Sessions
Date, delivery mode, trainer and fee are specific to each session. Fees are per person.
Request a quote for a date for your organisation or for the next run.
Application formNo membership required
Get a quote
Training content
Overview
ISO 22301 Business Continuity Management System Internal Auditor Training has been developed to provide participants with the knowledge and auditing skills required to assess the conformity and effectiveness of organisations’ Business Continuity Management Systems, systematically examine their level of preparedness for disruptions and crises, and conduct internal audits based on objective evidence.
The training is based on the current requirements of ISO 22301:2019 and ISO 22301:2019/Amd 1:2024, together with the ISO 19011:2026 guidance for management system audits. ISO 22301 provides a systematic management approach that enables organisations to prepare for and respond to disruptions, maintain their prioritised activities at acceptable levels, and continually improve their business continuity capability.
The language of the training is Turkish. The training is delivered online.
About the Training
The training covers the structure of the ISO 22301 standard, the context of the organisation, leadership, business continuity policy, risks and opportunities, Business Impact Analysis (BIA), risk assessment, identification of prioritised activities, business continuity strategies and solutions, business continuity plans and procedures, incident response, crisis communication, exercises and tests, performance evaluation, continual improvement, ISO 19011:2026 auditing principles, internal audit planning, collection of objective evidence, interviewing and sampling techniques, reporting nonconformities, and following up corrective actions.
Who Should Attend?
- ISO 22301 internal auditors and auditor candidates
- Personnel responsible for business continuity management systems
- Business continuity and crisis management teams
- Risk and compliance personnel
- Internal audit teams
- Information technology and information security personnel
- Operations and production teams
- Supply chain and purchasing personnel
- Quality and management system specialists
- Personnel involved in implementing and developing the ISO 22301 system
Objectives and Outcomes
The aim is to enable participants to interpret the requirements of ISO 22301 correctly, evaluate the Business Continuity Management System using a risk-based approach founded on objective evidence, and conduct effective internal audits in accordance with the principles of ISO 19011:2026.
Upon Completion of the Training
Participants will be able to:
- Explain the purpose, scope and structure of the ISO 22301 standard.
- Evaluate the fundamental principles of the Business Continuity Management System.
- Audit the requirements relating to the context of the organisation and interested parties.
- Evaluate leadership, policy, roles and responsibilities.
- Examine the Business Impact Analysis (BIA) process.
- Evaluate the identification of prioritised activities.
- Audit the business continuity risk assessment.
- Evaluate the adequacy of business continuity strategies and solutions.
- Examine business continuity plans and procedures.
- Evaluate incident response and crisis communication processes.
- Audit the planning and effectiveness of exercises and tests.
- Examine performance monitoring and evaluation activities.
- Establish the scope, criteria and plan for an internal audit.
- Collect and evaluate objective audit evidence.
- Apply interview, observation and sampling techniques.
- Report nonconformities objectively.
- Monitor the implementation and effectiveness of corrective actions.
Programme and Method
Training Topics
- Introduction to the ISO 22301 Standard and the Business Continuity Management System
- Context of the Organisation, Interested Parties and Leadership
- Business Continuity Policy, Roles and Responsibilities
- Risks, Opportunities and Business Continuity Objectives
- Business Impact Analysis (BIA) and Identification of Priority Activities
- Business Continuity Risk Assessment
- Business Continuity Strategies and Solutions
- Business Continuity Plans and Procedures
- Incident Response, Crisis Management and Communication
- Exercises, Testing and Validation of Plans
- Performance Monitoring, Measurement and Continual Improvement
- Impact of Climate Change on Business Continuity Management
- ISO 19011:2026 Auditing Principles and Internal Auditor Competence
- Internal Audit Planning and Determination of Scope and Audit Criteria
- Conducting the Audit, Interviewing, Observation, Sampling and Objective Evidence
- Evaluation of Business Continuity Records and Exercise Results
- Audit Findings, Writing Nonconformities and Reporting
- Follow-up of Corrective Actions and Evaluation of Audit Effectiveness
Training Method
The training is delivered through presentations, evaluation of ISO 22301 requirements, examples of Business Impact Analysis and risk assessment, disruption and crisis scenarios, review of business continuity plans, evaluation of exercise results, process-based internal audit activities, audit plan and checklist preparation exercises, interviewing, observation and sampling activities, objective evidence assessments, case studies and nonconformity writing exercises.
