According to ISO 22301:2019, Clause 6.2, the organization must establish business continuity objectives at relevant functions and levels. The business continuity objectives must be consistent with the business continuity policy, measurable, monitored, communicated, and updated as appropriate. The organization must also retain documented information on the business continuity objectives. One of the elements that should be included in the documented information is the timescale for the task completion. The timescale is the period of time within which the task or activity must be completed, such as hours, days, weeks, or months. The timescale helps to define the expected performance and results of the business continuity management system (BCMS), and to evaluate the progress and effectiveness of the implementation and operation of the BCMS. References: ISO 22301:2019, Clause 6.2; ISO 22301 Auditing eBook, Chapter 4.2.2.

Scope is the term that defines the area of operation in which the task and its activities should be performed, as described in ISO 22301. Scope is one of the key elements of a business continuity plan (BCP), which is a documented information that specifies the procedures and resources needed to manage a disruptive incident and ensure the continuity of the organization’s critical functions. Scope helps to define the boundaries and applicability of the BCP, as well as the roles and responsibilities of the involved parties. Scope also helps to ensure the consistency and compatibility of the BCP with the organization’s business continuity objectives and strategies. Scope is one of the key requirements of ISO 22301, as it provides the basis for planning, implementing, monitoring, reviewing, and improving the business continuity management system (BCMS). References: ISO 22301 Auditing eBook, page 36 1; ISO 22301:2019, clause 8.4.2 2

 The document that is owned by executive management and sets the purpose of BCM in an organization is the Business Continuity Policy. The Business Continuity Policy is a high-level document that defines the scope, objectives, principles, and roles and responsibilities for business continuity management within the organization. It also demonstrates the commitment of top management to support and continually improve the BCMS. The Business Continuity Policy is one of the mandatory documents required by ISO 22301, the international standard for BCMS12.

The other options are not correct because they are not documents that are owned by executive management and set the purpose of BCM in an organization. A Business Process Policy is a document that describes the procedures and rules for performing a specific business process, such as procurement, sales, or accounting. A Register is a document that records and tracks the status of certain items, such as risks, incidents, or assets. A Worksheet is a document that contains data and calculations, such as a spreadsheet or a form.

References: 1: ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements, 5.3 2: ISO 22301 Auditing eBook, Chapter 2.2.2