ISO 22301:2019 Business Continuity Management System Audit Checklist

What an ISO 22301:2019 self-assessment checklist is

An ISO 22301:2019 checklist is a structured tool for reviewing a business continuity management system (BCMS) against the requirements of the standard. It breaks those requirements into discrete items so that you can check each one in turn: whether the organization has documented information in place, whether its practices are established and maintained, and whether the results are being evaluated. The template is completed as a self-assessment, with each item marked as conforming, not conforming, or not applicable, and with the evidence you gathered recorded alongside the item.

Why it matters

A business continuity management system exists so that an organization can prepare for and respond to disruptive incidents and protect its critical products and services. ISO 22301:2019 sets out the requirements for building, operating, and improving such a system. Working through the standard clause by clause helps you confirm that the system is complete: that the context and scope are understood, that leadership has committed to it, that risks and opportunities have been addressed, that support and operation are in place, and that performance is evaluated and improved. The checklist gives you a consistent way to carry out that review and to record where gaps remain.

What a good checklist covers

A complete ISO 22301:2019 checklist follows the structure of the standard. It should cover: - **Context of the organization.** Understanding the organization and its context, understanding the needs and expectations of interested parties, including legal and regulatory requirements, determining the scope of the BCMS, and establishing the BCMS itself. - **Leadership.** Leadership and commitment, establishing and communicating the business continuity policy, and assigning roles, responsibilities, and authorities. - **Planning.** Determining risks and opportunities and the actions to address them, and setting business continuity objectives and the plans to achieve them. - **Support.** The resources, competence, awareness, communication, and documented information needed for the BCMS. - **Operation.** Business impact analysis and risk assessment, business continuity strategies and solutions, business continuity plans and procedures, and exercising and testing. - **Performance evaluation.** Monitoring, measurement, analysis, and evaluation; internal audit; and management review. - **Improvement.** Nonconformity, corrective action, and continual improvement.

How to carry it out

Set the scope of the review first, then work through the sections of the checklist and record each finding as you go. For each item, ask whether the organization has the arrangement in place and can show evidence that it is operating. Where an item does not conform, note what is missing so that a corrective action can be raised. Where an item genuinely does not apply, mark it not applicable rather than leaving it blank. Date the completed checklist, and use the results to plan the next cycle of monitoring, internal audit, and management review.

Frequently Asked Questions

An ISO 22301:2019 audit is an evaluation of an organization's business continuity management system (BCMS) against the requirements of the standard. You gather and review evidence to establish whether the BCMS conforms to the requirements, and you record each finding, with the option to mark an item as not applicable where it genuinely does not apply to the organization's scope.

You use it to structure the review of your business continuity management system. The template walks through context of the organization, leadership, planning, support, operation, performance evaluation, and improvement, with reference to the management system and technical requirements implicated by the questions. You answer each item as conforming or not conforming, or mark it not applicable where it does not apply.

The checklist covers clause 4 requirements on context of the organization, including understanding the organization and its context, and then continues through the other clauses that make up the standard's requirements for a business continuity management system: leadership; planning; support; operation; performance evaluation; and improvement.

For each item you record whether it conforms, does not conform, or is not applicable, and you capture supporting evidence. Where you need an observation, the checklist gives you prompts to record the applicable requirements, the arrangements the organization has put in place, and the results it has achieved, so that your findings are traceable to what you saw.

Several items ask you to identify and work with the legal, regulatory and contractual requirements that apply to the organization's business continuity management system. Use those prompts to list the requirements that are relevant to the organization and to confirm they are addressed in the BCMS.

The checklist is built for one audit at a time, so the title, location, date, and the name and signature of the person who completed the inspection apply to that single audit. The results recorded against each item also belong to that audit, and marking them not applicable affects the summary only for that run.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile