Preparing an ISO 22301 Audit
Domain 4 tests whether you can turn an audit programme into a risk-based audit plan: scope, criteria, sampling, time, roles and logistics, supported by document review.
Before the audit
- Confirm audit objectives, scope, criteria, sites, dates and interfaces with the auditee.
- Review the BCMS documentation: scope, policy, objectives, BIA, risk assessment, plans, exercise reports, internal audit and management review outputs, previous findings.
- Build a sampling plan by process, site, shift and clause; sample high-risk and high-impact activities, not just convenient ones.
- Prepare an audit plan with time allocations, auditor roles, auditee guides, opening and closing meetings, and report timing.
- Prepare working documents such as checklists and trace matrices as prompts, not scripts.
Worked example
A logistics company has three depots and a head office. The audit scope covers all sites; the plan samples head office plus the busiest depot and one night shift. Time is weighted to 8.5 (exercise programme) and 10.1 (corrective actions) because the last internal audit found repeated exercise actions. Reasoning: risk-based sampling covers the system, not every transaction; weighting reflects prior performance.
Traps
Planning only desk review; using a generic checklist that drives yes/no answers; failing to confirm scope changes; ignoring remote or virtual audit constraints; not reserving time for findings and the closing meeting.