ISO 22301 FAQ Certification Evidence

Certification evidence includes documented information that ISO 22301 explicitly requires the organization to retain or maintain, plus other records needed to show that BCMS processes were carried out as planned. A policy folder alone cannot show operation: reviewers need traceability across scope, objectives, BIA, risk assessment, strategies, plans, exercises, evaluation, internal audit, management review, and corrective action.

Start with the BCMS boundary. The scope record must identify the included parts of the organization and products and services, and it must document and explain exclusions. Supporting dependency, location, outsourced-process, and interested-party records help show how that scope was determined and whether exclusions affect the organization's continuity ability or responsibility.

The core operating evidence should show how the organization determined continuity priorities and selected recovery arrangements. That means business impact analysis records, risk assessment records, continuity requirements, strategy and solution decisions, resource requirements, plans, procedures, warning and communication steps, response structure, and recovery processes.

The BIA and risk assessment should be fresh enough to represent the current organization. ISO 22301 expects these processes to be reviewed at planned intervals and when significant changes occur, so the evidence pack should show the last review, change trigger, approval, and resulting updates.

Exercises and tests show whether strategies, solutions, plans, communications, teams, and suppliers can perform over time. Keep the scenario, aims, objectives, participants, assumptions, results, recommendations, action owners, due dates, and closure proof together with the plan or capability being tested.

Internal audit and management review close the evidence loop. Audit records should show criteria, scope, auditor independence, findings, reported results, and follow-up. Management review records should show inputs, decisions, scope changes, BIA or risk updates, plan updates, resource decisions, and improvement opportunities.

Keep an evidence map instead of a last-minute audit folder. Each evidence item should have a record owner, storage location, review frequency, change trigger, retention rule, and status. When the scope, product, service, site, supplier, system, incident pattern, legal requirement, or continuity objective changes, update the affected evidence and show what changed.

Corrective-action records show whether the organization reacts to nonconformities, evaluates their causes and possible recurrence, implements needed action, reviews effectiveness, changes the BCMS where necessary, and retains evidence of the nonconformity, subsequent action, and results.