ISO 22301 Business Continuity Management Internal Auditor

Module 1: Introduction to ISO 22301

• Purpose and scope
• Business continuity concepts
• Organisational resilience
• BCMS fundamentals
• Key terminology
• Structure of ISO 22301

Module 2: ISO 22301 Requirements Overview

• Context
• Leadership
• Planning
• Support
• Operations
• Performance and improvement

Module 3: Organisational Context

• Internal issues
• External issues
• Interested parties
• Relevant requirements
• BCMS scope
• Process interactions

Module 4: Leadership & Business Continuity Policy

• Leadership commitment
• BCMS policy
• Management responsibilities
• Roles and authorities
• Organisational accountability
• Policy communication

Module 5: Planning, Risks & Opportunities

• Risk-based thinking
• Risks and opportunities
• BCMS objectives
• Planning actions
• Responsibilities
• Managing changes

Module 6: Support & Resources

• Resource requirements
• Personnel competence
• Awareness
• Internal communication
• External communication
• Organisational knowledge

Module 7: Documented Information

• Documentation requirements
• Document approval
• Version control
• Record management
• Information retention
• Document accessibility

Module 8: Business Impact Analysis

• BIA methodology
• Critical activities
• Disruption impacts
• Recovery priorities
• Dependencies
• Resource requirements

Module 9: Recovery Objectives

• Recovery time objectives
• Recovery point considerations
• Maximum tolerable disruption
• Minimum acceptable capacity
• Recovery priorities
• Dependency considerations

Module 10: Business Continuity Risk Assessment

• Threat identification
• Vulnerabilities
• Risk identification
• Risk analysis
• Risk evaluation
• Disruption scenarios

Module 11: Continuity Strategies & Solutions

• Strategy selection
• People strategies
• Workplace strategies
• Technology strategies
• Supplier strategies
• Resource solutions

Module 12: Business Continuity Procedures

• Plan structure
• Activation criteria
• Response procedures
• Recovery procedures
• Communication arrangements
• Return to normal operations

Module 13: Internal Audit Fundamentals

• Purpose of internal auditing
• Audit principles
• Audit terminology
• Audit objectives
• Audit scope
• Audit criteria

Module 14: Internal Audit Programme

• Programme objectives
• Audit priorities
• Audit frequency
• Resource requirements
• Auditor selection
• Programme monitoring

Module 15: Audit Planning & Preparation

• Audit plan
• Audit schedule
• BCMS document review
• Previous audit findings
• Process identification
• Audit preparation

Module 16: Developing Audit Checklists

• Checklist objectives
• Requirement-based questions
• Process-based questions
• BIA audit questions
• Continuity plan questions
• Audit trails

Module 17: Conducting the Opening Meeting

• Introductions
• Confirming objectives
• Confirming scope
• Audit methods
• Communication arrangements
• Audit schedule

Module 18: Gathering Audit Evidence

• Objective evidence
• Interviews
• Observation
• Document review
• Record review
• Audit sampling

Module 19: Auditing BCMS Operational Controls

• Business impact analysis
• Risk assessments
• Recovery objectives
• Continuity strategies
• Response procedures
• Exercise records

Module 20: Audit Findings & Nonconformities

• Evaluating evidence
• Conformity
• Nonconformity
• Supporting evidence
• Writing findings
• Communicating findings

Module 21: Audit Reporting & Closing Meeting

• Audit conclusions
• Report structure
• Findings summary
• Closing meeting
• Communicating results
• Follow-up expectations

Module 22: Corrective Actions & Audit Follow-Up

• Immediate corrections
• Root cause analysis concepts
• Corrective-action planning
• Reviewing responses
• Effectiveness verification
• Closing findings