ISO 22301 Business Continuity Audit Checklist Template

What the ISO 22301 Business Continuity Audit Checklist Covers

1. 1
   Phase 1

   Phase 1: Plan the Audit from the Programme

   7 tasks

   Each internal audit is one entry in your BCMS audit programme. Answer the setup questions on the first task first: the audit type, how it is carried out, whether outsourced activities are in scope and whether an exercise was held decide which tasks and notes appear. The planning tasks count back from the opening meeting date.

   • Set up the BCMS internal audit run — the organisation and sites, the audit reference, the part of the BCMS and the clauses in scope, the audit type, on-site or remote, outsourced activities, whether an exercise was held, the opening meeting date and the three people; later tasks are assigned from these fields
   • Record why the programme scheduled this audit now — the importance of the processes and sites in scope, the results of earlier audits, and any change, disruption or exercise result that brought it forward
   • Set the audit objectives, scope and criteria — ISO 22301:2019 and its 2024 amendment, your own BCMS documents, the legal, regulatory and contractual requirements the BCMS has to meet, and the sites, activities and period the audit covers
   • Confirm the auditors are objective and impartial — no auditor audits their own work, such as the person who wrote the business impact analysis or owns a plan in scope, and the record says how that was checked
   • Check each auditor’s competence record — training in auditing management systems, knowledge of ISO 22301 and business continuity, and enough knowledge of the activities and sites audited
   • Pull earlier findings and open actions for the areas in scope — the last internal audit, open corrective actions, certification body findings, and actions from exercises, incidents and the last management review
   • Check the programme has covered the whole BCMS before certification — shown for a pre-certification audit: every clause and every part of the BCMS scope audited at least once in the programme, earlier findings closed or on track, and a management review held, so the certification body sees a complete cycle
2. 2
   Phase 2

   Phase 2: Review the BCMS Documents and Write the Audit Plan

   7 tasks

   Read the BCMS documents before fieldwork, so the audit tests what people do against what the documents say. Choose now which business impact analysis records, plans and exercise reports to sample. The remote audit task appears when the audit is remote or partly remote.

   • Review the BCMS scope, policy and objectives documents — check they are current and approved, and note the products, services, sites and exclusions the scope names, to test in fieldwork
   • Choose the business impact analysis and risk assessment records to sample — a sample of activities across the sites and departments in scope, including the ones the organisation treats as most urgent to resume
   • Choose the business continuity plans and procedures to sample — at least one plan for each site or team in scope, plus the incident response arrangements that sit above them
   • Review exercise, incident and corrective action records since the last audit — post-exercise reports, real disruptions and how they were handled, and late or repeated corrective actions, which become audit trails to follow in fieldwork
   • Write the audit plan by clause, site and auditor — who is audited when, which records are sampled, and which auditor covers each clause group and site
   • Test the remote audit set-up — shown for a remote or partly remote audit: the meeting tool, screen sharing and access to records agreed with the BCMS manager, a test call held, and how confidential plans and contact lists will be shown without copies being kept
   • Send the audit plan to the BCMS manager — agree the times, the people who must be available and the records to have ready
3. 3
   Phase 3

   Phase 3: Opening Meeting, Context and Leadership (Clauses 4 and 5)

   6 tasks

   Clauses 4 and 5 cover the context of the organisation, the scope of the BCMS, and leadership. Sample real records and talk to the people who do the work, not only the BCMS manager.

   • Hold the opening meeting — confirm the objectives, scope, criteria and plan, how findings will be graded, how confidential information is handled and when the closing meeting is
   • Audit the context, interested parties and their requirements — the internal and external issues the organisation has identified, including whether climate change is a relevant issue, the interested parties and their requirements, and the legal, regulatory and contractual requirements the BCMS must meet (clause 4)
   • Audit the scope of the BCMS — the scope is documented, names the products, services, sites and parts of the organisation it covers, explains any exclusion, and matches what the plans actually cover (clause 4)
   • Audit leadership and commitment — top management’s part is evidenced, for example in setting the policy and objectives, providing resources and taking part in management review, not only signing the policy (clause 5)
   • Audit the business continuity policy — documented, approved, communicated within the organisation and available to interested parties as appropriate, and consistent with the objectives (clause 5)
   • Check roles, responsibilities and authorities — who is responsible for the BCMS and for each plan is assigned and known, including who can invoke a plan and who deputises, and the people named are still in post (clause 5)
4. 4
   Phase 4

