Twelve months, six milestones
The calendar that holds
| Month | Milestone | Key deliverable |
|---|---|---|
| 1–2 | Framing | Context analysis, interested parties, approved scope, signed policy |
| 3–5 | Analysis | Validated BIA, risk assessment, continuity objectives |
| 5–7 | Design | Strategy comparison, investment decision, response structure |
| 7–9 | Implementation | Plans, action cards, directory, awareness |
| 9–11 | Validation | Exercise programme, at least one real exercise, internal audit, management review |
| 11–12 | Certification | Stage 1 audit (documentation), stage 2 audit (on site) |
Twelve months is realistic for a mid-sized organisation starting from scratch. Six months is possible where arrangements already exist and the work is to bring them into conformity.
The three sequencing errors
Freezing scope too late. Scope drives the BIA, the plans, the audit and the certificate itself. Changing it at month 8 invalidates six months of work. It is decided at month 2 and does not move.
Scheduling the internal audit after the certification audit. ISO 22301 § 9.2 requires an internal audit; the certification body will check it happened before. A BCMS with no prior internal audit fails stage 1.
Deferring the first exercise. The exercise is the only evidence the capability exists. Arrangements that are complete on paper with no exercise performed lead to a major nonconformity on clause 8.5.
The twenty documented items
ISO 22301 explicitly requires around twenty documented items. The principal ones:
- BCMS scope and justification of exclusions (4.3)
- Continuity policy (5.2)
- Continuity objectives (6.2)
- Evidence of competence (7.2)
- Documented information deemed necessary (7.5.1)
- BIA and risk assessment process and results (8.2)
- Selected strategies and solutions (8.3)
- Plans and procedures (8.4)
- Exercise programme and results (8.5)
- Evaluation results (8.6)
- Monitoring and measurement results (9.1)
- Internal audit programme and results (9.2)
- Management review minutes (9.3)
- Nonconformities and corrective actions (10.1)
The temptation is to produce three times as many. Every additional document must be maintained, versioned and presented in audit: documentary restraint is a strategy, not laziness.
Key takeaways
- Scope freezes at month 2, not month 10
- Internal audit and management review must precede the initial audit
- A complete exercise cycle is required before stage 2