ISO 22301 LA common mistakes
ISO 22301 LA · Understand the traps and how to avoid them.
Treating the business impact analysis and the risk assessment as the same activity, so answers describing how a candidate would 'identify threats and likelihood' get applied to the BIA clause instead of the risk assessment clause.
Both are analysis steps that feed the BCMS, and many candidates carry over generic risk-management habits from ISO 31000 or ISO 27001 without noticing that ISO 22301 separates them: the BIA determines prioritized activities and their disruption tolerances, while the risk assessment addresses threats to the BCMS and its processes. The vocabulary overlaps ('risk', 'impact', 'likelihood'), so the distinction blurs under time pressure.
What to do instead
Memorize the two clauses as separate deliverables. BIA output = prioritized activities, maximum acceptable outage/MTPD, minimum service levels, dependencies and resources. Risk assessment output = identified risks to the BCMS, analysis, evaluation and treatment options. Before answering, ask: 'is this about what happens to the organization if an activity stops (BIA) or about what could harm the management system (risk)?'
Selecting 'monitor and measure' or 'management review' as the corrective action for a nonconformity, rather than requiring root-cause analysis and action to eliminate the cause.
Candidates conflate the corrective action clause with continual improvement and performance evaluation. Because ISO 22301 also requires monitoring, measurement, analysis and evaluation, and management review, these look like plausible remedies, and candidates pick them to avoid committing to an invasive root-cause investigation.
What to do instead
Anchor on the corrective action definition: react to the nonconformity, evaluate the need to eliminate the root cause, implement action, review effectiveness, update risks if needed, and retain documented information. If the scenario has an already-identified cause and a repeat occurrence, the answer must address cause elimination and effectiveness review, not just detection or reporting.
Auditing the documented business continuity plan as a document and concluding conformity, without gathering evidence that the plan has been exercised, evaluated and updated, or that personnel know their roles.
Document review is the easiest evidence to obtain and candidates default to it. ISO 22301 requires evidence of exercise, evaluation of performance, and competence/awareness, which are process and people evidence, not paper evidence. Candidates who treat the audit as a paperwork check miss the operational clauses.
What to do instead
For every requirement, ask 'what record would prove this actually happened?' Build audit trails toward exercise reports, post-exercise evaluations, corrective actions arising from exercises, competence records and awareness interviews. Treat a plan with no exercise history as an audit finding candidate, not as conformity.
Writing the audit objective as 'to verify compliance with ISO 22301' or 'to certify the BCMS', instead of stating the objective in terms of what the audit is to determine and its scope.
Candidates memorize the standard's title and assume the objective is self-evident. They also import certification-body language into an internal or second-party audit context, where the objective is to evaluate the organization's own BCMS effectiveness against its criteria, not to certify.
What to do instead
Phrase objectives as determinations: e.g. 'to determine the extent of conformity of the BCMS with the organization's criteria and ISO 22301, and to evaluate its capability to consistently achieve intended outcomes'. Keep certification decisions out of the objective; that is a certification-body function, not an audit objective.
Confusing audit criteria, audit evidence and audit findings, for example labelling a policy document as a 'finding' or describing an interview as 'criteria'.
The three terms are defined together in audit principles vocabulary and candidates learn them as a list without mapping each to a role in the audit process. Exam items deliberately swap them to test whether the candidate can distinguish the benchmark, the proof and the conclusion.
What to do instead
Fix the chain: criteria = what is required (standard clause, policy, regulation); evidence = what was found (records, observations, interviews); findings = the result of evaluating evidence against criteria (conformity or nonconformity). Practice re-labelling every item in a scenario into one of the three before choosing an answer.
Classifying every problem as a major nonconformity, or downgrading a systemic breakdown to an observation, because the candidate uses personal severity instinct instead of the defined grading rules.
Candidates lack a consistent decision rule and are influenced by how dramatic the scenario sounds. A single missing signature can be minor, while an unexercised BCMS affecting all prioritized activities is systemic; without a rule, both get graded by feel. Conversely, candidates avoid raising majors to seem reasonable.
What to do instead
Apply a stated rule: does the issue represent a systemic failure or absence of a required process/element, or a lapse in an otherwise implemented process? Check impact on the BCMS's ability to deliver intended outcomes and whether it recurs across areas. State the rule you are applying in the answer rationale and grade consistently across the whole audit.
Skipping the audit programme's risk-based prioritization and scheduling the same audit days and depth to every BCMS process and site, or treating the programme as a one-off plan for a single audit.
Candidates merge 'audit programme' with 'audit plan'. The programme is the ongoing set of audits over time with objectives, resources and risk-based scheduling; the plan is the logistics for one audit. Because both use the word 'plan', the strategic layer is lost and the answer describes a single audit.
What to do instead
Separate the layers explicitly: programme = multi-year framework including objectives, risk-based prioritization, resources, schedules and monitoring of programme performance; plan = scope, criteria, dates, team and sampling for one audit. When a question mentions 'over a three-year cycle' or 'programme effectiveness', answer at the programme level.
Reaching a conclusion and closing the audit without verifying that corrective actions were implemented and effective, or without confirming the audit report was issued and distributed as required.
Candidates treat the closing meeting as the end of the audit and jump to 'issue certificate' or 'close the finding'. ISO 22301 audit closure requires follow-up on actions and evaluation of their effectiveness, plus report approval and distribution. The administrative steps feel less 'technical' and get skipped.
What to do instead
Use a closure checklist: findings agreed and recorded, report approved and issued within agreed time, corrective action owners and due dates set, follow-up/verification activity scheduled, and effectiveness of actions evaluated before the finding is closed. If a scenario asks what happens next after the closing meeting, the answer is action follow-up and report distribution, not certification.
Answering questions about auditor competence and independence by describing technical BC knowledge only, ignoring impartiality threats such as auditing one's own work or a conflict of interest.
Candidates focus on the technical content of ISO 22301 and underweight the audit principles domain. They also assume that being knowledgeable about business continuity is sufficient, missing that independence and objectivity are separate, mandatory attributes that can disqualify an auditor from an assignment.
What to do instead
For any competence or team-selection scenario, check both dimensions: competence (BCMS knowledge, audit skills, sector knowledge, language) and impartiality (no auditing of own work, no recent operational responsibility for the area, no conflicting commercial relationship). If impartiality is compromised, the fix is reassignment or team composition change, not more training.
Describing the audit as a checklist walkthrough of every clause in order, rather than planning sampling and audit trails based on process importance, prior findings and the BIA-prioritized activities.
Clause-by-clause auditing is the default mental model from studying the standard's structure, and it feels thorough. In practice it produces shallow coverage and ignores the requirement to focus on the processes that matter most to continuity. Candidates also fear that sampling looks like incomplete auditing.
What to do instead
Plan by process and risk: use the BIA output to select prioritized activities, weigh prior audit results and nonconformities, and document the sampling rationale in the audit plan. Justify samples as representative and risk-based rather than exhaustive. When a scenario offers 'audit all clauses equally' versus 'focus on high-impact processes with documented sampling', choose the latter and explain the rationale.