Attendance and Certificate
Certification Rule
A certificate of attendance is issued to all participants whose attendance has been confirmed. To receive a certificate of achievement, participants must achieve a passing grade in the examination at the end of the training; participants who use all their examination attempts but do not pass will be issued a certificate of attendance.
FAQ and Resources
Who is the ISO 22301 Business Continuity Management System Internal Auditor Training suitable for?
It is intended for professionals working in business continuity, crisis management, risk, information technology, operations, supply chain, quality, management systems and internal auditing, or those who will serve as ISO 22301 internal auditors.
What is the main objective of the training?
The objective is to enable participants to evaluate the ISO 22301 Business Continuity Management System systematically and objectively, and to conduct effective internal audits in accordance with ISO 19011 principles.
Which areas are evaluated during an internal audit?
The organisation’s context, leadership, business continuity policy, Business Impact Analysis, risk assessment, prioritised activities, business continuity strategies, plans and procedures, incident response, crisis communication, exercises, performance evaluation and continual improvement processes are evaluated.
Why is an ISO 22301 internal audit conducted?
An internal audit is conducted to evaluate whether the Business Continuity Management System conforms to the organisation’s own requirements and the requirements of ISO 22301, whether it is effectively implemented, and whether it supports the organisation’s capacity for preparedness and resilience against disruptions.
How is the Business Impact Analysis (BIA) evaluated during an internal audit?
The internal audit examines the suitability of the BIA methodology, the correct identification of activities and dependencies, the assessment of disruption impacts, the identification of prioritised activities, and the alignment of the specified recovery requirements with business continuity strategies.
Are business continuity plans evaluated during the audit?
Yes. The plans’ currency, scope, roles and responsibilities, communication methods, resource requirements, response steps and arrangements for maintaining prioritised activities are evaluated as part of the internal audit.
Why are exercises and tests important?
Exercises and tests provide important objective evidence that verifies the feasibility of business continuity plans, the preparedness level of teams and the effectiveness of strategies. The internal audit examines the planning and conduct of exercises, the evaluation of their results and the follow-up of improvement actions.
Should ISO 22301:2019/Amd 1:2024 be considered during the internal audit?
Yes. During the internal audit, it should be verified that the organisation has determined whether climate change is a relevant issue within its context and has considered the climate change-related requirements of relevant interested parties. ISO 22301:2019/Amd 1:2024 was published in February 2024.
Is the training practical?
Yes. The training includes practical exercises involving Business Impact Analysis, risk assessment, disruption and crisis scenarios, business continuity plans, exercise records, internal audit planning, checklist preparation, interviewing, observation, sampling, objective evidence evaluation and writing nonconformities.
Is there an examination at the end of the training?
Yes. An assessment examination is administered at the end of the training.
References
- ISO 22301:2019 Security and Resilience — Business Continuity Management Systems — Requirements
- ISO 22301:2019/Amd 1:2024 Security and Resilience — Business Continuity Management Systems — Amendment 1: Climate Action Changes
- ISO 19011:2026 Guidelines for Auditing Management Systems
- ISO 22313:2020 Security and Resilience — Business Continuity Management Systems — Guidance on the Use of ISO 22301
- ISO/TS 22317:2021 Security and Resilience — Business Continuity Management Systems — Guidelines for Business Impact Analysis
- ISO 22320:2018 Security and Resilience — Emergency Management — Guidelines for Incident Management
- ISO 22398:2013 Societal Security — Guidelines for Exercises
- ISO 31000:2018 Risk Management — Guidelines