Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO 22301 Business Continuity Management System Auditor Training has been designed to train auditors who can assess the conformity, implementation and effectiveness of Business Continuity Management Systems, examine organisations’ preparedness and response capabilities for disruptions based on objective evidence, and conduct systematic management system audits.
The training is based on the current ISO 22301:2019 and ISO 22301:2019/Amd 1:2024 requirements, together with the guidance provided in ISO 19011:2026 for management system audits. The requirements of ISO/IEC 17021-1 and ISO/IEC TS 17021-6:2014 concerning the competence of personnel involved in third-party certification audits are also taken into account. ISO 22301:2019 remains the current published base version, and a new edition is under development.
The training language is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO 22301 standard; the context of the organisation; leadership; business continuity policy; risks and opportunities; Business Impact Analysis (BIA); risk assessment; prioritised activities; business continuity strategies and solutions; business continuity plans and procedures; incident response; crisis communication; exercises and tests; performance evaluation and continual improvement; as well as audit principles, management of the audit programme, audit planning, collection of objective evidence, interview and sampling techniques, formulation of audit findings, reporting of nonconformities and follow-up of audit results.
Who Should Attend?
- ISO 22301 auditors and auditor candidates
- Business continuity and crisis management professionals
- Management system auditors
- Auditors working for certification bodies
- Risk and compliance teams
- Internal audit personnel
- Information technology and information security teams
- Operations and supply chain managers
- Management system specialists
- Professionals wishing to take part in ISO 22301 audits
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO 22301 correctly, assess organisations’ Business Continuity Management Systems and levels of preparedness for disruptions based on objective evidence, plan and conduct audits in accordance with the principles of ISO 19011:2026, and report audit findings professionally.
By the End of the Training
Participants will be able to:
- Explain the purpose, scope and structure of ISO 22301.
- Interpret Business Continuity Management System requirements from an auditor’s perspective.
- Assess the organisation’s context and interested parties.
- Audit leadership, policy, roles and responsibilities.
- Assess the Business Impact Analysis (BIA) process.
- Review the identification of prioritised activities.
- Audit the business continuity risk assessment.
- Assess the adequacy of business continuity strategies and solutions.
- Review business continuity plans and procedures.
- Assess incident response and crisis communication processes.
- Audit the effectiveness of exercise and testing programmes.
- Assess business continuity performance indicators.
- Define audit objectives, scope and criteria.
- Prepare a risk-based audit plan.
- Develop audit checklists and working documents.
- Manage opening and closing meetings.
- Apply interview, observation, document review and sampling techniques.
- Evaluate objective audit evidence.
- Accurately document audit findings and nonconformities.
- Assess the adequacy and effectiveness of corrective actions.
- Prepare an audit report and manage follow-up activities.
Programme and Method
Training Topics
- Introduction to the ISO 22301 Standard and Business Continuity Management System
- Context of the Organisation, Interested Parties and Leadership
- Business Continuity Policy, Roles and Responsibilities
- Risks, Opportunities and Business Continuity Objectives
- Business Impact Analysis (BIA) and Identification of Prioritised Activities
- Business Continuity Risk Assessment
- Business Continuity Strategies and Solutions
- Business Continuity Plans and Procedures
- Incident Response, Crisis Management and Communication
- Exercises, Testing and Validation of Plans
- Performance Monitoring, Evaluation and Continual Improvement
- Impact of Climate Change on Business Continuity Management
- ISO 19011:2026 Auditing Principles and Auditor Competence
- Business Continuity Auditor Competence within the Scope of ISO/IEC TS 17021-6
- Management of the Audit Programme and Risk-Based Auditing Approach
- Audit Objectives, Scope and Criteria, and Preparation of the Audit Plan
- Roles, Authority and Responsibilities of the Audit Team
- First-, Second- and Third-Party Auditing Approaches
- Opening Meeting and Conducting the Audit
- Interviewing, Observation, Document Review and Sampling Techniques
- Evaluation of Objective Evidence and Business Continuity Records
- Audit Findings and Writing Nonconformities
- Preparation of the Audit Report and Closing Meeting
- Follow-up of Corrective Actions and Post-Audit Activities
Training Method
The training is delivered through presentations, evaluation of ISO 22301 requirements from an auditor’s perspective, examples of Business Impact Analysis and risk assessment, disruption and crisis scenarios, review of business continuity plans, evaluation of exercise records, activities involving the preparation of audit programmes and plans, interviewing and sampling exercises, evaluation of objective evidence, opening and closing meeting exercises, case studies, writing nonconformities and preparing audit reports.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO 22301 Business Continuity Management System Auditor Training suitable for?
