ISO 22301 audit process
An ISO 22301 audit checks whether your business continuity management system (BCMS) is not only documented, but also works in practice. The standard is published by ISO , practical guidance is in ISO 22313 , and certification goes through accredited bodies under RvA (Dutch Accreditation Council).
Auditors mainly look at critical processes, recovery objectives (RTO/RPO), test results and follow-up of improvement actions.
The ISO 22301 audit process in brief
| Component | What happens? | Result |
|---|---|---|
| Stage 1 | BCMS design and documentation check | Go/no-go for stage 2 |
| Stage 2 | Practical test of implementation | Certification recommendation |
| Surveillance | Annual follow-up audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
The ISO 22301 audit step by step
Stage 1: document and system review
The auditor assesses whether your BCMS structure is logical and ready for audit:
- scope and governance;
- BIA outcomes and recovery objectives;
- continuity plans;
- internal audit and management review.
Outcome: findings you resolve before stage 2.
Stage 2: implementation in practice
Here the auditor checks whether processes actually work:
- are roles clear during incidents;
- do escalation and communication paths work;
- is follow-up of test results demonstrable;
- are supplier dependencies under control.
Outcome: certification recommendation with any findings.
Annual surveillance
After certification, an annual check audit follows, covering critical areas and follow-up of earlier findings.
Recertification
In year 3, a full reassessment takes place to renew the certificate.
Types of findings in the ISO 22301 audit
| Type of finding | Meaning | Effect |
|---|---|---|
| Major nonconformity | Fundamental gap in BCMS design or operation | Certification postponed |
| Minor nonconformity | Deviation with limited impact | Corrective action plan required |
| Observation | Opportunity for improvement without a formal deviation | No direct blocker |
ISO 22301 audit readiness checklist
| Checkpoint | Why it matters | Read more |
|---|---|---|
| Scope and critical processes clear | Basis for defining the audit | Step-by-step plan |
| BIA and RTO/RPO up to date | Core of continuity objectives | BIA, RTO and RPO |
| Tests demonstrably carried out | Proof that the plan works | Requirements of the standard |
| CAPA followed up and closed | Shows the improvement cycle | Requirements of the standard |
| Internal audit and management review | Mandatory component | Step-by-step plan |
Common mistakes in the ISO 22301 audit
- Plans are written down but never practised.
- Unrealistic RTO/RPO values without a management decision.
- Too little attention to supplier and supply chain dependencies.
- Improvement actions not demonstrably completed.