ISO 22301 LA cheat sheet

ISO 22301 defines business continuity as the capability of an organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident; it is not the same as disaster recovery, which addresses technology assets only.

Business impact analysis (BIA) identifies time-critical activities and their dependencies; risk assessment identifies threats, vulnerabilities and likelihood. ISO 22301 requires both as inputs to selecting continuity strategies.

Recovery time objective (RTO) is the target time to resume an activity or resource after disruption; recovery point objective (RPO) is the acceptable data loss measured in time before the incident.

Maximum acceptable outage (MAO) or maximum tolerable period of disruption (MTPD) is the time by which the impact of not resuming an activity becomes unacceptable; RTO must be shorter than MTPD, and the difference covers the recovery buffer.

Minimum business continuity objective (MBCO) is the minimum level of service and product acceptable to the organization during disruption, expressed in measurable terms such as volume, geography or service tier.

The Plan-Do-Check-Act cycle underpins the standard: Plan establishes the BCMS, Do implements and operates it, Check monitors and reviews through internal audit and management review, Act maintains and improves through corrective action.

ISO 22301 follows the Harmonized Structure (Annex SL) shared with ISO 9001 and ISO 27001, so clauses 4 to 10 align: context, leadership, planning, support, operation, performance evaluation, improvement.

A disruptive incident is an event, whether anticipated or unanticipated, that causes unplanned negative deviation from expected service delivery; incidents trigger the incident response structure and business continuity plans.

Business continuity management is a holistic management process, distinct from emergency response (life safety and asset protection) and crisis management (strategic communications and stakeholder handling), although the three interoperate during an incident.

Clause 4 requires determining external and internal issues, identifying interested parties and their relevant requirements, and defining BCMS scope and boundaries with justification for exclusions.

Clause 5 requires top management to demonstrate leadership by establishing policy, ensuring resources, communicating importance and directing management review; the BC policy must be appropriate to purpose and include commitment to continual improvement.

Clause 6 requires risk-based planning: actions to address risks and opportunities, business continuity objectives at relevant functions and levels, and planning how to achieve them with measurable criteria.

Clause 7 covers support: resources, competence, awareness, communication and documented information; competence records are mandatory, and awareness covers the BC policy, contribution to effectiveness and implications of nonconformity.

Clause 8.2 requires systematic BIA and risk assessment, reviewed at planned intervals and after significant change; outputs include prioritized activities, dependencies, MTPD, RTO and risk treatment options.

Clause 8.3 requires determining and selecting business continuity strategies and solutions based on BIA and risk outputs, evaluating them against criteria, and documenting the rationale for selection.

Clause 8.4 requires documented business continuity plans and procedures, an incident response structure with roles and authorities, warning and communication procedures, and arrangements for external parties.

Clause 8.5 requires exercising and testing at planned intervals and after significant change, with documented results, and clause 8.6 requires evaluating continuity performance against objectives and acting on results.

Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit at planned intervals, and management review covering status of actions, changes, performance, nonconformities and improvement opportunities; clause 10 requires corrective action and continual improvement.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach; independence means auditors do not audit their own work.

Audit criteria are the set of policies, procedures, requirements or standards used as a reference against which evidence is compared; audit evidence consists of records, statements of fact or other verifiable information.

Audit findings classify as conformity or nonconformity; nonconformities may be graded major (systemic breakdown, absence of a required process, or failure to implement corrective action) or minor (isolated lapse not affecting system effectiveness).

An observation or opportunity for improvement is not a nonconformity; it indicates risk of future nonconformity or a possible enhancement and does not by itself require corrective action.

Objective evidence must be traceable and verifiable: sampling should be representative, and conclusions must rest on facts recorded in the audit, not on auditor opinion.

Audit types include first-party (internal), second-party (supplier or customer) and third-party (certification or accreditation); certification audits comprise stage 1 and stage 2, followed by surveillance and recertification.

An audit programme is a set of one or more audits planned for a specific time frame and directed at a specific purpose; the audit plan is the description of activities and arrangements for a single audit.

Competence of auditors rests on knowledge of the standard, sector and processes, plus skills in interviewing, sampling, reporting and handling conflict, maintained through continuing professional development.

