Business Continuity Management System Certification Audits

Key requirements — selected themes

• Continuity policy, governance and responsibilities
• Business impact analysis and risk assessment
• Continuity strategies and solutions
• Response structures and continuity plans
• Exercises and evaluation of capabilities
• Review, corrective action and improvement

High-level summary

An assessment of how the organisation prepares for disruption to its prioritised activities. Audits examine business impact analysis, continuity arrangements and evidence that relevant people understand and exercise their responsibilities.

Certification provides independent recognition of a managed approach to continuity. It supports stakeholder confidence while acknowledging that recovery performance depends on the disruption, available resources and the organisation’s actual response.

Third-party certification pathway

References: [S07] · [G01] · [G02] · [G03]

• Application & scope. Identify prioritised activities, locations, dependencies and the proposed continuity management scope.
• Review & audit planning. Confirm eligibility, impartiality, competence and applicable rules; agree scope, audit time and programme.
• Stage 1 — readiness. Review impact analysis, risk assessment, strategies, plans and completed system evaluations.
• Stage 2 — implementation. Evaluate response arrangements, exercises, resource provision and evidence of continuity capability.
• Nonconformity resolution. Review corrections and corrective actions; verify closure or accept action plans as the applicable rules require.
• Independent certification decision. A competent function independent of the audit evaluates the evidence; certification is issued only when requirements are met.
• Surveillance. Review changes to dependencies, exercise results, incidents and maintenance of continuity arrangements.
• Recertification. Reassess the system before certificate expiry and complete the required review and decision for a new cycle.