ISO 22301 clause by clause: what auditors examine

Clause 4: Context of the Organisation

Auditors check the organisation’s internal and external issues, interested parties such as customers and regulators, the scope of the system, and its overall structure.

Scope is particularly important. Auditors verify that the products and services included in the scope reflect the organisation’s actual business needs. They also check whether the activities essential to delivering these products and services are covered.

If a critical outsourced activity is excluded from the scope, auditors may question this because outsourcing does not remove the organisation’s dependence on that activity.

Clause 5: Leadership

This clause covers management commitment, the business continuity policy, and the roles and responsibilities of key personnel.

Auditors check whether senior management understands and supports the organisation’s recovery objectives. They also verify whether the necessary resources are available to achieve these objectives.

For example, if the organisation has committed to recovering a critical activity within four hours, senior management should understand this requirement. If they are unaware of it, auditors may raise a finding related to leadership commitment.

Clause 6: Planning

This clause focuses on risks, opportunities, and business continuity objectives.

Auditors check whether the objectives are clear, measurable, and linked to the organisation’s ability to continue its important activities during a disruption.

For example, ensuring that all prioritised activities are tested annually and meet their recovery targets is a measurable objective. Simply stating “improve business resilience” is not specific enough.

Clause 7: Support

This clause covers employee competence, awareness, communication, and documented information.

Auditors check whether employees with business continuity responsibilities have the required knowledge and skills. They also verify whether employees across the organisation understand what they should do when a disruption occurs.

To check awareness, an auditor may ask an employee outside the business continuity team what they would do if an incident were declared.

Clause 8: Operation — The Main Focus of the Audit

This clause receives the most attention because it covers the practical steps an organisation takes to prepare for and manage disruptions.

1. Business Impact Analysis (BIA)

Auditors examine both the process used to conduct the BIA and its results.

They check how impacts were assessed, which criteria were used, the timeframes considered, and who provided the information. They also verify whether the organisation considered financial, legal, regulatory, and reputational impacts.

Auditors may select an important business activity and ask why a particular recovery timeframe was chosen.

The answer should be supported by the BIA findings and business requirements, rather than being based only on a department head’s opinion.

2. Risk Assessment

Auditors check whether the organisation has identified risks that could interrupt its prioritised activities.

The assessment should focus on potential disruptions to critical business operations rather than relying only on a general corporate risk register.

3. Business Continuity Strategies and Solutions

Auditors verify whether the organisation has carefully evaluated different recovery options and selected suitable solutions.

They also check whether the resources required to implement these solutions are actually available.

For example, if the continuity strategy involves moving operations to another location, the alternative site should have sufficient space, internet connectivity, equipment, and access to support the required activities.

4. Business Continuity Plans and Procedures

Auditors review whether the plans are practical, clear, and easy to follow during an emergency.

They look for details such as:

• Roles, responsibilities, and decision-making authority.

• Conditions for activating the continuity plan.

• Who has the authority to declare an incident.

• Communication arrangements with employees, customers, regulators, and other relevant parties.

• Clear steps for restoring prioritised business activities.

A common finding occurs when a plan does not clearly explain when and how it should be activated.

5. Exercising and Testing

This is an area where organisations often face difficulties during an audit.

ISO 22301 requires organisations to conduct appropriate exercises to check whether their continuity strategies and procedures work as intended. These exercises should match the organisation’s scope and objectives.

Auditors usually review:

• The business continuity exercise and testing programme.

• Exercise records and reports.

• Results, identified gaps, and recommendations.

• Evidence that corrective actions and improvements were completed.

Organisations should use different types of exercises where appropriate. For example, discussing a scenario in a meeting is not the same as testing whether an actual recovery site or backup system can support operations.

Auditors also look for honest reporting. If every exercise report shows perfect results with no issues identified, they may question whether the exercises were sufficiently realistic and effective.

Clause 9: Performance Evaluation

This clause covers monitoring, internal audits, and management reviews.

Auditors check whether the organisation regularly evaluates the effectiveness of its business continuity management system.

They also verify whether management reviews cover the required information, including exercise results, the status of documented procedures, and areas that need improvement.

Clause 10: Improvement

This clause focuses on managing nonconformities, taking corrective action, and continually improving the business continuity management system.

Auditors check whether the organisation identifies the reasons for problems, takes appropriate corrective action, and learns from exercises and actual incidents.

If a real disruption occurred during the audit period, auditors may ask for the post-incident review. If no review was conducted, this could lead to a significant finding because the organisation has missed an important opportunity to learn from the event and strengthen its continuity arrangements.

Common Areas Where ISO 22301 Audits Identify Findings

Two areas that frequently require attention are:

1. Business Impact Analysis based on assumptions: Recovery priorities and timeframes are decided without sufficient analysis, evidence, or input from relevant stakeholders.

2. Ineffective exercise and testing programmes: Exercises are conducted only as a formality, identified gaps are not properly addressed, or there is no evidence that the continuity arrangements can work in practice.

Both issues can be addressed through better analysis, realistic testing, proper documentation, and timely corrective action.

The key takeaway: 

ISO 22301 is not just about having a business continuity policy or documented plans. It is about demonstrating that the organisation understands its critical activities, has practical recovery arrangements, tests them regularly, and uses the results to improve its ability to manage disruptions.