Define audit objectives, scope and criteria in consultation with the client; scope must specify organizational units, locations, processes and period, and criteria must reference ISO 22301 clauses, the BC policy and applicable legal requirements.

Perform document review before fieldwork: BC policy, scope statement, BIA and risk assessment reports, continuity strategies, BC plans, exercise reports, internal audit results and management review minutes.

Prepare a risk-based audit plan allocating time to high-impact areas: incident response structure, BIA validity, plan activation, exercise evidence and corrective action follow-up.

Use the process approach: map clause requirements to organizational processes and identify interfaces between continuity, IT service continuity, facilities, HR and supply chain.

Prepare audit checklists and sampling plans per clause; sampling should cover different sites, shifts, product lines and levels of personnel, and be adjustable as evidence emerges.

Select an audit team whose competence matches the scope; avoid conflicts of interest, and brief team members on roles, schedules, sampling approach and reporting format.

Communicate the audit plan and logistics to the auditee in advance, confirm availability of interviewees and evidence, and agree confidentiality and safety arrangements.

Prepare working documents: opening meeting agenda, interview guides, nonconformity report forms and a schedule that includes time for team meetings and closing meeting preparation.

Open with a meeting confirming objectives, scope, criteria, schedule, methods, confidentiality and reporting; the auditee should be able to raise concerns and ask questions.

Collect evidence through interviews, observation and document review; corroborate verbal statements with records, and record sources so findings are traceable.

Test the BIA for completeness: verify that all critical activities were identified, dependencies mapped, MTPD and RTO justified, and results approved by process owners.

Verify the incident response structure: named roles, deputies, contact lists, escalation thresholds, and evidence that personnel know their responsibilities.

Test plan adequacy by tracing a scenario through the plan: activation criteria, communication flows, resource requirements, alternate arrangements and recovery priorities consistent with the BIA.

Examine exercise and test records for scope, objectives, participants, scenario, results, identified issues and follow-up actions with owners and deadlines.

Verify corrective action effectiveness by tracing nonconformities from internal audit, exercises and incidents to root cause analysis, implemented action and verification of effectiveness.

Write nonconformities with three elements: the requirement (clause or document), the objective evidence found, and a clear statement of the gap; avoid prescribing the solution.

Hold team meetings to consolidate findings, agree classifications, resolve differences with the auditee, and prepare the closing meeting and report content.

The closing meeting presents findings, conclusions and audit opinion, explains nonconformity grading, confirms agreement on facts, and states the audit report timeline; disagreements are recorded.

The audit report must include objectives, scope, criteria, dates, sites, team, findings, conclusions on conformity and effectiveness, and any limitations on coverage.

Audit conclusions address whether the BCMS conforms to criteria and is effectively implemented and maintained; they also state the audit opinion and any recommended follow-up.

Nonconformity reports are issued with clear requirement references and evidence; the auditee proposes correction, root cause analysis and corrective action with target dates.

Verification of corrective action may be by document review or follow-up audit; closure requires evidence that the root cause was addressed, not only that the symptom was fixed.

For certification, the audit team recommends certification only when all major nonconformities are closed and minor nonconformities have accepted plans; the certification decision rests with the certification body.

Confidentiality applies after the audit: reports, working documents and evidence are retained and shared according to the audit programme and client agreement.

Lessons learned from the audit feed the audit programme: findings inform risk assessment, future sampling, auditor competence needs and scheduling of follow-up activities.

Establish the audit programme with objectives, scope, risks, responsibilities, resources and schedule, considering the size, complexity, maturity and risk profile of the BCMS.

Assign programme management responsibility to a competent person with authority to approve plans, allocate auditors and report to top management.

Determine audit frequency and scope using risk: higher-risk or less mature processes are audited more often; the full BCMS must be covered over the programme cycle.

Maintain auditor competence and impartiality: rotate auditors, avoid auditing own work, and manage resource constraints and conflicts of interest.

Monitor programme performance through indicators such as plan completion, nonconformity trends, corrective action closure times and audit findings repeat rates.

Review the programme at planned intervals and after significant change; adjust plans based on results, incidents, organizational changes and management review inputs.

Record the programme: audit plans, reports, nonconformity logs, corrective action status and auditor competence records, retained per documented information requirements.

For certification bodies, the programme must meet accreditation requirements for audit time, multi-site sampling, special audits and transfer or recertification timelines.