ISO22301CERTIFICATION.COM
ISO 22301 / Business continuity
ISO 22301 certification:
the process, step by step.
Understand application, preparation, Stage 1, Stage 2, the certification decision and your ongoing audit cycle.
04 / Your certification journey
From first conversation
to ongoing confidence.
A structured process, an independent assessment and a commitment to maintaining your BCMS.
Step 01 / Scope & application
Start with the right scope.
Describe the legal entity, activities, people, sites and certification objective. The certification body reviews the formal application.
- Clarify locations, boundaries and critical services
- Identify a body with appropriate competence and scope
- Review the proposed audit program and fees
Step 02 / Prepare your BCMS
Build and operate the system.
Establish the processes and capabilities your BCMS needs. Preparation should produce evidence of implementation, not just a collection of templates.
- Complete BIA and disruption risk assessment
- Implement strategies, plans and response arrangements
- Exercise, internally audit and review the system
Step 03 / Stage 1 audit
Confirm preparedness for assessment.
The certification body reviews the documented arrangements, scope and relevant site circumstances to evaluate readiness and plan Stage 2.
- Review scope and documented management arrangements
- Identify concerns that may affect Stage 2 readiness
- Agree audit planning and address identified gaps
Step 04 / Stage 2 audit
Assess implementation and effectiveness.
Auditors examine how the BCMS operates, using interviews, records and sampling of the activities and sites within scope.
- Demonstrate the implementation of continuity arrangements
- Show exercises, reviews and corrective-action evidence
- Respond to findings under the body’s agreed process
Step 05 / Certification decision
An independent decision follows.
The body reviews the audit outcome and necessary corrective-action evidence. Authorized personnel separate from the audit delivery make the certification decision.
- Resolve nonconformities as required before the decision
- Confirm the certificate’s legal entity, scope and sites
- Obtain the issuer’s verification information
Step 06 / Maintain & renew
Keep the BCMS working.
Surveillance checks ongoing conformity. Recertification reviews the system for the next cycle, with the required actions and decision completed in time.
- Keep plans and capabilities current as circumstances change
- Complete surveillance under the agreed audit program
- Plan recertification early to avoid a lapse
The typical certification cycle
Initial certification
Stage 1 · Stage 2 · Decision
Year 1
First surveillance
Year 2
Continued surveillance
By cycle end
Recertification decision
The first surveillance is within 12 months of the initial certification decision. Surveillance is generally at least once per calendar year, except in the recertification year. The body determines the audit program; certification may be suspended or withdrawn before expiry.
Make your next step clear.
Prepare your scope and discuss an independent certification connection.
ISO22301CERTIFICATION.COM