A useful ISO 22301 checklist tests whether the BCMS operates as a connected management system and whether objective evidence supports the organisation’s claims; it should not be a copied list of clause headings.
Start with scope, context and obligations
Before auditing procedures, establish what the BCMS covers: products and services, organisational boundaries, locations, interfaces and relevant interested-party requirements. Check that exclusions or boundaries do not hide dependencies needed to deliver the scoped services. Maintain an obligations register that distinguishes contractual, regulatory and internal commitments and assigns an owner for monitoring change.
Audit the management-system chain
| Area | Evidence to sample | Failure signal |
|---|---|---|
| Leadership | Policy, roles, resources, management decisions | BCM exists only within one coordinator |
| Planning | Objectives, risks/opportunities, change actions | Objectives have no measure or owner |
| Support | Competence, awareness, communications, controlled information | Plans exist but responders are unprepared |
| Operation | BIA, risk assessment, strategies, plans, exercises | RTOs are not traceable to tested capability |
| Evaluation | Metrics, audits, management review | Reporting counts documents rather than capability |
| Improvement | Nonconformity, corrective action, lessons | Actions close without effectiveness evidence |
Sample vertically, not only clause by clause
Select a priority service and trace it from impact tolerance through BIA, dependencies, recovery strategy, procedures, exercise evidence, metrics and improvement actions. A vertical sample exposes contradictions that a document-by-document review misses. For example, a four-hour RTO is not credible if a critical supplier contract promises restoration only on the next business day.
Use evidence-based audit findings
Separate observations from nonconformities and describe the requirement, objective evidence and gap precisely. Avoid vague findings such as “plan needs improvement.” A useful finding states what was expected, what sample was examined, what evidence was absent or inconsistent and why the gap matters to continuity capability.
Treat the 2019 edition and 2024 amendment correctly
As of September 2026, ISO 22301:2019 remains the published requirements standard and has Amendment 1:2024 concerning climate-action changes; ISO also shows a future revision under development. Organisations should manage applicable published requirements while monitoring revisions through their standards-management process rather than treating draft text as a certified requirement.
Practitioner review checklist
- Confirm the scope, accountable owner and decision authority are explicit.
Turn the checklist into an evidence trail
For each requirement area, record the expected evidence, process owner, sampled record and result. A checklist item marked “yes” without a reference is difficult to defend. A stronger entry states what was reviewed, the period sampled, the people interviewed and the specific evidence that supports the conclusion.
Use both horizontal and vertical sampling. Horizontal sampling checks one control across several teams, such as whether plan reviews occur on schedule. Vertical sampling starts with one critical service and traces its context, BIA, strategy, plan, exercise evidence, corrective actions and management reporting. The two views reveal different weaknesses.
Separate design from operating effectiveness
A documented process can be well designed but poorly executed. Mark these separately. For example, the organization may have a strong exercise methodology but repeatedly leave findings overdue. The audit conclusion should show that the control design exists while operating effectiveness needs improvement.
Management review inputs
Prepare evidence on objectives, exercise outcomes, incidents, audit findings, corrective-action ageing, changes in context, supplier issues, resource needs and decisions requiring leadership. The review should produce documented decisions and actions, not only acknowledge a presentation.
Implementation sequence for a new BCMS
Start with scope and governance, then establish impact criteria and BIA, select continuity solutions, implement plans, build competence, exercise the arrangements, measure performance and drive corrective action. Some activities can run in parallel, but do not publish polished plans before recovery requirements and strategies are understood.
Corrective-action discipline
For each finding, document the cause, immediate correction, systemic corrective action, owner, due date and evidence required for closure. Closing an audit item because a document was updated is insufficient when the underlying problem was an untested dependency or unavailable recovery capacity. Re-test material findings before treating the risk as resolved.
Use the checklist to test the management system, not to collect yes/no answers
An implementation checklist is most useful when every item points to evidence and an accountable process. Instead of marking “complete” because a policy or procedure exists, ask whether the process is operating, whether required outputs are current and whether management responds when performance is below expectation. Sample across business units and time periods so one well-prepared example does not mask inconsistent execution elsewhere.
Organize evidence around the management-system lifecycle: context and scope, leadership, planning, support, operational continuity activities, performance evaluation and improvement. For operational continuity, trace a small number of critical services end to end—from BIA requirement through strategy, plan, exercise and corrective action. This exposes disconnects that a document-by-document audit can miss.
Examples of stronger audit evidence
- Scope: documented boundaries plus evidence that excluded activities were considered and justified.
- Objectives: measurable continuity objectives with owners, progress and management review.
- BIA and strategy: approved analysis linked to actual recovery solutions and unresolved gaps.
- Exercises: objectives, scenario, attendance, observations, evidence of capability and closed corrective actions.
- Performance: monitoring results, internal-audit findings, management-review decisions and follow-up.
- Improvement: root cause and effectiveness checks, not merely evidence that an action was marked closed.
Keep the checklist as a navigation aid, not the audit conclusion. The conclusion should explain whether the BCMS produces reliable continuity capability, where evidence is insufficient and which weaknesses require corrective action or management decision.
Worked example: using the checklist as an assurance tool
Instead of marking a requirement “done” because a document exists, sample the operating evidence. For competence, inspect role requirements, training records and exercise performance. For operational planning, trace approved recovery objectives into strategies and plans. For performance evaluation, verify that metrics have owners and that management review considered trends, audit results, exercise outcomes and corrective actions. Record the evidence reference, owner and gap for every sampled item. This makes the checklist useful for readiness assessment and internal audit rather than a document-presence exercise.
Related BCM.Center resources: ISO 22301 for Practitioners: Build an Evidence-Based BCMS · Business Continuity Management Policy Guide.
In assessing ISO 22301 Implementation & Internal Audit Checklist, distinguish the site-specific operating assumptions from the published guidance on BCMS requirements and their amendment status in ISO 22301:2019. A useful ISO 22301 checklist tests whether the BCMS operates as a connected management system and whether objective evidence supports the organisation’s.