An ISO 22301 audit checks whether a company can keep its important activities running, or restore them in an agreed time, when something disrupts them. The auditor tests the business impact analysis, the plans built from it, and the proof that those plans have been exercised. A plan that has never been tested is the most common weak point.
Last reviewed: 17 October 2026. Facts checked. A web search confirmed that the current base edition is ISO 22301:2019 and that ISO published Amendment 1:2024, "Climate action changes", in February 2024. Secondary summaries say the amendment touches clauses 4.1 and 4.2 (context and interested parties) and does not change the certification process. We did not open the standard or the amendment, because they are paid documents. Read the exact clause wording before you audit.
What the standard is for
ISO 22301 sets requirements for a business continuity management system, often shortened to BCMS. A BCMS is the set of policies, roles, plans and tests a company uses to prepare for a disruption such as a fire, a cyber attack, a supplier failure or the loss of a key site.
It follows the common structure of ISO management system standards, so the audit flow will feel familiar if you have audited ISO 9001. For the general method, see our guide on how to run an ISO internal audit step by step.
What changed in the 2024 amendment
The amendment asks the company to decide whether climate change is a relevant issue for its continuity system, and to note that interested parties may have climate-related requirements. For the auditor the test is simple. Ask to see where the company recorded that decision. A written "not relevant, because..." is acceptable. Silence is not.
Audit areas and what to ask
| Area | Question to ask | Evidence to request |
|---|---|---|
| Context and scope | Which products, sites and activities are inside the BCMS? | Scope statement, list of interested parties, record of the climate relevance decision |
| Leadership | Does top management own the programme? | Signed policy, assigned roles, management review minutes |
| Risk and planning | Which disruption risks were assessed? | Risk assessment, treatment actions |
| Business impact analysis | Which activities matter most, and how long can each be down? | Impact analysis with recovery time targets agreed by the activity owners |
| Strategies and solutions | How will each critical activity be restored? | Alternate site, backup, manual workaround or supplier arrangement |
| Plans | Who does what, in what order, when a disruption starts? | Incident and continuity plans, contact lists, escalation steps |
| Exercises | Have the plans been tested? | Exercise schedule, scenarios, results, lessons recorded |
| Evaluation | Is performance measured and reviewed? | Indicators, internal audit report, management review |
| Improvement | Were gaps from tests and incidents fixed? | Corrective action log |
The business impact analysis is the spine
Most of the system rests on the business impact analysis (BIA). The BIA lists the company's activities, estimates how quickly a stoppage would hurt, and sets how fast each must come back.
Audit it by sampling. Pick three activities and ask:
- Who set the recovery time, and did the activity owner agree to it?
- Does the continuity solution actually meet that time? A one-day target with a backup that takes three days to restore is a finding.
- Does the analysis cover dependencies, such as IT systems, key people and suppliers?
- When was it last reviewed after a change in the business?
Test the plans, not just their existence
Read a plan, then ask the named person what they would do first. If they cannot answer, the plan is a document, not a capability.
Check these points on exercises:
- Is there a schedule, and was it followed?
- Did the exercise test a realistic scenario, or only a walk through the paper?
- Were the results written down, with actions for what went wrong?
- Did the people who would really respond take part?
A company that has had a real incident should show how it used the plan and what it changed afterwards. That record is strong evidence.
Suppliers and outsourced activities
Many continuity failures start outside the company. Check whether critical suppliers and outsourced services are covered in the analysis, and whether the company knows how a supplier's outage would affect it. If the company relies on a cloud or payroll provider, ask what it does if that provider is unavailable. For the supplier side, see our guide on supplier and third-party audits.
Common findings
- The BIA was done once and never updated.
- Recovery targets exist but no one has tested whether they can be met.
- Plans name people who have left.
- Exercises are held but no lessons or actions are recorded.
- Management review does not discuss continuity results.
- The scope excludes a site or service that the BIA shows is critical.
For how to grade these, see major vs minor nonconformities.
Frequently Asked Questions
Is ISO 22301 mandatory in India?
We did not find a general legal requirement that applies to all companies. Some customers, lenders or sector regulators may ask for continuity arrangements, so check the contract or the regulator's rules for your case. ISO 22301 certification itself is voluntary.
What is the difference between a BIA and a risk assessment?
A BIA asks how much a stoppage of an activity would hurt and how quickly it must be restored, whatever the cause. A risk assessment asks what could cause a disruption and how likely it is. A BCMS normally uses both.
Does the 2024 climate amendment require new controls?
According to secondary summaries, it adds considerations to the context clauses and does not set specific climate targets. The company must show it has considered whether climate change is relevant. Confirm against the amendment text.
How often should continuity plans be tested?
The standard expects exercises at planned intervals, and the company sets the interval based on risk. The auditor checks that the schedule exists, is sensible and was followed.
Who can carry out an internal BCMS audit?
Any competent person who is independent of the activity being audited. Our guide to the certification audit stages explains how the external audit builds on the internal one.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error