ISO 22301 certification process, step by step: from scope to certificate

Who does what in ISO 22301 certification

Three parties share the work, and each has a fixed role. You own the business continuity management system: your managers decide what must keep running, your teams respond when something breaks, and your records show it. A consultancy helps you design, build and test that system. The certification body, independent of whoever helped you, audits it and decides. An accreditation body assesses the certification body against ISO/IEC 17021-1, the international rules for bodies that certify management systems; since 1 January 2026, recognition between accreditation bodies runs through the Global Accreditation Cooperation (Global ACI), which replaced the IAF and ILAC arrangements.

For continuity work there is one more document worth knowing by name. ISO/IEC TS 17021-6 sets the competence a certification body's auditors and decision-makers need for business continuity management systems. It is why an accredited continuity audit is led by someone who understands recovery objectives, dependencies and exercise design.

Steps 1 to 5: preparing the system for audit

Step 1: agree the scope

Decide which products and services you are promising to keep delivering, from which sites, and for which clients or regulators; that boundary is printed on the certificate. A BPO that serves three clients from two delivery centres can scope both centres or one; what it cannot do is certify a site whose recovery depends on a data centre it has left outside every plan.

Step 2: gap analysis

Sterling's gap analysis is the opening stage of an engagement. It reviews your current plans, recovery arrangements, incident history and any exercises already run against the requirements of ISO 22301:2019 with its 2024 amendment, then turns the findings into actions with owners and dates. It is different from the free online readiness check, which is a short self-assessment, and from the certification body's Stage 1, which comes much later.

Step 3: analyse, decide, then write

The order matters. The business impact analysis sets priorities and recovery objectives; the risk assessment looks at what threatens those priorities; management then chooses and funds the strategies and solutions; only after that are the response structure, plans and recovery procedures written. Our guide to the business impact analysis covers how to run it so that management acts on the results.

Step 4: exercise the plans

A continuity system that has never been exercised has no operating evidence. Run at least one exercise on a realistic scenario, write the post-exercise report, and complete or schedule the actions it raises before the certification body arrives. The exercises guide explains how to move from a desk-top walk-through to a full invocation.

Step 5: internal audit and management review

Before the external audit, complete one internal audit covering the whole scope, carried out by people who are not auditing their own work, and one management review that looks at exercise results, incidents, recovery objectives and the resources still missing. Stage 1 checks that both have been planned and performed.

Step 6: apply to an accredited certification body

Choose a body whose accreditation includes business continuity management systems, and confirm that accreditation in the accreditation body's own directory rather than on a sales brochure. The quotation should state the audit days for each stage and each surveillance audit and the sites to be visited; a quotation far below the others usually means a shorter audit, not a better deal. Our guide to choosing a certification body goes through the checks in detail.

Apply while the build is still under way. Auditors are booked ahead, and your application is what fixes the audit dates your plan works back from.

Steps 7 and 8: the Stage 1 readiness review and the Stage 2 audit

Stage 1 is the certification body's readiness review. The auditor looks at your documented information and scope, the sites and services covered, the legal and contractual obligations you identified, and whether the internal audit and management review have taken place. Anything that could become a nonconformity is recorded as an area of concern, and the Stage 2 plan is agreed. Close each concern with evidence before Stage 2; the interval between the stages should leave time to do that.

Stage 2 evaluates whether the system is implemented and effective across the scope. In a continuity audit, expect the auditor to pick a prioritised activity and trace it: the impact criteria and time frames in the BIA, the resources and suppliers it depends on, the solution management selected, the team and plan that would invoke it, and the exercise that tested it. Response-team members are interviewed about how they would be alerted and what they would do first. Exercise reports and the actions taken after them tend to receive more attention than the plans themselves.

Step 9: findings, the decision and the certificate

A major nonconformity is one that affects the system's ability to achieve its intended results; a minor one does not. For each, you send the correction, the root cause and the corrective action within the time the certification body sets. Majors must be verified before certification can be granted, sometimes through a follow-up visit, and if that verification is not completed within six months of the last day of Stage 2, the body has to repeat Stage 2. For minors, an accepted action plan is normally enough, with implementation checked at the next audit. How findings are written and closed is the subject of a separate guide in this series.

The decision is taken by competent people at the certification body who did not carry out the audit. The certificate names your organisation, scope, sites, the standard and its edition, and its issue and expiry dates. It describes a management system, not a promise that nothing will ever be interrupted.

Step 10: surveillance and recertification

The three-year cycle begins with the certification decision. Surveillance audits take place at least once a calendar year outside recertification years, and the first must fall within twelve months of the decision. Each one samples the system and looks again at the exercise calendar, evaluations after incidents and changes, internal audits, management reviews and corrective actions. A recertification audit before expiry covers the whole system again and opens a new cycle. Tell the certification body about changes to scope, sites or ownership as they happen.

Continuity systems decay quietly: staff move, contact lists age and the BIA drifts away from the business. Keeping exercises and post-incident evaluations going is what Sterling's Sustain™ phase is for.

How long the ISO 22301 certification process takes

For a single-site organisation, steps 1 to 5 usually take four to eight months. The slow items are rarely the writing: they are BIA workshops with process owners, management decisions on solutions and budgets, lead times for those solutions, and an exercise with its report acted on. The certification body's schedule then adds Stage 1, the interval to Stage 2 and the time to close any findings. More sites, more outsourced dependencies or a starting point with no plans at all push the calendar out. The cost guide explains how the same factors move the price.

ISO 22301 certification process: questions buyers ask