ISO 22301 internal audit: how to plan, conduct and report an audit of your business continuity system

What does ISO 22301 require of internal audit?

Clause 9.2 of ISO 22301:2019 has two parts: a general requirement (9.2.1) and a requirement for audit programmes (9.2.2). In plain terms, you audit your BCMS at planned intervals to find out two things. First, does it conform to what you decided for yourselves and to what the standard requires? Second, is it actually in place and kept up, not only written down?

The programme is yours to design, but it has to state how often audits happen, the methods, who is responsible, how audits are planned and how results are reported. It should take account of how important each process is and what earlier audits found. Each audit needs defined criteria and a defined scope. Auditors are chosen, and audits run, in a way that keeps them objective and impartial. Results go to the managers who need them, and documented information is kept as evidence that the programme ran and what it found.

Two other clauses complete the loop. Audit results are one of the inputs to the management review under clause 9.3, and every nonconformity the audit raises is handled under clause 10.1, Nonconformity and corrective action.

Internal audit, exercises and evaluation: three different checks

Business continuity has more self-checking built in than most management systems, and teams often confuse the three.

• The exercise programme (8.5) proves that strategies, plans and people work on a realistic scenario. Its output is a post-exercise report with actions. The guide to business continuity exercises covers how to design and run them.
• Evaluation of documentation and capabilities (8.6) asks whether the BIA, risk assessment, strategies, solutions, plans and procedures are still adequate and effective, at planned intervals, after an incident or invocation, and when something significant changes.
• Internal audit (9.2) stands one step back. It asks whether the exercises happened as planned, whether their actions were closed, whether the evaluations were triggered when they should have been, and whether every other clause is working.

So an exercise does not replace an audit, and an audit does not replace an exercise.

How to build an ISO 22301 audit programme

Start from risk, not from the clause list. The areas that carry the most weight in a BCMS are the business impact analysis, the selected solutions, the plans and the exercise record, because a weakness there means the organisation cannot recover when it has promised to. Those areas deserve earlier and deeper audits.

For a single-site organisation preparing for certification, a sound first cycle audits the whole scope at least once before Stage 2, often split into two or three sessions so process owners are not tied up for days. After certification, a rolling yearly programme is common. The table below shows what each area of the audit should sample.

Conducting the audit: sampling the chain of evidence

Plan and open

Send each auditee a short plan in advance: the criteria (the standard, your policy, the relevant plans), the scope, the times and the records you will ask for. ISO 19011:2026 is the reference for this method, from managing the programme to conducting each audit; its 2026 edition also gives more guidance on remote auditing and digital tools.

Trace, do not tick

The strongest technique in a BCMS audit is tracing a single prioritised activity end to end. Find its RTO in the BIA, the resources it needs, the solution chosen to meet that time frame, the plan that invokes the solution, the exercise that last tested it and the action raised afterwards. Every break in that chain is a candidate finding. A second trace on a supplier-dependent activity shows whether outsourcing sits inside the plans.

Write findings that stand on their own

Each finding states the requirement, the evidence observed and the gap between them,. For example: "The BIA sets an RTO of four hours for the claims line, but the selected alternate workspace needs a day to activate according to the provider's contract; no exercise has tested the switch." That is a finding a process owner can fix; "BCP needs improvement" is not.

Who should audit: competence and independence

ISO 22301 does not name a qualification for internal auditors. Clause 7.2 applies instead: you determine the competence the role needs, make sure auditors have it through education, training or experience, and keep evidence. For a BCMS, that means audit method plus enough BIA and exercise knowledge to spot a weak analysis.

Objectivity means auditors do not audit their own work. The business continuity coordinator should not audit the BIA they facilitated; an IT recovery lead should not audit the IT recovery plans. In a small organisation, cross-auditing between departments usually solves this. Certification auditors meet a separate standard, ISO/IEC TS 17021-6, which does not apply to your internal team.

Reporting, follow-up and the record auditors ask for

Keep the report short: scope and criteria, what was sampled, conclusions per area, and the findings with a grade. ISO 22301 prescribes no grading scheme, so many organisations mirror the certification body's language: a major nonconformity affects the system's ability to achieve its intended results, a minor one does not, and observations point to risk without a breach.

Each nonconformity then goes through correction, root cause and corrective action, with a check that the action worked. A fix to the BIA or a plan usually triggers an 8.6 evaluation, sometimes a new exercise. The certification body will ask to see the programme, audit plans, reports, the nonconformity and corrective action records, and management review minutes showing that results were considered. In Effivity, that record is in one place. Where the BCMS shares a management system with ISO/IEC 27001, one integrated audit can cover both; the guide to ISO 22301 and ISO/IEC 27001 explains how.

ISO 22301 internal audit: questions buyers ask