ISO 22301 business continuity: BIA, RTO and audit readiness

ISO 22301:2019 sets the requirements for a business continuity management system (BCMS): a documented, tested way of keeping your most important activities running, or restarting them within an agreed time, when something goes wrong. In practice it rests on three things: a business impact analysis that fixes recovery targets, plans that meet those targets, and regular exercises that prove the plans work.

What is ISO 22301 and who uses it?

ISO 22301 is a requirements standard, which means an organisation can be audited and certified against it. The Bureau of Indian Standards has adopted it as IS/ISO 22301:2019, identical to the ISO text, and certification is voluntary.

It is relevant to any business whose customers depend on it not stopping: IT and BPO service providers, payment and fintech companies, logistics firms, manufacturers in a supply chain, hospitals, and firms that process accounts or payroll for overseas clients. Large customers increasingly ask suppliers about continuity arrangements in vendor due diligence, and a certificate is one way to answer.

How is the standard structured?

ISO 22301 follows the common structure used by ISO 9001 and ISO/IEC 27001, so a business already certified to one of those can integrate it rather than start afresh.

Clause	What it requires
4 Context	Internal and external issues, interested parties, legal requirements, BCMS scope
5 Leadership	Top management commitment, business continuity policy, roles
6 Planning	Risks and opportunities, business continuity objectives
7 Support	Resources, competence, awareness, communication, documented information
8 Operation	BIA and risk assessment, strategies, plans and procedures, exercises
9 Performance evaluation	Monitoring, internal audit, management review
10 Improvement	Nonconformity, corrective action, continual improvement

Clause 8 is where most of the real work sits, and where certification auditors spend most of their time.

What is a business impact analysis?

The business impact analysis (BIA) is the core of the standard. For each activity that supports your products and services, you assess what happens over time if it stops: lost revenue, penalties under contracts, regulatory breaches, harm to customers and damage to reputation. From that you set:

Term	Meaning	Example (payroll processing)
MTPD – maximum tolerable period of disruption	The point after which the impact becomes unacceptable	3 working days before salary date
RTO – recovery time objective	Target time to resume the activity; must be shorter than MTPD	1 working day
RPO – recovery point objective	Maximum data loss acceptable, measured in time	Last 4 hours of input
MBCO – minimum business continuity objective	Minimum level of service acceptable during disruption	Salary credit for all employees, reports later

The examples are illustrative; each business must arrive at its own figures with the people who run the activity. Guidance on carrying out a BIA is in ISO/TS 22317:2021, also adopted by BIS.

The risk assessment then asks what could cause those activities to stop: loss of a site, power or internet failure, a cyber incident, a key supplier failing, or loss of key people.

How do strategies and plans follow from the BIA?

Strategies are the choices that let you meet the RTO and RPO at an acceptable cost: an alternate site or work from home, cloud backups with a defined frequency, a second supplier, cross-trained staff. The plans then set out who does what, in what order, with contact lists and decision authority. A plan that cannot be followed by a stand-in at 2 a.m. is not finished.

What did Amendment 1:2024 add?

ISO published ISO 22301:2019/Amd 1:2024 on 23 February 2024, together with similar amendments to other management system standards. It requires the organisation to determine whether climate change is a relevant issue in its context, and adds a note that interested parties can have climate-related requirements. For a business in a flood-prone area, or one that depends on outdoor logistics in extreme heat, the answer is likely yes, and it should then flow into the risk assessment.

What do certification auditors check?

Certification is done by a certification body, not by ISO. Look for one accredited for ISO 22301 by an IAF-member accreditation body, and verify the certificate afterwards. The usual cycle is a stage 1 review of documents and readiness, a stage 2 audit of implementation, then surveillance audits, normally every year, within a three-year certificate.

Auditors commonly look for:

• a BIA that is signed off and reviewed, not a one-time exercise
• RTOs that the chosen strategies can actually achieve
• exercise records showing what was tested, what failed and what was fixed
• an internal audit and a management review that covered the BCMS
• clear scope, including which sites and services are excluded and why

The general certification route, and how to spot certificates that buyers will not accept, is covered in our earlier article on what the ISO standard requires. The ISO certification page sets out the standards covered.

The information in this article reflects the law as on the date of publication and is for general guidance only.

CA. Kunal Darwani

Frequently asked questions