ISO 22301 Audit — Business Continuity Management System
Assessment of resilience and recovery capabilities against critical disruptions.
ISO 22301:2019 establishes requirements for a business continuity management system, but the standard is frequently misunderstood. It is not about having a PDF document with recovery steps — it is about demonstrating with evidence that the organization can activate, execute, and sustain those plans under real stress conditions. The three most common findings in continuity audits are: outdated BIA (with impact assumptions that do not reflect current operations), recovery plans never tested in a full exercise, and recovery time objectives (RTO) that do not match actual technical capabilities. An untested disruption costs an average of USD 300K to USD 1.2M depending on sector. The assessment measures the distance between documented commitments and actual operational response capacity.
Deliverables
BIA evaluation
Review of business impact analysis and its assumptions.
Recovery plan audit
Verification of plans by critical process and feasibility testing.
Resilience report
Assessment of response capacity and recovery times.
Intervention Flow
Context analysis
Review of scope, stakeholders and critical processes.
Stress test
Disruption scenario simulation and response evaluation.
Results delivery
Report with findings, gaps and prioritized improvement plan.
Technical Inquiries
It is not a normative requirement, but the standards share the same high-level structure (Annex SL) and complement each other in practice. ISO 27001 protects information; ISO 22301 ensures operations recover when an incident disrupts them. Organizations adopting both in an integrated manner reduce control duplication by 30-40% and present a more coherent auditable system to the certification body. The assessment can evaluate both standards in parallel if the organization requires it.
Yes. Clause 8.5 of ISO 22301 requires the organization to conduct exercises and tests of plans at planned intervals and when significant changes occur. The absence of documented tests constitutes a major nonconformity because there is no evidence that the plans work. Beyond the normative finding, the real risk is operational: an untested plan is a hypothesis, not a capability. The assessment includes a simulation exercise that measures actual response times against committed RTOs.
Fernando Arrieta offers evaluation, assessment, and methodological guidance services for management systems. These activities are independent of the certification process, which is carried out exclusively by accredited certification bodies.