ISO 22301 Certification for Business Continuity Management Systems
Independent ISO 22301 certification of business continuity management systems: two-stage audit, three-year certificate, annual surveillance audits.
ISO 22301 is the international standard for business continuity management systems (BCMS), and itmad audits BCMSs for organisations that must keep delivering after a disruption. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits.
ISO 22301 in brief
The standard sets requirements for planning, establishing and maintaining an organisation's ability to keep delivering products and services at an acceptable level after a disruption. A certificate is independent confirmation that the BCMS works.
Who the standard is for
Customers and supplier programmes often ask for independent proof of a BCMS. ISO 22301 applies to any organisation that must keep delivering products and services after a disruption, including:
- Banking, insurance and financial services subject to regulatory continuity expectations
- Telecommunications, data centres and IT service providers
- Healthcare providers and laboratories
- Oil, gas and utilities operators
- Logistics, ports and aviation services
- Government entities and their contracted service providers
- Any organisation named in a client contract as continuity-critical
What auditors examine
- Scope and contextThe organisation, its interested parties, and the activities, locations and services inside the BCMS scope, drawn to reflect what needs protecting and not what is convenient to certify.
- Business impact analysisPrioritised activities, the time within which each must resume (the recovery time objective) and the point to which each must be recovered (the recovery point objective). Auditors examine it most closely, because every continuity strategy depends on it being accurate.
- Risk assessmentThe disruptions that prioritised activities are exposed to, with the likelihood and impact of each evaluated so that strategies are proportionate.
- Continuity strategies and solutionsThe resources, procedures and capabilities needed to recover within the stated objectives, including redundancy, alternate sites, supplier alternatives and manual workarounds.
- Continuity plansDocumented plans for incident response, communication, escalation and recovery, detailed enough to be followed under pressure by someone who did not write them.
- Exercising and testingPlans proven by tabletop exercises and operational tests, with records of what was tested, what was found and what changed as a result.
- Warning and communicationArrangements for detecting disruption early and informing staff, customers and authorities at the right time.
- Performance evaluationMeasurement of how well the BCMS works, internal audit, and management review with decisions recorded and acted on.
- Continual improvementCorrective action on the findings of exercises, audits and real incidents, with verification that the changes were effective.
The business impact analysis in practice
The business impact analysis is where most continuity programmes either work or fail. It makes an organisation state which activities genuinely cannot stop, how long each can be interrupted before the consequences become unacceptable, and what recovery really depends on. Dependencies are often not where the organisation assumed: IT systems that seem critical turn out to be secondary, while manual processes or supplier relationships that seem routine turn out to be the real constraint.
Where ISO 22301 audits find gaps
Exercising is the most common gap: plans written but never tested, or tabletop exercises that showed a plan looked reasonable without proving that it works. The second is a business impact analysis completed at implementation and never updated as the organisation changed. The third is continuity plans that say what must recover but not the specific resources, contacts and decision authorities needed to do it, detail that only matters when a plan is followed under pressure.
How an itmad audit runs
Stage 1 reviews the documented BCMS, confirms the scope and assesses readiness, examining the business impact analysis, the risk assessment and the continuity strategies. Stage 2 verifies implementation and effectiveness: the continuity plans, the records of exercises that were actually carried out, and whether people can describe their roles in an incident.
The certificate cycle
An ISO 22301 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years and recertification before it expires.
Independence
ISO/IEC 17021-1 does not allow a certification body to design, implement or consult on the management system that it certifies, and itmad does not. itmad provides the audit and the certification decision and, if wanted, a pre-assessment that identifies gaps against ISO 22301 without telling the organisation how to close them.
What itmad delivers
- A Stage 1 report on readiness gaps, issued before the main audit
- A Stage 2 audit report whose findings rest on objective evidence
- Nonconformities graded by severity, each with a defined response time
- A certificate of registration naming the certified scope and locations
- The certification mark, for use under itmad's mark and seal policy
- Annual surveillance audits and reports across the three-year cycle
Frequently asked questions
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems. It sets requirements for planning, establishing and maintaining an organisation's ability to keep delivering products and services at an acceptable level after a disruption.
What is a business impact analysis?
A business impact analysis identifies an organisation's prioritised activities, the time within which each must resume and the point to which each must be recovered. Auditors examine it most closely, because every continuity strategy depends on it being accurate.
What does ISO 22301 require for exercising?
Plans must be proven through tabletop exercises and operational tests. The records must show what was tested, what was found and what was changed as a result.
What are the most common ISO 22301 audit findings?
Plans that were written but never tested come first. A business impact analysis never updated after implementation comes second, and continuity plans lacking specific resources, contacts and decision authorities come third.
How does an ISO 22301 audit work?
itmad audits in two stages. Stage 1 reviews the documented BCMS, the business impact analysis, the risk assessment and the continuity strategies. Stage 2 verifies implementation, including the records of exercises actually conducted.
How long does an ISO 22301 certificate last?
An ISO 22301 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years. Recertification is completed before the certificate expires.