangements. Regulators may examine the adequacy of operational controls.

How managers respond can influence the severity of these consequences.

Timely communication, reasonable decisions, transparent escalation and coordinated recovery help protect stakeholder relationships.

Poor communication can turn a manageable interruption into a larger reputational problem.

Management lesson: Business continuity is closely connected to ethical management, stakeholder responsibilities and organizational reputation.

7. Treat Business Continuity as a Continuous Management Process

A continuity plan cannot remain unchanged while the organization evolves.

New technology, outsourcing arrangements, acquisitions, staffing models and business locations can all alter operational dependencies.

ISO 22301 emphasizes performance evaluation, management review and continual improvement.

Managers should learn to review continuity arrangements when important business changes occur.

Lessons from actual incidents and exercises should lead to improvements in procedures, resources and responsibilities.

Management lesson: Business continuity is an ongoing management discipline, not an annual paperwork exercise.

A management student does not need to become an ISO auditor. But understanding how the standard works can strengthen the ability to manage organizations responsibly.

ISO 22301 and the Growing Importance of Digital Resilience

Digital transformation has made business continuity more complex.

Organizations increasingly depend on cloud computing, interconnected systems, external technology providers and automated processes.

These developments create efficiency but also introduce additional vulnerabilities.

The EU's Digital Operational Resilience Act (DORA), which became applicable in January 2025, reflects this growing concern within the financial sector.

DORA focuses specifically on digital operational resilience for covered financial entities. ISO 22301 has a broader business continuity scope and can be used across industries.

The two frameworks are not interchangeable, but they share an important principle.

Organizations must understand critical activities, prepare for disruptions, establish accountability and test their ability to recover.

For future managers, this means resilience should be understood as part of business performance rather than only a technical or compliance issue.

Bringing ISO 22301 Into Management Education

Professors do not need to create an entirely new course to introduce business continuity standards.

ISO 22301 can complement existing lectures, assignments and case studies.

For example, students could be presented with a fictional company that experiences a prolonged outage affecting its online ordering system.

Working in groups, students would identify its critical activities, assess dependencies, determine recovery priorities, assign responsibilities and prepare a basic response plan.

They could then receive an additional development: the company's main technology provider cannot restore services within the expected timeframe.

Students would need to revise their decisions and explain how they would communicate with employees, customers and senior leadership.

This type of exercise helps connect strategic planning, operations, leadership, risk management and communication.

It also introduces students to the realities of decision-making when established procedures are no longer sufficient.

The textbook Practical Management: A Comprehensive Guide to Change in the 21st Century provides a useful foundation for introducing these ideas into management education.

Chapter 11 — Sustainability, Reputation and Crisis Management is particularly relevant.

Section 11.4, Crisis Management, addresses the management of disruptive events, while Section 11.4.2, Business Continuity Planning (BCP) and Crisis Management, connects crisis response with the continued delivery of essential business activities.

Section 11.4.3, Business Continuity Plan (BCP) Template, gives students an opportunity to work with the practical structure of a continuity plan.

These sections can be complemented by Chapter 8 - Risk Management: Anticipating and Mitigating Challenges, which provides the broader risk management context.

Together, these chapters offer a way to bridge management theory, practical planning and the internationally recognized principles of ISO 22301.

A useful classroom assignment would be to ask students to prepare a continuity plan using the textbook's BCP template, then compare their proposed arrangements with the main elements of ISO 22301.

Students would learn not only how to prepare a plan, but also why business impact analysis, management accountability, continuity strategies, exercises and continual improvement matter.

ISO 22301 is not presented as a substitute for management education. It provides an additional professional reference that can make established management subjects more practical and relevant.

Preparing Managers for the Unexpected

Future managers will work in organizations where disruption is inevitable.

Technology will change. Suppliers will fail. Natural events will interrupt operations. People will make mistakes.

What matters is how well organizations prepare, how effectively managers respond and how quickly essential operations can recover.

This is why business continuity should be part of a manager's professional knowledge.

Understanding ISO 22301 does not mean every graduate must become a business continuity specialist.

It means managers should recognize continuity risks, understand their responsibilities and know how to contribute to organizational resilience.

A successful manager should know how to achieve business objectives. A well-prepared manager should also know how to protect those objectives when normal operations are disrupted.

That is a valuable addition to modern management education.