The ISO 22301 standard outlines the requirements for a Business Continuity Management System (BCMS). The aim of the standard is to help organisations identify threats to their ongoing operations and prepare and test arrangements to ensure business continuity.
The current version of the standard is structured similarly to other standards such as ISO 9001. It requires organisations to prove they are well structured with clear roles and responsibilities for individuals. Additionally, organisations must demonstrate that documented information is controlled, that risks and opportunities are considered and that actions to address these are identified and implemented.
Meeting the requirements of this standard
In order to meet the ISO 22301 standard organisations are required to produce several pieces of documentation. Firstly, they must generate a business impact analysis and risk assessment to demonstrate that they have examined the risks to their operations and the potential impact these could have. Secondly the organisation will need to produce business continuity strategies and solutions to communicate how the risks to business operations will be mitigated. As part of this evidence will need to be produced to show that a programme of testing has been conducted to ensure that all potential risks to the business have been identified and that prevention and recovery systems are in place and are effective. Finally, the organisation must also produce a business impact assessment to show that it has examined all of its business-critical functions and the impact unplanned events and disruptions could have on them.
Meeting the requirements of this standard requires that an effective Business Continuity Management System (BCMS) has been prepared, that business continuity plans and arrangements are in place and that business continuity objectives are set and monitored.
We do not start you from a blank page. We bring a complete, ready-built library of management system documentation with us. Policies, procedures, registers, risk assessments, audit checklists and training material, already mapped to the clauses of ISO 22301. That material is then tailored to the way your business actually runs, rather than your business being reshaped to fit a template. It is the single biggest reason a fixed-price engagement can hold to a predictable timescale: the writing is largely done, so the work is in adapting it, implementing it and building the evidence.
See our ISO consultancy service for how onsite and remote delivery works, or our system implementation service for what the build stage involves.
How ISO 22301 certification works
We take you all the way to ISO 22301 certification, and certification is guaranteed, backed by a 100% success rate. We build the management system around the way your business already works, support you through your internal audit and management review so your team owns them, and close out anything an assessor would otherwise raise before the audit rather than after it.
The system we leave you with is integrated and meant to be used. It should not add workload or complexity to how you already run, and if it does then it has been built wrong. By the time the assessor arrives your people know the system and can answer for it, because it is theirs.
It is a fixed price, agreed before we start, with payment by milestones or monthly instalments. Consultancy clients also get our ISO and legal update service at no extra cost, so the system does not quietly go out of date once we have finished.
We help you choose the right certification body too, based on an objective review of what you actually need rather than who we happen to know: whether accreditation is required by your customers and tenders, what the full three-year cycle costs, and how quickly a body can realistically get an assessor to you. Lead times vary far more than prices do. Our guide to choosing a certification body works through all three.
Benefits of ISO 22301 Certification
- Achieve better score in pre-qualification questionnaires (PQQ’s)
- Ensure preparedness for unplanned disruptions to critical business operations
- Establish an effective Business Continuity Plan (BCP) and Business Continuity Management System (BCMS)
- Demonstrate to suppliers and other interested parties that formal systems are in place to ensure continuity of service
- Establish systems for ongoing checks of continuity arrangements