Risk, Governance & Compliance
ISO 22301:2019 Business Continuity Management – Lead Auditor
Overview
A professional programme for those who plan, lead and report management-system audits against ISO 22301:2019. It follows the audit principles of ISO 19011 and covers the full audit cycle — from planning and opening meeting to findings, nonconformity grading, reporting and follow-up — through realistic case work and role play.
The standard
About the standard
ISO 22301:2019
Business Continuity Management System
Defines what an organization needs to plan, set up, run and keep improving a system that protects its most critical activities against disruption. It covers preparing for incidents, responding to them, and recovering operations within timeframes the organization itself decides are tolerable. The requirements are generic enough to fit organizations of any sector or size, scaled to the complexity of their operating environment.
Key objectives
- Identify threats capable of interrupting priority activities and estimate their impact
- Set recovery time and resource targets that match the organization's risk appetite
- Establish response and recovery procedures ready to activate during a disruption
- Exercise and test continuity arrangements so they hold up under real conditions
- Continually review and strengthen organizational resilience over time
Who uses it
Organizations that need to protect critical operations against disruption.
Structure of the standard
1–3Scope, references & terms
Introductory clauses defining the scope of the standard, normative references and key definitions.
4Context of the organisation
Understand internal and external issues, the needs and expectations of interested parties, and the scope of the management system.
5Leadership
Top-management commitment, an appropriate policy, and clearly assigned roles, responsibilities and authorities.
6Planning
Address risks and opportunities, set measurable objectives and plan the actions and changes to achieve them.
7Support
Provide the resources, competence, awareness, communication and documented information the system needs.
8Operation
Plan and control business continuity, including business impact analysis and risk assessment, continuity strategies and solutions, and documented, exercised response and recovery plans.
9Performance evaluation
Monitor, measure, analyse and evaluate; conduct internal audits and management reviews.
10Improvement
Manage nonconformities and corrective action and continually improve the management system.
Learning outcomes
What you will be able to do
- Interpret the requirements of ISO 22301:2019 in an audit context
- Plan an audit programme and an individual audit, including scope, criteria and sampling
- Lead an audit team and conduct opening and closing meetings
- Collect and evaluate objective evidence through interview, observation and document review
- Grade nonconformities and write clear, defensible audit findings
- Prepare the audit report and follow up corrective actions
Who should attend
Auditors, consultants, management representatives and professionals who want to lead first-, second- or third-party audits.
More in Risk, Governance & Compliance
All Risk, Governance & ComplianceInternal AuditorABM-01Risk, Governance & Compliance
ISO 37001:2025 Anti-Bribery Management – Internal Auditor
Lead AuditorABM-02Risk, Governance & Compliance
ISO 37001:2025 Anti-Bribery Management – Lead Auditor
Lead ImplementerABM-03Risk, Governance & Compliance
ISO 37001:2025 Anti-Bribery Management – Lead Implementer
AXIOS · Certification body
Looking for management-system certification?
AXIOS certification is a separate, impartial certification body: audits, certification decisions and the public register of ISO certificates.