ISO 22301 Audit Readiness and Certification Evidence

Before collecting samples, confirm the BCMS scope. It must identify the included parts of the organization and products and services, taking account of relevant context, interested-party requirements, the organization's mission, goals, and obligations. Document and explain exclusions; they cannot reduce the organization's ability or responsibility to provide continuity as determined by the BIA or risk assessment and applicable legal or regulatory requirements.

Audit readiness also depends on control of documented information. Policies, BIA records, risk assessments, plans, exercise reports, audit reports, and management review minutes should have owners, version control, approval status, access rules, retention expectations, and a clear link to the process they support.

Use ISO 22301:2019 together with Amendment 1:2024 as the published requirements baseline. ISO lists a revision as under development, but it has not replaced the 2019 edition. Record the edition and amendment used in the audit criteria so reviewers do not test against a draft or superseded edition.

The BIA should define impact types and criteria, identify activities that support products and services, assess disruption impacts over time, and identify when not resuming an activity would become unacceptable. It should then set a prioritized resumption time within that limit and at a specified minimum acceptable capacity, identify prioritized activities, and determine their resources, dependencies, and interdependencies.

The disruption risk assessment should identify risks to prioritized activities and required resources, analyse and evaluate them, and determine which require treatment. Keep a trace from these outputs to the selected strategies and solutions, continuity objectives, plans, owners, and review triggers.

Evidence should show that continuity arrangements operate, not only that plans exist. The exercise programme should validate strategies and solutions over time through planned scenarios with clear aims and objectives. Formal post-exercise reports should record outcomes, recommendations, and improvement actions.

Operational-control evidence should connect BCMS work to the approved continuity strategy: implemented and activatable solutions, maintained plans, response thresholds, warning and communication procedures, recovery and stand-down steps, supplier capability reviews, resource arrangements, and post-incident or post-exercise improvements.

Internal audit evidence should show the programme's frequency, methods, responsibilities, planning, and reporting; the criteria and scope for each audit; auditor objectivity and impartiality; results reported to relevant managers; necessary corrective action; and follow-up verification. The programme should account for process importance and previous audit results.

Management review evidence should show that top management considered previous actions, relevant context changes, performance trends, interested-party feedback, BIA and risk-assessment information, capability evaluations, unresolved risks, lessons from near misses and disruptions, and improvement opportunities. Retain the resulting decisions, assigned actions, and communication to relevant interested parties.

Assign each evidence set to the person who performs or controls the work: process owners approve BIA facts, continuity owners maintain strategies and plans, exercise leads retain results, independent auditors retain audit records, top management owns management-review decisions, and action owners prove correction and effectiveness. The BCMS owner can maintain the index, but should not become the undocumented owner of every underlying record.

Generic, stale, or disconnected evidence cannot show the full BCMS process. A BIA with no strategy link, a risk assessment with no treatment decision, an exercise report with no actions, or a management review with no decisions does not by itself demonstrate effective operation.

Maintain the evidence file as an audit trail. Update it after major service, site, supplier, technology, threat, incident, exercise, audit, or organizational changes, and keep pending actions visible until closure.