Prepared. Resilient. Always Operating.
Disruptions such as IT outages, supply failures, fires, floods or pandemics can stop critical activities within hours. ISO 22301 sets out the requirements for a business continuity management system (BCMS) that helps you prepare for, respond to and recover from disruption. We help you build a BCMS that is proportionate to your risks and ready for certification.
Customers, regulators and boards increasingly ask how you will keep critical services running when things go wrong. A business continuity management system answers that question with tested plans, clear roles and agreed recovery objectives.
We help you focus on the activities that matter most and build plans your people can actually use under pressure.
About ISO 22301
ISO 22301 specifies the requirements for a business continuity management system. Organisations can be certified against it by an independent, accredited certification body.
1. Our ISO 22301 Consultancy Services
Our support can cover the whole journey or only the stages you need.
A. Gap Analysis & Readiness Assessment
Every project starts with a clear picture of where you stand. Our consultants compare your current practices, documents and records with the requirements of ISO 22301 and agree the priorities with you.
- Review of existing processes, policies, procedures and records.
- Interviews with top management, process owners and key staff.
- Site walk-through to see how work is actually done.
- Clause-by-clause assessment against ISO 22301.
- Identification of strengths, gaps and quick wins.
- A gap analysis report with a prioritised action plan and an estimated timeline.
B. Business Continuity Management System Design & Documentation
We design the business continuity management system around how your organisation really works, so that documents support the work rather than sit on a shelf. Documentation is kept proportionate to your size and risks.
- Definition of the scope, context and interested parties.
- Process mapping and interactions between processes.
- Policies, objectives and performance indicators.
- Procedures, work instructions, forms and records where they add value.
- Risk and opportunity registers.
- Document control and record management arrangements.
C. Implementation Support & Coaching
Our consultants work alongside your team, on site and remotely, while the new arrangements are put into practice and the first records are generated.
- Coaching of process owners and the management representative.
- Support in running the new processes and controls.
- Review of the first records and evidence.
- Practical advice on handling nonconformities and corrective actions.
- Regular progress meetings and status reports to management.
D. Training & Awareness
People make the system work. We train each group on what the standard means for their role.
- Awareness sessions for all staff.
- Workshops for top management on leadership responsibilities.
- Practical training for process owners on their procedures.
- Internal auditor training for your audit team.
- Training records to demonstrate competence.
E. Internal Audit & Management Review
Before the certification audit, the system must be tested. An experienced auditor carries out a full internal audit, and we help top management run an effective management review.
- Internal audit programme and audit plan.
- Full internal audit covering all requirements and all processes in scope.
- Audit report with graded findings and objective evidence.
- Support in root cause analysis and corrective actions.
- Preparation and facilitation of the management review meeting.
F. Certification Audit Preparation & Support
When your system is ready, we help you through certification. The audit is carried out, and the certificate is issued, by an independent accredited certification body; ITA does not issue certificates.
- Guidance on selecting an accredited certification body.
- Readiness check before the stage 1 audit.
- Preparation of your team for auditor interviews.
- Support during the stage 1 and stage 2 audits, where requested.
- Help in closing any findings raised by the certification body.
G. Transition, Integration & Ongoing Support
Management systems need to stay effective after certification. We continue to support you as standards, your organisation and your risks change.
- Transition to new editions of the standard.
- Integration with other management systems such as ISO 9001, ISO 14001 and ISO 45001.
- Periodic internal audits and health checks.
- Support before surveillance and recertification audits.
- Help with extending the scope to new sites, products or services.
2. Requirements We Help You Implement
Depending on your scope, our consultants support you across the key areas of ISO 22301, including:
- Context, scope and interested parties
- Business impact analysis (BIA) and recovery objectives
- Risk assessment for disruption
- Business continuity strategies and solutions
- Business continuity plans and incident response structure
- Exercise and testing programme
- Performance evaluation, internal audit and management review
3. Key Documents and Records We Help You Develop
- Business continuity policy and objectives
- Business impact analysis with recovery time and recovery point objectives
- Risk assessment of disruption scenarios
- Business continuity strategies and resource requirements
- Incident response structure and communication plan
- Business continuity and recovery plans
- Exercise programme and exercise reports
- Internal audit and management review records
Documentation is kept practical and proportionate: we build only what your organisation needs to work effectively and demonstrate conformity.
4. How We Deliver Our Services
Step 1: Understanding Your Organisation
We start by understanding your activities, sites, products and services, current practices, and what you want to achieve: certification, customer requirements, better control, or all of these.
Step 2: Gap Analysis & Project Plan
We assess your current situation against ISO 22301 and agree a realistic plan defining:
- Scope of the business continuity management system.
- Priorities and actions.
- Responsibilities on both sides.
- Timeline and milestones.
- Target date for the certification audit.
Step 3: System Design & Documentation
Together with your process owners, we design the processes, controls and documented information the system needs, building on what already works.
Step 4: Implementation & Training
Your team puts the system into practice with our coaching. We train staff at every level and review the first records to make sure the system is working as intended.
Step 5: Internal Audit
An experienced auditor audits the whole system against ISO 22301. Findings are graded and supported by evidence, and we help you correct them at the root cause.
Step 6: Management Review & Readiness
We help top management review the performance of the system and confirm readiness for certification.
Step 7: Certification & Beyond
We support you through the stage 1 and stage 2 audits by the certification body you choose, help you close any findings, and remain available for surveillance audits and continual improvement.
5. Business Benefits
- Win tenders and keep customers who require certification
- Reduce errors, waste and incidents
- Show regulators and clients that risks are under control
- Give staff clear roles, procedures and objectives
- Build a base for continual improvement
6. Who Can Benefit From This Service?
This service is particularly valuable for:
- Banks, insurers and financial services
- Telecommunications and IT service providers
- Government entities and critical infrastructure
- Healthcare providers
- Logistics and supply chain operators
- Manufacturers with critical customers
- Organisations required by regulators to demonstrate resilience
7. Why Choose ITA?
Practical, Not Paper-Based
We build systems around how you actually work, with documentation proportionate to your size and risks.
Experienced Consultants and Auditors
Your project is led by specialists with practical experience of implementing and auditing management systems.
Clear Plan and Accountability
You know from the start what will be done, by whom and by when, with regular progress reporting.
Your Team Learns as We Work
We transfer knowledge throughout the project so that your people can run and improve the system themselves.
Integrated Approach
One system can cover several standards, avoiding duplicated documents, audits and effort.
Bilingual Delivery
We work in Arabic and English, and our training courses are available in all languages.
8. Frequently Asked Questions
How long does a project take?
It depends on the size of your organisation, the number of sites and the controls already in place. We give you a timeline after the gap analysis.
Do you issue the certificate?
No. Certificates are issued by an independent, accredited certification body. We prepare you and support you through the audit.
Can several standards be combined?
Yes. We can build one integrated management system covering, for example, quality, environment and occupational health and safety.
9. Related Training
Build in-house competence with our Lead Auditor course or Implementation course, or browse all training courses.
10. Request a ISO 22301 Consultancy Proposal
Tell us about your organisation, sites, scope and target dates. Our team will review your needs and send you a proposal with a clear scope, plan and fees.