ISO 22301 Audit Checklist

Use this ISO 22301 Audit Checklist to evaluate business continuity management systems, ensure compliance, and enhance resilience against disruptions.

Download as free PDF

Library
ISO Standards
ISO 22301 Audit Checklist

Clause 4 - Know Your Organization

Clause 4 - Limit Your BCMS To What Really Matters

Clause 5 - Make Sure Your Top Management Is Committed To Business Continuity

Clause 6 - Have Some Objectives

Clause 7 - Are Your Resources Capable, Competent, And Sufficient?

Clause 8 - Conduct A Business Impact Analysis

Clause 8 - Conduct A Risk Assessment

Build Business Continuity Strategies And Solutions

Procedures

Plans

Recovery To Normal Operations

Test, Test, And Test Again

Clause 9 - Continuously Monitor Your Business Continuity Performance

Clause 10 - Continuously Improving

Is this sample what you are looking for?
Sign up to use & customise this template, or create your own custom checklist:

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 22301 Audit Checklist

Use this ISO 22301 Audit Checklist to evaluate business continuity management systems, ensure compliance, and enhance resilience against disruptions.

1. What are the internal and external issues that drive the need for business continuity planning?

2. Who are the stakeholders and what are their requirements?

3. What relevant laws and regulations apply, and what is the process for managing them?

1. Which parts of the organization should be included in the scope?

2. What outputs (products and services) should be included in the scope?

3. What exclusions need to be documented and explained?

1. Has a Business Continuity Policy been written?

2. Has the policy been disseminated to everyone affected by it, both internal and external?

3. Have the roles and responsibilities for business continuity been defined?

4. Is there a senior leadership individual responsible for the BCMS, and have their responsibilities been documented?

1. What are the risks and opportunities at the organizational level?

2. What actions are needed to address the risks and opportunities, and how will they be implemented into operational processes?

3. What are the business continuity objectives, what is needed to achieve them, and who is responsible?

4. How will performance towards the business continuity objectives be monitored and measured?

5. Are change control processes for the BCMS in place?

1. What resources (personnel, technology, infrastructure) are required, and what knowledge and skills are needed for personnel?

2. Are the required resources, knowledge, and skills present in the organization?

3. Is there a communications plan for the wider organization and external interested parties?

4. Is everything required by the standard documented, including any additional necessary items, and is there a process for controlling changes to documents?

1. What are the impacts and their criteria for performing the Business Impact Analysis (BIA), and how will this ensure consistency and repeatability?

2. What are the key activities that comprise your products and services?

3. What are the internal and external resources required to deliver these products and activities, including personnel, equipment, technology (IT), supplies, and infrastructure?

4. How will the criteria be used to determine the business impact over time on the key activities?

5. What is the maximum tolerable period of disruption (MTPD) before business impacts become unacceptable?

6. What are the timeframes for recovering activities to minimum acceptable levels (MBCO)?

7. What are the impacts and their criteria for performing the BIA, and how will this ensure consistency and repeatability?

8. What are the key activities that comprise your products and services?

1. Is a risk assessment considered?

2. Are the risks for treatment prioritized which drives the business continuity strategies and then the plans?

1. Do the strategies address the risks and requirements of the BIA?

1. How should the crisis management team(s) be established to address immediate steps and cope with ambiguity in an incident?

2. Is a crisis management team established?

3. Are the roles and responsibilities of the crisis management team(s) clearly defined?

4. What response structure should be defined for the responsible team?

5. How should internal and external communications be managed during a crisis?

1. What guidance should be provided to teams on how to respond, including the order of activities?

2. What criteria should be specified for invoking activities?

3. What actions need to be taken to protect the welfare of individuals?

4. What actions need to be taken during a crisis?

1. Are plans and processes developed to ensure a smooth transition from the disaster recovery phase to normal operation?

1. Is an exercise program used to ensure the plans work and to prevent knowledge fade?

2. Are the organization’s capabilities evaluated as an essential part of the continual improvement cycle required by the standard?

1. Do you know what you should measure, by whom, how, and by when?

2. Do you need an ongoing internal audit program and regular management reviews?

1. Is there a process to control them?

2. Is there a process to fix them?

3. Is there a process to understand why they went wrong?

4. Is there a process to prevent it from happening again?