ISO 22301 BIA and exercise planning checklist: the first BCMS cycle, step by step, with the evidence auditors look for

Before the first workshop: scope, sponsor and criteria

These items settle what the analysis covers and how severity will be judged. Skipping them is the most common reason a BIA has to be repeated.

• The scope of the BCMS is written, naming the products and services, sites and organisational units covered, and the analysis is planned against exactly that scope. Evidence: a scope statement that matches the certification application and the list of activities analysed.
• Client, contractual and regulatory continuity obligations for the products and services in scope are listed, so the analysis can test impacts against them. Evidence: a register of obligations with the contract or regulation each one comes from.
• A management sponsor is appointed with authority to approve the criteria, the results and the money that follows. Evidence: a role assignment or terms of reference signed by top management.
• The impact types and criteria relevant to the organisation, such as client, financial, legal and regulatory, reputation and people, are defined as a graded scale and approved by top management before any activity is rated. Evidence: the approved criteria with the approval date earlier than the first workshop.
• The BIA method is documented: who takes part, the time points used to assess impact, how results are recorded, who approves them and when they are reviewed. Evidence: a short method statement or procedure under document control.
• Workshop participants are confirmed for each area in scope: the manager and someone who actually does the work, plus IT, facilities and procurement leads for resources. Evidence: a schedule with names, dates and attendance.
• Existing material is gathered so it is reused, not rewritten: earlier continuity plans, an ICT continuity analysis prepared for ISO/IEC 27001, incident history and client recovery commitments. Evidence: an inventory of inputs with what was kept and what was replaced.

Running the business impact analysis

Work outward from what the organisation delivers. The order below mirrors what clause 8.2 expects the analysis to produce.

• Every product and service in scope is listed, and the activities that deliver or support each one are identified, including internal functions such as scheduling or payroll where a client-facing activity depends on them. Evidence: a product-to-activity map with no product or service left without activities.
• For each activity, the impact of a disruption is assessed at each agreed time point using the approved criteria, not each owner's own judgement. Evidence: completed BIA records showing an impact rating per criterion per time point.
• The reasoning behind each rating is captured, such as the contract clause, the regulatory deadline or the seasonal peak. Evidence: notes or references against the ratings that a reviewer can follow.
• For each activity, the point after which not resuming it becomes unacceptable is identified, and a shorter time frame for resuming it at an acceptable level is set within it. Evidence: both values recorded per activity. Most BIA methods call them the maximum tolerable period of disruption (MTPD) and the recovery time objective (RTO); any terms will do if the BIA method defines them and uses them consistently.
• Where data matters, the point to which information must be restored is agreed, along with the minimum capacity the activity needs to run at during a disruption. Evidence: a recovery point objective (RPO) and a minimum acceptable capacity per activity, agreed with the data owners and defined in the BIA method.
• Activities are prioritised from the results, and the list shows a real order rather than a register in which almost everything is critical. Evidence: a ranked list of prioritised activities that management can read in a few minutes.
• The resources each prioritised activity needs are recorded: people and skills, workspace, information and data, applications, equipment, transport and finance. Evidence: resource lists per activity at the minimum acceptable capacity, not normal staffing.
• Internal and external dependencies are identified, including partners, outsourced providers and single-source suppliers. Evidence: a dependency list naming each supplier and the activity that relies on it.
• Dependencies are checked for consistency: no system, team or supplier is given a longer recovery time than the activity that needs it. Evidence: a cross-check or reconciliation sheet, with the inconsistencies found and how each was resolved.
• Each recovery time is compared with what current arrangements can actually deliver, and the shortfalls are stated. Evidence: a capability comparison per prioritised activity, showing the gap in hours or days.
• Top management has reviewed and approved the prioritised activities and their time frames. Evidence: signed approval or minutes recording the decision, with the date.

Business impact analysis: how to run one management will act on

Handing the results to the risk assessment

The risk assessment is part of the same clause and starts where the analysis stops: it looks at what could disrupt the prioritised activities and the resources they need.

• The risk assessment uses the prioritised activities and their resources as its subject, rather than a generic corporate risk list. Evidence: risk entries that each point to a prioritised activity or resource from the BIA.
• Risks of disruption are identified across people, sites, technology, information and suppliers, including the single points of failure the dependency work revealed. Evidence: a risk register showing the source of each risk.
• Each risk is analysed and evaluated using a stated method, so ratings can be repeated by someone else. Evidence: the risk criteria and a register in which each rating can be traced to them.
• The risks that require treatment are decided and recorded, with the reasoning for those accepted. Evidence: treatment decisions with an owner, and acceptance signed by the right level of management.
• Where an ISO/IEC 27001 risk assessment already exists, the two are reconciled so a single threat is not rated differently in each. Evidence: cross-references between the registers, or a note of how they are aligned.
• The scenarios that matter most are shortlisted for the exercise programme. Evidence: a scenario shortlist taken from the highest-rated risks.

