Home Certification ISO 22301
BUSINESS CONTINUITY
ISO 22301 certification
A business continuity management system connects important activities with disruption planning, response responsibilities and evaluation. Identify the services you need to maintain or recover, their dependencies and the evidence available from exercises and review.
AT A GLANCE
STANDARD REFERENCE
ISO 22301:2019
Business Continuity Management System
ASSESSMENT SUBJECT
Your management system
Certification applies to the agreed organizational scope.
Your application identifies the edition, activities and sites to be assessed.
UNDERSTAND THE STANDARD
What is ISO 22301 certification?
ISO 22301 addresses business continuity management systems. It concerns the arrangements an organization establishes to prepare for, respond to and recover from disruption within its scope. Certification does not guarantee uninterrupted service under every possible circumstance.
Identify which activities must continue, how a disruption affects them and what resources and dependencies they rely on. A continuity plan should connect business priorities with practical arrangements. A document that lists emergency telephone numbers is not, by itself, a complete description of the management system.
START WITH THE BOUNDARY
Make the scope clear.
Describe the services, sites, organizational functions and dependencies included. Be clear about operations provided by other group entities or suppliers. If a customer relies on a particular service, check that the proposed scope meaningfully addresses the organization’s role in delivering it.
FROM INTENT TO EVIDENCE
Show how your system works.
These are examples of relevant information, not a universal list of mandatory documents. The evidence depends on your activities and applicable requirements.
01
Business impact analysis and risk-related information appropriate to the scope.
02
Continuity strategies, plans and assigned responsibilities.
03
Exercises or other suitable evaluations and their results.
04
Actions taken to address lessons, changes and management review outcomes.
A PRACTICAL EXAMPLE
Put the scope into context.
An organization may have an alternative workplace but depend on a specialist supplier that has no substitute. The useful planning question is whether its continuity assumptions address that dependency. An enquiry should make those interfaces visible rather than treating recovery of office space as the whole objective.
Use this example to prepare your own scope and evidence.
HOW CERTIFICATION WORKS
A clear route from enquiry to decision.
01
Scope & application
Describe the activities, sites and standard you want assessed.
02
Assessment planning
Agree arrangements based on the application and programme.
03
Audit & response
Demonstrate the system and address findings with evidence.
04
Decision & review
Certification follows a decision, with continuing assessment as applicable.
An application or completed audit does not guarantee certification.
EDITION & APPLICATION
Confirm the right basis for assessment.
The planning reference is ISO 22301:2019. Applicable amendments, transition arrangements and the edition for your application must be confirmed before assessment is agreed.
Check the official ISO publication information. Use the official publication record to check the edition and related amendments.
CONNECTED MANAGEMENT NEEDS
Considering several standards?
Shared processes can support a coordinated system. Explain the common boundaries and the differences.
FREQUENTLY ASKED QUESTIONS
ISO 22301: frequently asked questions
Clear answers before you take the next step.
Is business continuity certification the same as a disaster recovery test?
No. Disaster recovery can be part of a wider continuity approach, particularly for technology, but certification concerns the management system within its stated scope. A successful isolated test does not establish every aspect of continuity capability.
Does certification guarantee that services will never stop?
No. Business continuity management concerns preparedness, response and recovery arrangements. A certificate cannot guarantee performance under every disruption.
Why do supplier dependencies matter?
A recovery plan may depend on services, people or materials supplied by another organization. Explain those dependencies and the assumptions behind the planned response.
Can ISO 22301 be assessed with other standards?
Other systems may share responsibilities or processes with ISO 22301, but each retains its own requirements. Explain the intended standards, sites and boundaries when discussing an integrated assessment.
What affects the cost and timing of ISO 22301 certification?
The scope, activities, personnel, locations and applicable programme determine the proposed assessment work. Readiness and responses to findings also affect timing. Request a quotation based on your actual organization.
START WITH YOUR ORGANIZATION
Discuss ISO 22301 with EQRM.
Tell us your activities, locations and ISO 22301 requirements. We’ll review availability and the scope of the proposed engagement.