It is intended for professionals working in business continuity, crisis management, risk, information technology, operations, supply chain, management systems and auditing who wish to conduct first-, second- or third-party audits under ISO 22301.
What is the main objective of the training?
To enable participants to evaluate the requirements of ISO 22301 from an auditor's perspective and conduct Business Continuity Management System audits systematically, impartially, using a risk-based approach and based on objective evidence.
Which areas are evaluated during the audit?
The organisation's context, leadership, business continuity policy, Business Impact Analysis, risk assessment, prioritised activities, business continuity strategies, plans and procedures, incident response, communication, exercises, performance evaluation and continual improvement processes are evaluated.
What is the difference between Internal Auditor Training and Auditor Training?
While Internal Auditor Training focuses primarily on first-party audits within the organisation, Auditor Training covers first-, second- and third-party audit approaches, management of the audit programme, audit team activities and the more comprehensive auditor competencies required for certification audits.
Why is Business Impact Analysis (BIA) important in an audit?
Business Impact Analysis provides the basis for determining the impacts of disruptions on the organisation's activities, prioritised activities and recovery priorities. The auditor evaluates the suitability of the BIA methodology, whether the information used is up to date and whether the results are consistent with the business continuity strategies.
Are business continuity plans evaluated during the audit?
Yes. The audit evaluates whether the plans cover the identified scenarios and prioritised activities, define roles and responsibilities, include communication and resource requirements, are kept up to date and have their practicability verified through exercises.
Why are exercises and tests important in an audit?
Exercises and tests provide important objective evidence demonstrating the practicability of business continuity plans and the organisation's capacity to respond to an actual disruption. The audit examines the planning and implementation of exercises, evaluation of their results and rectification of identified deficiencies.
Why is ISO/IEC TS 17021-6 important?
ISO/IEC TS 17021-6:2014 defines additional competence requirements for personnel involved in the auditing and certification of Business Continuity Management Systems and supplements the ISO/IEC 17021 requirements for third-party auditor competence.
Should ISO 22301:2019/Amd 1:2024 be taken into account during the audit?
Yes. The 2024 amendment added provisions to management system standards concerning the consideration of climate change in relation to the organisation's context and the requirements of interested parties; therefore, the audit must verify that the organisation has considered these matters.
Does the training include practical activities?
Yes. The training includes practical activities involving Business Impact Analysis, risk assessment, disruption and crisis scenarios, evaluation of business continuity plans, audit planning, interviewing, sampling, evaluation of objective evidence, writing nonconformities and preparing audit reports.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO 22301:2019 Security and Resilience — Business Continuity Management Systems — Requirements
- ISO 22301:2019/Amd 1:2024 Security and Resilience — Business Continuity Management Systems — Amendment 1: Climate Action Changes
- ISO 19011:2026 Guidelines for Auditing Management Systems
- ISO/IEC 17021-1:2015 Conformity Assessment — Requirements for Bodies Providing Audit and Certification of Management Systems
- ISO/IEC TS 17021-6:2014 Conformity Assessment — Requirements for Bodies Providing Audit and Certification of Management Systems — Part 6: Competence Requirements for Auditing and Certification of Business Continuity Management Systems
- ISO 22313:2020 Security and Resilience — Business Continuity Management Systems — Guidance on the Use of ISO 22301
- ISO/TS 22317:2021 Security and Resilience — Business Continuity Management Systems — Guidelines for Business Impact Analysis
- ISO 22320:2018 Security and Resilience — Emergency Management — Guidelines for Incident Management
- ISO 22398:2013 Societal Security — Guidelines for Exercises
- ISO 31000:2018 Risk Management — Guidelines