Preparing the strategy decision

Clause 8.3 belongs to management, but the continuity lead prepares the inputs. These items make sure the decision is taken on the analysis, not on a supplier's offer.

• For each shortfall between required and current recovery capability, options are identified for before, during and after a disruption. Evidence: an options list linked to the shortfalls in the capability comparison.
• Options are compared on the capacity they deliver, the time frame they meet, the resources they need, their costs and benefits and how they fit the organisation's appetite for risk. Evidence: a comparison table for each prioritised activity.
• The resource needs of each option are spelt out: people, information and data, infrastructure, equipment, ICT, transport, finance and suppliers. Evidence: resource requirements attached to each recommended option.
• Management selects the strategies and solutions and records the decision, including any shortfall it chooses to accept. Evidence: minutes or a decision record with owners and dates.
• Selected solutions are actually implemented, not only described, before the plans that rely on them are exercised. Evidence: contracts, configuration records, purchase approvals or a completed implementation plan.
• Business continuity objectives under clause 6.2 reflect the approved time frames and the exercise coverage you intend to achieve. Evidence: objectives with targets, owners, dates and how each is measured.

ISO 22301 requirements explained

Planning the exercise programme

Plan the programme as soon as the first plans under clause 8.4 are drafted. Coverage, not frequency, is what an auditor tests first.

• A written exercise programme covers, over a stated period, every business continuity plan, response team, site and selected solution in scope. Evidence: a coverage matrix showing which exercise addresses each item, and when.
• Exercises are scheduled at planned intervals, with dates, owners and the format chosen for each. Evidence: an exercise calendar approved by the sponsor.
• Each exercise is linked to one or more business continuity objectives, such as a recovery time for a prioritised activity. Evidence: the objective reference recorded in each exercise plan.
• Scenarios come from the risk assessment and suit the organisation's context. Evidence: each scenario traced to a risk register entry.
• Formats build up over time, so that simpler exercises have been passed and their actions closed before larger ones are attempted. Evidence: the sequence in the calendar and the closure status of earlier actions.
• Triggers for extra exercises are defined, such as a new site, a new outsourcing partner or a major system change. Evidence: trigger criteria in the programme document.
• Key suppliers and outsourced providers whose services support prioritised activities are scheduled to take part in at least one exercise. Evidence: supplier participation agreed in writing or noted in the calendar.
• The first exercise is dated early enough for its report to be written and its actions under way before the Stage 2 audit. Evidence: the calendar alongside the planned audit date.

Running each exercise and reporting it

Use these items for every exercise, from the first plan walk-through to a full invocation.

• An exercise plan states the aim, the measurable objectives, the scenario, the participants and the evaluation criteria, and is approved before the day. Evidence: the dated exercise plan.
• Control rules protect live operations: who can pause or stop the exercise and what must not be touched. Evidence: control rules in the exercise plan, briefed to the facilitator.
• Participants include the people named in the plan, among them the manager with authority to invoke it, and observers who are not playing. Evidence: an attendance record with roles.
• Decisions, times and gaps are logged as the exercise unfolds, so results can be measured against the objectives. Evidence: observer logs or a timeline of key events.
• A debrief is held the same day, and what participants raise is captured. Evidence: debrief notes attached to the exercise file.
• A post-exercise report records the outcomes against each objective, recommendations and actions for improvement, each action with an owner and a date. Evidence: the report, signed off by the sponsor.
• Actions from the report are tracked to closure, and the plans, contact lists and procedures they affect are revised under document control. Evidence: an action log with closure dates and the new plan versions.

Business continuity exercises: from walk-through to full invocation

Closing the loop: evaluation, audit and review

Clause 8.6 asks for the analysis, risk assessment, strategies, solutions, plans and procedures to be evaluated at planned intervals, after an incident or invocation and when significant change occurs. These items keep the first cycle from ending as a filed report.

• The BIA and the plans are reviewed after each exercise that exposed a weakness, and changed where needed: either the solution improves or the time frame is reconsidered with management. Evidence: revision history linking changes to the exercise report.
• Any real incident or invocation during the cycle is evaluated, and its lessons feed the analysis, the plans and the next exercises. Evidence: an incident review record with resulting changes.
• Significant changes, such as a new client, site, system or supplier, prompt a check of the analysis and the affected plans. Evidence: change records showing the continuity check before go-live.
• A planned review date for the whole analysis is set and owned. Evidence: the next review date in the method statement or the BCMS calendar.
• The internal audit under clause 9.2 samples the BIA, the risk assessment and the exercise records, by auditors who did not produce them. Evidence: audit plans and reports covering clause 8, with auditor independence shown.
• Management review under clause 9.3 considers exercise results, incidents, the status of actions and the resources still lacking, and decides on them. Evidence: the review pack and minutes with decisions and owners.
• Where an exercise or audit shows a requirement was not met, it is handled as a nonconformity with a cause found and corrective action checked for effect. Evidence: nonconformity and corrective action records under clause 10.1.

ISO 22301 internal audit: planning, conduct and reporting