Effivity ISO 22301: how the business continuity software runs your BCMS from the first BIA to the audit

How does Effivity run ISO 22301?

Effivity runs ISO 22301 by giving each part of the business continuity cycle a place to be recorded and a person to own it. The BIA sits in the Business Continuity module, the plans are generated from it, exercises are logged against those plans, and the lessons flow into corrective action and management review.

That chain matters more for continuity than for most standards. A certification auditor testing a BCMS wants to see that recovery time objectives came from an analysis, that the chosen solutions actually meet them, and that an exercise has shown the plan works in practice. Scattered files rarely show those links; linked records show them at once.

Effivity is cloud-based, used in 50+ countries, and runs in a browser or on a mobile app.

ISO 22301 requirements mapped to Effivity

The table places each requirement of ISO 22301:2019, at clause-title level, beside the Effivity module where the work is done and the record it leaves. For the full reading of each requirement, see the ISO 22301 requirements guide.

What Sterling configures at the start

In a Sterling ISO 22301 engagement, Effivity is ready before the first BIA workshop, so the analysis goes straight into the system rather than into a spreadsheet that someone later retypes.

• Impact criteria agreed first. Management sets the impact types and scales (financial, contractual, regulatory, reputational, safety) before any activity is rated.
• The BIA structure mirrors your services. Products and services in scope are set up first, then the activities that deliver them, so recovery time frames trace back to what clients were promised.
• Plan templates are adapted. The response structure, call lists and recovery steps are shaped around your teams and sites; a generic plan exposes itself in the first exercise.
• The exercise calendar is loaded early. The first exercise is planned while the plans are being written, because at least one must be run and acted on before Stage 2.

How the BIA itself is run with management is covered in Business impact analysis: how to run one management will act on, and exercise design in Business continuity exercises: from walk-through to full invocation.

A worked trace: one tabletop exercise

A contact centre with two sites runs a tabletop exercise on a scenario agreed in advance: the main site loses power and network for a full shift. The exercise is logged in the Business Continuity module against the site plan,.

During the walk-through, the team finds that the alternate site can seat the agents, but the call-routing change needs a supplier engineer whose contact appears nowhere in the plan. The post-exercise report records the outcome, the gap and two actions: add the supplier's out-of-hours escalation route to the plan, and confirm in the supplier's next evaluation in Purchase that it can meet the recovery time frame. Both actions go to their owners in Non-conformance/Deviation Management with due dates and reminders.

The plan is revised, a new version is approved in Documented Information, and the updated copy is printed and shared with the response team. An auditor who samples that exercise sees the scenario, the finding, the fix and the proof that the plan changed, all dated. The scenario and site are illustrative.

What the certification body's auditor sees in Effivity

After the Stage 1 readiness review, the Stage 2 auditor tests the capability in operation, usually by following one activity through. With Effivity, your people open the records while the auditor watches:

• the BIA entry for a prioritised activity, showing who rated it, the recovery time frame and the resources it depends on;
• the solution selected for it and the management decision behind the choice;
• the plan that puts the solution into action, with its current version and approval;
• the exercises that tested that plan, their reports and whether the actions were closed;

Auditors are wary of dates bunched in the weeks before the visit and of a single name on every record. The process from appointing the body to the certificate is set out in ISO 22301 certification process, step by step.

After certification: surveillance, the revision and Sustain™

The certificate opens a three-year cycle, with surveillance audits at least once a calendar year and a recertification audit before expiry. Surveillance tests whether the system kept moving: exercises held, the BIA reviewed after changes, incidents evaluated, actions closed.

That is where software earns its place. Scheduled exercises raise alerts and overdue actions escalate, so continuity work survives staff changes. Certificates are currently issued to ISO 22301:2019 with Amendment 1:2024, which added the question of whether climate change is a relevant issue; a revision is in preparation with no publication date announced, and any transition would be handled in the same system. Under Sustain™, Sterling continues exercise facilitation, post-incident reviews and internal audits there.

What Effivity does not do

Effivity does not decide your recovery objectives, choose your alternate site or approve the budget for a second supplier. Those are management decisions based on the BIA, and the auditor will ask the managers, not the software, to explain them. Nor does it certify: neither Effivity nor Sterling issues ISO 22301 certificates.

• It is not your IT recovery tooling. Backups, replication and failover run on your own infrastructure; Effivity records the recovery objectives they must meet and the tests that prove them.
• Plans must be reachable when systems are not. A plan only available online fails the day the network does. Printed and shared copies, kept current after each revision, are part of the design.
• A BIA entered by one person is weak. Ratings belong to the process owners the auditor will interview.
• Exercises logged but not acted on count against you. A post-exercise report with open actions and an unchanged plan is an easy finding.

Effivity for ISO 22301: questions buyers ask