   Phase 4: Planning and Support (Clauses 6 and 7)

   8 tasks

   Clause 6 covers risks and opportunities, objectives and changes to the BCMS; clause 7 covers resources, competence, awareness, communication and documented information. Ask the people with roles in the plans what they would do, not only whether they were trained.

   • Audit actions to address risks and opportunities to the BCMS — risks and opportunities to the BCMS itself are identified, actions are planned and built into its processes, and their effectiveness is checked (clause 6)
   • Audit business continuity objectives and plans to achieve them — objectives are measurable where practicable, consistent with the policy, monitored and updated, with what will be done, by whom and by when (clause 6)
   • Check changes to the BCMS were planned — changes since the last audit, such as a new site, a restructure or a new critical supplier, were made in a planned way, and the BIA and plans were updated to match (clause 6)
   • Audit resources for the BCMS — the people, budget, premises and equipment the BCMS and its plans rely on are provided, including any alternative site or work-from-home arrangement the plans assume (clause 7)
   • Sample competence records for people with plan roles — for a sample of people named in the plans, the competence their role needs, the training or exercise experience they had, and evidence it was effective (clause 7)
   • Check awareness of the policy and of each person’s role — interview staff in the areas audited: do they know the policy, their part in a disruption, how they would be contacted and what happens if they do not follow the plan (clause 7)
   • Audit internal and external communication — what is communicated, when, to whom and by whom, including warning and communication arrangements during a disruption, and contact lists kept up to date (clause 7)
   • Audit control of documented information — BCMS documents are approved, versioned, reviewed, protected and available where and when needed, including copies of plans that can be reached when the usual systems or premises are not available (clause 7)
5. 5
   Phase 5

   Phase 5: Operation (Clause 8)

   9 tasks

   Clause 8 is where the BCMS does its work: the business impact analysis, the risk assessment, the strategies and solutions, the plans, the exercise programme and their evaluation. Trace real records from the analysis through to the plan and the last exercise. The exercise and outsourcing tasks appear only when the first task puts them in scope.

   • Audit operational planning and control — the processes the BCMS needs are planned, run and controlled as the BCMS documents say, changes to them are controlled, and outsourced processes relevant to the BCMS are controlled (clause 8)
   • Sample the business impact analysis — for each activity sampled, the impacts of a disruption over time were assessed, a recovery priority and timeframe were set, the dependencies and resources it needs are recorded, and the analysis was reviewed when the documents say
   • Sample the risk assessment of disruption — the risks of disruption to the prioritised activities and their resources are identified, analysed and evaluated, and a treatment is chosen for each one the organisation decided to treat
   • Audit the business continuity strategies and solutions — the options chosen to continue or recover each prioritised activity are based on the BIA and risk assessment, the resources they need are in place, and any gap was approved by the right person
   • Sample the business continuity plans and procedures — each plan sampled has an owner, matches the current BIA and strategy, says who invokes it and how, covers warning and communication, and gives steps a person could follow during a disruption
   • Audit the exercise programme — exercises are planned at intervals with defined objectives and scenarios, cover the plans and strategies in scope over time, and their findings lead to changes
   • Sample a post-exercise report and its actions — shown when an exercise was held since the last audit: the report records what was tested, what worked and what did not, and each action from it has an owner, a date and evidence it was done
   • Audit the evaluation of business continuity documentation and capabilities — the BIA, risk assessment, strategies, solutions and plans are evaluated for suitability, adequacy and effectiveness at planned intervals, after exercises and incidents and after significant change, and the results are acted on
   • Audit outsourced activities and suppliers in the BCMS — shown when outsourced activities or suppliers are in the scope: the suppliers that prioritised activities depend on are identified, their own continuity arrangements were checked, and the contracts or agreements say what they will provide during a disruption
6. 6
   Phase 6

   Phase 6: Performance Evaluation and Improvement (Clauses 9 and 10)

   4 tasks

   Clause 9 covers monitoring and measurement, internal audit and management review; clause 10 covers nonconformity, corrective action and continual improvement. Auditing the audit programme itself is part of this phase.

