CBCA cheat sheet

ISO 19011:2018 sets seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit criteria are the set of requirements (policies, procedures, standards, contractual or legal obligations) used as the reference against which evidence is compared.

Independence rule: an auditor shall not audit their own work; where full independence is not practicable, the residual threat is disclosed and mitigated and the mitigation is recorded.

Three audit types by relationship: first-party (internal audits performed by or for the organisation), second-party (audits of suppliers, partners or outsourced providers), third-party (certification bodies, regulators, clients).

Team roles: the lead auditor manages the audit and signs the report; auditors collect and evaluate evidence; technical experts advise without audit authority; observers and guides do not audit.

ISO 19011:2018 Clause 7 covers auditor competence: education, training, audit experience, audit knowledge and skills, plus personal attributes, evaluated against defined criteria.

Role boundary: auditors evaluate against criteria and report findings; management designs and implements corrective action, and the auditor only verifies implementation and effectiveness.

An audit programme is a set of one or more audits planned for a specific time frame and directed at a specific purpose, and it includes schedules, resources, objectives and criteria.

Risk-based frequency rule: audit frequency and depth increase with activity criticality (BIA derived RTO/MTPD), prior findings, incident and exercise history, recent change, and regulatory or contractual exposure.

An audit scope statement fixes the boundaries: organisational units, locations, processes, period covered, and any explicitly stated exclusions or limitations.

Per-audit plan contents: objectives, scope, criteria, dates and locations, team roles and responsibilities, audit methods, sampling approach and the schedule of activities.

Feasibility check before proceeding: sufficient and appropriate information must be available, time and resources must be adequate, and the auditee must cooperate.

Sampling decision rule: larger samples are taken from higher-risk or higher-volume populations, and the sample size and selection method are documented in the work documents.

Criteria hierarchy for a continuity audit: legal and regulatory obligations, then contractual requirements, then the adopted standard (for example ISO 22301), then the organisation's own BCMS documentation.

Document review precedes fieldwork; its outputs are a documented gap list and a tailored checklist that are carried into the audit plan and sampling decisions.

Programme monitoring: audit programme performance is measured (for example completion against schedule, finding trends, corrective action closure rates) and the programme is adjusted at review.

The opening meeting confirms objectives, scope, criteria, schedule, communication channels, escort arrangements, confidentiality and safety and security requirements.

Evidence collection methods: document and record review, interviews, observation of work being performed, walkthroughs or re-performance, and physical site inspection.

Corroboration rule: interview statements alone are the weakest evidence class; they are confirmed by records or direct observation before a finding is recorded.

A finding requires three elements: a criterion (requirement), verifiable evidence of what was found, and the gap between them; if a criterion is absent the issue is at most an observation.

BIA verification points: documented activities, impact ratings over time, derivation of RTO and MTPD, dependency mapping, and evidence the results were approved and used.

Plan verification points: activation criteria, roles and authorities, current contact data, recovery procedures, alternate resources and sites, interdependencies, and version control.

Exercise verification points: programme schedule, scenario and objectives, participants, records of results, and evidence that action items were tracked to closure.

Immediate escalation rule: a condition posing immediate risk to continuity capability is reported to the auditee and the lead auditor without waiting for the closing meeting or report.

Evidence recording rule: each recorded item cites the criterion, the source document identifier, the date and the interviewee's role so that another auditor can re-verify it.

ISO 19011:2018 report contents: audit objectives, scope, identification of client, auditee and audit team, dates and locations, criteria, findings, conclusions and the degree of fulfilment of the criteria.

Finding formula: requirement (criterion) + evidence (what was found and where) + gap (conclusion) produces a complete, auditable finding statement.

Severity decision rule: major nonconformity = systemic failure or failure of a critical requirement affecting the management system's ability to achieve intended results; minor nonconformity = isolated lapse that is not systemic; opportunity for improvement = no requirement breach.

Correction versus corrective action: correction removes the observed nonconformity, corrective action eliminates its cause so the nonconformity does not recur.

Root cause analysis (5 Whys, cause-and-effect diagram) is performed and owned by the auditee, which also defines the action plan, owner and due date.

Follow-up rule: a finding is closed only when implementation and effectiveness are verified against objective evidence; overdue actions are re-reported to management.

The audit conclusion states overall conformity with the criteria, the effectiveness of the BCMS, and whether further corrective action or audit activity is required (for certification audits, a recommendation).

Report quality rules: factual, accurate, concise, dated, written in the agreed language, and distributed only in line with the confidentiality arrangements.

ISO 22301:2019 clause structure: 4 context of the organisation, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation, 10 improvement.

Clause mapping used as audit criteria: 8.2 business impact analysis and risk assessment, 8.3 continuity strategies and solutions, 8.4 plans and procedures, 8.5 exercise programme, 8.6 evaluation of continuity documentation and capabilities.

Timing relationship: RTO must be shorter than the MTPD; the MBCO defines the minimum acceptable output during disruption; the RPO bounds tolerable data loss for supporting resources.

BIA sequence: identify activities and dependencies, assess impact over time, derive priorities and RTO, set the MBCO, then use the results to select strategies.

Risk assessment sequence (ISO 31000 aligned): identify, analyse, evaluate and treat, using risk acceptance criteria defined by the organisation.

Plan minimum contents: purpose and scope, roles and authority, activation criteria, communication arrangements, recovery procedures, resource requirements and interdependencies.

Exercise programme requirement (8.5): planned and progressive (walkthrough, tabletop, simulation, full exercise), documented, evaluated, with lessons learned converted into corrective action.

Clause 9 components: 9.1 monitoring, measurement, analysis and evaluation; 9.2 internal audit; 9.3 management review. Clause 10 covers nonconformity, corrective action and continual improvement.

Related criteria: ISO 22313 (guidance on ISO 22301), ISO 22317 (BIA guidance), ISO 31000 (risk management), NFPA 1600, BCI Good Practice Guidelines, plus applicable regulatory and contractual obligations.