ISO 22301 LA case studies
ISO 22301 LA · Put your knowledge to work in context.
The PECB Certified ISO 22301 Lead Auditor credential is a professional certification for people who audit business continuity management systems (BCMS) against ISO 22301. PECB states that the ISO 22301 Lead Auditor training course equips participants to audit BCMSs based on best audit practices and principles, and that passing the exam earns the internationally recognized credential as evidence of expertise to audit organizations' compliance with ISO 22301 requirements. The ISO 22301 LA case studies are 5 cases and about 3,814 words.
1When the recovery capability cannot meet the stated MTPD
Northbridge Logistics is a 620-person third-party logistics provider whose ISO 22301 scope covers order fulfilment and cold-chain distribution. During a stage 2 audit the lead auditor reviews a business impact analysis approved in March 2023.
834 words, about 4 min2Lead auditor assignment, impartiality and an unbuildable audit plan
A certification body assigns auditor L as lead auditor for the stage 2 audit of a water utility with 900 staff and 1.2 million customers. The plan is two auditor-days with one auditor.
820 words, about 4 min3Closing a major nonconformity that is correction without corrective action
Thirty days later the client submits: procedure BCM-P-04 revised to version 3; a tabletop exercise held for 12 participants, evidenced by an attendance sheet and photographs; a statement that the exercise report is "being finalised"; a root cause recorded as "staff turnover"; no analysis of whether other plans, sites or suppliers share the same cause; and no defined effectiveness check. The CB's procedure allows a major nonconformity to be downgraded to minor where correction is verified and the corrective action is judged likely to be effective, with verification at the next surveillance audit.
625 words, about 3 min4Designing a risk-based audit programme for a multi-site sterilization provider
A certification body's audit programme covers MediChain, a sterile-services provider with six sites in two countries and 1,400 staff. The programme is: annual surveillance at head office only, one auditor-day per site, and recertification every three years with a two-day head-office audit.
740 words, about 4 min5Contradictory evidence, an anonymous source and a closing meeting in 45 minutes
Two auditors are on day three of a stage 2 audit of a 250-person software company. In interview the BC manager says: "We fail over to the secondary data centre every quarter - the runbook is on the shared drive - but I don't keep records, it's a small team and we just know it works." With 45 minutes before the closing meeting, an engineer shows one auditor, on condition of anonymity, a chat message from the CTO dated three weeks earlier: "Skip the DR test this quarter, we need the environment for the 9.2 release." The client's audit guide states that all auditor notes must be shared with the auditee before the closing meeting.
795 words, about 4 min