ISO 22301 audit of your business continuity system
An ISO 22301 audit checks whether, after a ransomware attack, a server room fire or a supplier going under, your organization will be back at work within the time it has itself defined as acceptable. It's for organizations where a few hours of downtime means real losses. You get a report of nonconformities against ISO 22301:2019 and a list of fixes ranked by business impact.
- A BIA assessed for processes and suppliers, not just IT
- RTO and RPO checked against how long restores really take
- A continuity plan checked with the people who will carry it out
Your contact:Bartosz MachnikUpdated:
What ISO 22301 is and what the audit checks
ISO 22301:2019 is the international standard for business continuity management systems (BCMS). It requires you to decide which activities must come back first and how quickly, and then to exercise and improve that capability over time. Certification is voluntary. Even so, banks ask their suppliers for a business continuity plan, and buyers ask for one in tenders.
An ISO 22301 audit, also called a business continuity audit or BCMS audit, compares what your organization has written down with what it can actually do. We read your BIA, strategies and plans, then talk to the people who will have to carry them out. That way the gaps show up during the audit, not during an outage.
Business continuity is also a legal requirement. NIS2, which Poland implements through the KSC Act, places it on essential and important entities, and DORA requires financial entities to have ICT business continuity plans and to test them. None of these laws requires ISO 22301 certification, but the standard gives you a structure to build their requirements on.
When to order a business continuity audit
- You're starting to implement ISO 22301 and want to know how far you are from its requirements
- You're heading for ISO 22301 certification and want to know about nonconformities before the certification body finds them
- You need the internal audit required by clause 9.2 and want it run by someone outside the team that built the system
- NIS2 or DORA requires you to have business continuity plans, and you want them checked before a supervisor does
- You want to check the business continuity of a supplier your organization depends on
The audit checks your system, documents and records, but it doesn't simulate an attack. To test backup restores and incident response readiness in practice, choose a ransomware simulation. If you run an ISO 27001 ISMS and cover continuity only through its controls (A.5.29 and A.5.30), an ISO 27001 audit is enough.
What an ISO 22301 audit covers
The audit covers the requirements of ISO 22301:2019, from the context of the organization to improvement. We spend the most time on six areas where plans most often drift away from what the organization can actually do.
BIA, RTO and RPO (clause 8.2)
We check that the BIA covers all prioritized activities, processes and suppliers, not just IT systems. RTO and RPO should be set by process owners and approved by management, because values copied from a template fall apart at the first question about where they came from.
Continuity strategies (clause 8.3)
We compare the RTO with what the organization can actually do: if restoring the database takes 12 hours, a 4-hour target is unrealistic. We also check whether the strategy covers losing a data center or a main supplier.
Business continuity plan (clause 8.4)
A plan should name specific people and their deputies and refer to the incident response procedure. We check whether the team can activate it when company email and chat are down.
Exercises and tests (clause 8.5)
A plan nobody has exercised is a hypothesis. We read the post-exercise reports and check whether the lessons learned made it back into the plans.
Backups and restores
Ransomware groups usually start by deleting backups. We check whether backups are separated from the domain and the production network, and when someone last restored a whole system from them, not just a single file.
Management review (clause 9.3)
We check whether top management sees exercise and audit results, approves recovery requirements and assigns resources to the fixes. If none of this shows up in the review minutes, the system exists only on paper.
How the audit works
Audit type and scope
We agree what you need: a gap analysis, an internal audit, a pre-certification audit or a supplier audit. We choose the services, sites and people to interview.
Document review
We read your business continuity policy, BIA, risk assessment, strategies, plans and exercise reports. At this stage it's already clear whether your RTO and RPO are justified.
Interviews and evidence
We talk to top management, process owners, IT and the people named in the plans. We check the evidence: restore test records, exercise reports and how backups are separated.
Report and debrief
Every nonconformity in the report comes with the clause, the evidence and a recommendation. We go through the results with your team and management.
Support after the audit
If you want, we help you close the nonconformities and stay with you during the certification audit. The certificate is issued by an accredited certification body, not by PWNONE.
What the audit is based on
- ISO 22301:2019, from the context of the organization (clause 4) to improvement (clause 10)
- ISO 22313:2020 guidance on applying the requirements of ISO 22301 in practice
- Legal requirements where they apply: NIS2 (Article 21(2)(c)), Poland's KSC Act and DORA (Article 11)
- Your customers' and contractual requirements (clause 4.2), such as recovery times promised in an SLA
- Objectivity and impartiality, as required by clause 9.2: auditors don't assess their own work
What you get after the audit
- A nonconformity report against ISO 22301:2019, each finding with its clause and evidence
- Recommendations ranked by business impact, not by the order of the standard's clauses
- Your stated RTO and RPO compared with the results of restore tests
- A debrief with management and a report you can use in the management review (clause 9.3)
- For a supplier audit: an assessment of whether the supplier's continuity covers your RTO and RPO
Frequently asked questions
What does an ISO 22301 audit involve?
An ISO 22301 audit checks whether a business continuity management system meets the requirements of ISO 22301:2019 and works in practice. The auditor reads the BIA, strategies, continuity plans and exercise reports, interviews process owners and compares the stated RTO with the results of restore tests. The outcome is a report of nonconformities with recommendations. It can be a gap analysis, an internal audit, a pre-certification audit or a supplier audit.
What is a business impact analysis (BIA)?
A business impact analysis (BIA) shows what happens when a process or service stops and how the impact grows over time. Based on it, the organization chooses its prioritized activities and sets their RTO, meaning how quickly they must be back, and RPO, meaning how much data it can afford to lose. ISO 22301 covers the BIA in clause 8.2, but neither the standard nor NIS2 sets specific RTO or RPO values. A good BIA also covers suppliers and dependencies between processes, not just IT systems.
What should a business continuity plan include?
A business continuity plan sets out who restores prioritized activities after a disruption, when and how. Under ISO 22301 (clause 8.4) it includes, among other things, the team's roles, activation criteria, recovery steps within set time frames, required resources, dependencies on suppliers and communication arrangements. It should name specific people along with their deputies and be usable even when company email is down. Without exercises, nobody knows whether it will work.
Is ISO 22301 mandatory?
No. Certification is voluntary, and neither NIS2 nor DORA requires you to use this standard. Business continuity itself can be mandatory, though: NIS2 requires it of essential and important entities, and DORA requires financial entities to have ICT business continuity plans and to test them. ISO 22301 gives you a ready-made structure to build those requirements on.
What is the difference between ISO 22301 and ISO 27001?
ISO 27001 is about information security and touches on business continuity in a few controls, such as A.5.29 and A.5.30, from an information and IT perspective. ISO 22301 covers the whole organization, including processes, people and suppliers. Both standards share the same clause structure, so internal audits and management reviews can be run jointly.
Who issues ISO 22301 certification?
ISO 22301 certificates are issued by an accredited certification body after its own certification audit. PWNONE does not issue certificates. We run the internal audits the standard itself requires (clause 9.2) and pre-certification audits, so you know what to fix before the certification body arrives. You can also run the internal audit in-house, as long as the auditor isn't assessing their own work.
Talk to Bartosz Machnik about your ISO 22301 audit
Bartosz Machnik, CBDO at PWNONE, will agree the audit type and scope with you: which services, sites and suppliers your business continuity system covers. If a smaller scope, such as a gap analysis on its own, is enough, he'll tell you so. The audit itself is led by an ISO 22301 Lead Auditor from our team.
Book a call about an ISO 22301 audit