ISO 22301 certification cost: what moves the price, and what the BIA decides

Four costs, only two of them invoices

The ISO 22301 certification cost a finance team sees is rarely all of it. Two lines arrive as invoices from independent organisations; two stay inside the business.

Consulting and implementation. Optional, and priced on the work of building a business continuity management system with you: the gap analysis, the BIA and risk assessment workshops, strategy options for management, the response structure and plans, the first exercise, internal audit and management review. ISO/IEC 17021-1 does not allow a certification body to provide management system consultancy, so this fee never comes from the body that audits you.

Independent certification. The accredited certification body charges for assessment time: the Stage 1 readiness review, the Stage 2 audit, surveillance in the two following years and recertification before the three-year certificate expires, plus travel and any fixed charges.

Continuity solutions. Alternate workspace, remote-working capacity, replicated data, a second supplier or cross-trained staff. Management chooses them on the evidence of the BIA, certification or not.

Internal time. Process owners in BIA workshops, managers deciding on strategies and budgets, response teams in training and exercises. Over a typical four to eight months, it is the cost most often left out.

What moves the price

The same facts about your organisation drive all four lines, but each driver bites in a different place.

How a certification body sizes the audit

Every accredited certification body works to ISO/IEC 17021-1, which requires documented procedures for determining audit time. The factors it names include the size and complexity of the organisation, the number of sites, outsourced processes, the risks involved, the results of any prior audits, and whether the audit is combined or integrated with another standard.

For business continuity, the body must also use auditors who meet the competence requirements of ISO/IEC TS 17021-6 for business continuity management systems.

Where ISO 22301 is audited together with another management system, the international rule for integrated audits starts from the sum of each standard's audit time and allows a reduction of no more than 20%, justified by how far the system is really integrated.

What you are entitled to see is the result: the scope, sites and headcount the body used, the audit days for each stage and each year, and the reasons for any increase or reduction. The stages themselves are set out in the ISO 22301 certification process guide.

Continuity solutions: the cost the BIA decides

ISO 22301 requires you to identify and select strategies and solutions that let prioritised activities continue or recover within the time frames you set, and the selection weighs the resources required, risk appetite, and costs against benefits. It does not prescribe a second office or duplicate systems.

This is where a well-run BIA pays for itself. The recovery objectives it produces, how long each activity can be down before the damage becomes unacceptable and how quickly it must resume, are what justify spending. Shorter recovery times usually need standing capacity; longer ones can often rely on arrangements activated only when needed.

The expensive mistake is the one the hub names first: every activity declared critical. It inflates the solutions budget and produces plans no team can execute. Realistic prioritisation keeps the spend on what clients and regulators depend on. How to run that analysis is covered in Business impact analysis: how to run one management will act on.

Hidden costs to watch for

Six costs explain most of the gap between a quotation and the final bill.

• Unaccredited certificates. Cheaper because the audit is thinner or unaccredited. When a client's due diligence or a tender panel rejects the certificate, you certify again and pay twice.
• An IT recovery plan sold as a BCMS. If the existing "BCP" only restores systems, the people, sites, suppliers and communication plans still have to be built.
• Plans never exercised. A Stage 2 audit tests the capability, not the binder. An exercise rushed in late costs more than one planned from the start.
• Re-audits. A major nonconformity must be verified before certification; if that cannot happen within six months of the last day of Stage 2, the body repeats Stage 2.
• Supplier dependencies found late. Outsourced activities and critical suppliers left outside the plans surface in the BIA or the audit, and bringing them in adds workshops, contract reviews and sometimes a second supplier.
• Surveillance missing from the quotation. Some offers stop at Stage 2, yet audits continue at least once a calendar year, with recertification in year three.

Comparing ISO 22301 quotations

Compare totals only once quotations describe the same scope and work.

From certification bodies

• Accreditation for ISO 22301 specifically, by an accreditation body recognised through the Global ACI arrangement; check it on the accreditation body's own register.
• The scope, sites and headcount used, identical across quotations.
• Audit days for Stage 1, Stage 2, each surveillance audit and recertification, with the justification.
• The three-year total: application and certificate charges, annual fees, travel, and the rates for follow-up visits.

From consultants

• An all-inclusive proposal for a written scope, or an open rate by the day or by the document?
• Who does which work, and does it include the BIA workshops, strategy options for management, at least one facilitated exercise with its report, internal audit and management review?
• Software, training for response teams and internal auditor training: included or extra? Certification-body fees shown separately? One price for consulting and certificate together is a warning sign.

ISO 22301 certification cost: questions buyers ask