An assessment is only as good as the people carrying it out. Whatever framework a scheme applies, the score in the end reflects the judgement of a small panel of practitioners reading evidence and asking questions — which is why the composition of that panel deserves as much scrutiny as the standard itself.
A well-constructed panel spans safety and life-support, business continuity, digital operations and cybersecurity, supply chain, and physical security, because those domains fail in different ways and a specialist in one rarely spots the gaps in another. Panels are usually assembled per engagement from a wider pool, with a lead assessor responsible for consistency of scoring across organisations.
A typical engagement produces the following deliverables:
Continuity, crisis management and recovery
Reviews business impact analyses, recovery time and recovery point objectives, dependency mapping and the exercise record. Looks for plans that have actually been tested under realistic conditions rather than reviewed on paper, and for evidence that findings from exercises were closed out.
People resilience and emergency response
Examines how an organisation locates, warns and accounts for its people during an incident, including travellers and lone workers. Contact data quality, escalation paths and the ability to confirm who is safe are usually more decisive than the technology in use.
IT service continuity and incident response
Assesses on-call structures, major-incident process, integration between monitoring and notification, and the honesty of post-incident reviews. A mature organisation can show the time from detection to the right people being engaged, and can show it improving.
Physical security, intelligence and travel risk
Looks at risk intelligence sources, how threat information reaches decision-makers, site and asset protection, and the interface between security operations and the wider crisis structure.
Third parties, logistics and single points of failure
Maps critical suppliers and sites, tests whether alternatives are real rather than theoretical, and checks that disruption to a tier-two supplier would actually be noticed before it reached production.
Consistency, scoring and the final report
Chairs the panel, keeps scoring consistent between organisations and across assessment cycles, resolves disagreements between specialists, and owns the written findings. The lead assessor is also responsible for saying plainly where evidence was thin.
Credible assessment panels are built from practitioners rather than auditors alone. The people who add the most value have run an incident themselves, at least once, badly enough to remember it. That experience is what separates a useful finding — “your escalation works until the person named in it is on a plane” — from a checklist observation that a document exists.
In practice, an organisation choosing between certification schemes should ask three questions about the panel. What operational background do the assessors have, and in which sectors? Is the same panel scoring every organisation, or does scoring drift between engagements? And can the scheme show what proportion of assessments result in findings that the organisation disputes — a scheme where nobody ever disagrees is not assessing very hard.
Independence matters as much as expertise. Where the body running the assessment also sells the tooling an organisation is being assessed on, that conflict should be disclosed and managed, and the assessment criteria should be published in enough detail that a third party could reach the same score from the same evidence.
