Preparation for a BCMS Certification Audit
Certification process
Certification is a third-party conformity assessment against ISO 22301. Candidates should know the typical stages: application and contract, Stage 1 (readiness/documentation and scope review), Stage 2 (implementation effectiveness), certification decision, and surveillance audits with recertification before the three-year cycle ends. A frequent trap is believing Stage 1 is a documentation-only formality-it assesses readiness for Stage 2 and can raise findings.
Evidence and readiness
Auditors sample evidence of conformity and effectiveness: scope and context analysis, policy, objectives, BIA and risk assessment outputs, strategies, plans, exercise records with actions, internal audit reports, management review minutes with decisions, nonconformity logs and corrective action effectiveness. Readiness means the BCMS has been operating long enough to generate records. Traps include producing documents created just before the audit, missing management review outputs, and having no evidence of exercising.
Scope, certification body and audit conduct
Agree the certification scope carefully; it must match the BCMS scope and be defensible. During audits, provide objective evidence, be honest about gaps, and treat findings as improvement input. Nonconformities are graded (typically major/minor) and require correction and corrective action with evidence before certification or continued certification.
Worked example
A firm schedules Stage 1 six weeks before Stage 2, uses the interval to close documentation gaps and run one exercise whose results feed the management review. Records from the exercise and review become Stage 2 evidence.
Rule of thumb
If it is not recorded, it did not happen. Build evidence through normal operation, not last-minute preparation.