Knowledge base

ISO 22301 Documentation: What Do You Actually Need?

A simple guide to the documented information required under ISO 22301.

Neha Dvivedi · 16 أغسطس 2026

ISO 22301 requires organisations to maintain certain documents and records to show that their Business Continuity Management System (BCMS) is properly planned, implemented, tested and improved.

Documents you must maintain

Your organisation should have documented:

• BCMS scope – what parts of the organisation are covered, including any exclusions and why they are excluded.

• Business continuity policy – the organisation’s commitment and approach to business continuity.

• Business continuity objectives – what the organisation wants to achieve.

• BIA and risk assessment methods – the process and criteria used to identify business impacts and risks.

• Business continuity strategies and solutions – how the organisation will continue critical operations during disruptions.

• Business continuity plans and procedures – what needs to be done when an incident occurs.

• Other necessary information – information required to make the BCMS work effectively.

Records you must retain

You should retain evidence of:

• Business Impact Analysis (BIA) results

• Risk assessment results

• Employee/team competency

• Internal and external communications

• Exercise and testing results, including post-exercise reports

• Evaluation of business continuity procedures and capabilities

• Monitoring and measurement results

• Internal audit programme and audit results

• Management review results

• Nonconformities and corrective actions

• Actual incidents and how they were handled

What a business continuity plan must contain

A business continuity plan should clearly explain:

• Purpose, scope and objectives – what the plan is for and what it covers.

• Roles and responsibilities – who will do what during an incident.

• Activation criteria – when the plan should be activated.

• Activation authority – who has the authority to activate the plan.

• Response procedures – what actions should be taken, including managing immediate impacts.

• Communication arrangements – how the organisation will communicate with employees, customers, authorities and other relevant parties.

• Dependencies and coordination – how the plan connects with other teams, plans, suppliers and organisations.

• Resources required – people, technology, facilities, equipment and other resources needed.

• Information and documentation flow – what information is needed, where it comes from and how it should be shared.

Two areas are often missed:

1. When exactly the plan should be activated

2. Who has the authority to activate it

These can be critical during the first few hours of a disruption.

Practical TIPS FOR BETTER Documentation

Keep plans simple and practical - During an emergency, people need quick instructions—not lengthy documents. Use checklists, contact details, decision points and clear action steps.

Keep emergency contact information accessible - Don't store your only contact list on a system that may become unavailable during a disruption.

Add version numbers and dates - Review and update plans regularly, especially after exercises or organisational changes.

Document exercise results honestly - A good exercise report should identify gaps, problems and corrective actions. A report showing only successful results may not demonstrate real improvement.

Keep your BIA updated - Review it regularly and whenever there are significant changes, such as new products, locations, organisational restructuring or critical suppliers.

Common ISO 22301 findings

Some common weaknesses identified during audits include:

1. BIA based mainly on opinions without clear assessment criteria.

2. Business continuity plans without clear activation criteria or an identified activation authority.

3. Testing limited to discussions or walkthroughs without testing actual capabilities.

4. Exercise reports showing only success and not identifying improvement areas.

5. Supplier dependencies mapped only to direct/first-tier suppliers.

6. Outdated contact details or contact information stored only on potentially unavailable systems.

7. No formal review after an actual business disruption.

In simple terms: ISO 22301 documentation should not exist just to satisfy an auditor. It should help people know what to do, who should act, when to act and how to keep critical business operations running during a disruption.

What this covers

ISO 22301

See how this looks as a working system

Reading about a requirement and seeing the documentation that satisfies it are different things. In a short demo we open the actual manual, procedures and records set for ISO 22301, show you how each clause is answered and where your existing way of working already fits. You will know what implementation involves before you commit to it.