   • Audit monitoring, measurement, analysis and evaluation — what is measured to judge the BCMS, how and when, who analyses the results, and how its performance and effectiveness are evaluated (clause 9)
   • Audit the internal audit programme — audits are held at planned intervals, the programme weighs the importance of the processes and earlier results, each audit has objectives, criteria and scope, auditors are objective and impartial, and results reach the relevant managers (clause 9.2)
   • Sample the last management review — held at the planned interval by top management, covering the inputs your procedure requires, such as audit, exercise and incident results, and its decisions and actions recorded and followed up (clause 9.3)
   • Audit nonconformity, corrective action and continual improvement — a sample of nonconformities from audits, exercises and incidents shows the reaction, the cause found, the action taken and a review of its effectiveness, and the BCMS is improved over time (clause 10)
7. 7
   Phase 7

   Phase 7: Grade the Findings, Report and Sign-off

   6 tasks

   Write each finding so the BCMS manager can find the same evidence again. The answer to “Which nonconformities were raised?” decides whether Phases 8 and 9 appear. The audit sponsor signs off the report, and nothing after the sign-off can be completed until they do.

   • Write and grade each finding — the requirement, the objective evidence and the gap for each finding, graded with your audit procedure’s definitions, such as major nonconformity, minor nonconformity or opportunity for improvement
   • Agree the facts with the BCMS manager — go through each finding before the closing meeting, so the facts are agreed even when a grade is disputed
   • Hold the closing meeting — present the findings and the audit conclusion, raise anything that cannot wait for the report, agree dates for corrective action and record who attended
   • Write the audit report — the objectives, scope and criteria, what was sampled, the findings with their evidence and grades, the conclusion on whether the BCMS conforms and is effectively implemented and maintained, and anything that could not be checked and why
   • Audit sponsor signs off the audit report — Approved, Approved with changes or Not approved, with any changes or reasons recorded; nothing after this task can be completed until the decision is recorded
   • Report the results to management review and update the audit programme — send the report to the managers of the audited areas and as an input to the next management review, record the audit as done and adjust when these areas are audited next
8. 8
   Phase 8

   Phase 8: Corrective Action Plan

   4 tasks

   Appears only when the audit raised a nonconformity. A correction deals with the problem found; corrective action removes its cause so it does not recur or occur elsewhere. A major nonconformity adds the lead auditor’s review of its plan.

   • Correct each nonconformity and deal with its consequences — fix what was found, such as an out-of-date contact list or a plan with no owner, and decide whether anything relying on it, such as another plan, needs a check now
   • Find the root cause of each nonconformity — and check whether similar nonconformities exist, or could occur, in other plans, sites or teams
   • Write the corrective action plan — for each nonconformity, the action, an owner, a due date and how its effectiveness will be checked
   • Lead auditor reviews the plan for each major nonconformity — shown when a major nonconformity was raised: the action deals with the root cause, the dates are realistic for the risk, and the effectiveness check would show the problem is gone
9. 9
   Phase 9

   Phase 9: Follow-Up and Verification

   4 tasks

   Appears only when the audit raised a nonconformity. A finding stays open until the auditor has seen evidence that the action worked. Leave time for the changed process to produce new records, or for a plan to be exercised, before you check.

   • Implement the corrective actions — by their due dates, with evidence filed against each one, and changes to the BIA, plans or other BCMS documents made through document control
   • Hold a follow-up audit of each major nonconformity — shown when a major nonconformity was raised: re-audit the requirement that failed, on site or remotely, with records made after the change
   • Verify each action was effective — sample records made after the change, or the results of the next exercise, and reopen the finding if the problem comes back
   • Close the findings and file the audit record — the plan, notes, evidence, report, sign-off, corrective actions and verification kept together as the record of this audit