ISO 22301 Business Continuity Management Lead Auditor

Module 1: Introduction to ISO 22301

• Purpose and scope
• Business continuity concepts
• Organisational resilience
• BCMS fundamentals
• Key terminology
• Structure of ISO 22301

Module 2: ISO 22301 Framework

• Context of the organisation
• Leadership
• Planning
• Support
• Operations
• Performance and improvement

Module 3: Business Continuity Management Principles

• Organisational resilience
• Process approach
• Risk-based thinking
• Continuity management
• Recovery capability
• Continual improvement

Module 4: Context of the Organisation

• Internal issues
• External issues
• Interested parties
• Relevant requirements
• BCMS scope
• Process interactions

Module 5: Leadership & Commitment

• Leadership responsibilities
• Management commitment
• BCMS integration
• Resource commitment
• Organisational accountability
• Business continuity culture

Module 6: Business Continuity Policy

• Policy development
• Policy objectives
• Organisational direction
• Roles and responsibilities
• Policy communication
• Policy review

Module 7: Risks, Opportunities & BCMS Objectives

• Risks and opportunities
• Planning actions
• Business continuity objectives
• Performance targets
• Responsibilities
• Managing changes

Module 8: Resources, Competence & Awareness

• Resource requirements
• Personnel competence
• Training needs
• Awareness
• Organisational knowledge
• Competence evaluation

Module 9: Communication & Documented Information

• Internal communication
• External communication
• Crisis communication
• Document control
• Record management
• Information availability

Module 10: Business Impact Analysis

• BIA methodology
• Critical activities
• Disruption impacts
• Recovery priorities
• Dependencies
• Resource requirements

Module 11: Recovery Requirements & Objectives

• Recovery time objectives
• Recovery point considerations
• Maximum tolerable disruption
• Minimum acceptable capacity
• Recovery priorities
• Recovery requirements

Module 12: Business Continuity Risk Assessment

• Threat identification
• Vulnerability assessment
• Risk identification
• Risk analysis
• Risk evaluation
• Disruption scenarios

Module 13: Continuity Strategies & Solutions

• Strategy development
• People strategies
• Workplace strategies
• Technology strategies
• Supplier strategies
• Resource solutions

Module 14: Business Continuity Plans

• Plan structure
• Activation criteria
• Roles and responsibilities
• Response procedures
• Recovery procedures
• Plan maintenance

Module 15: Incident Response Structure

• Incident detection
• Escalation
• Response teams
• Command structures
• Decision-making
• Incident coordination

Module 16: Crisis Communication

• Communication planning
• Internal stakeholders
• External stakeholders
• Communication responsibilities
• Communication channels
• Information consistency

Module 17: Exercise & Testing Programme

• Exercise objectives
• Exercise types
• Scenario development
• Exercise planning
• Conducting exercises
• Evaluating results

Module 18: Performance Evaluation & Improvement

• Monitoring and measurement
• Performance indicators
• Internal audits
• Management review
• Corrective actions
• Continual improvement

Module 19: Audit Principles

• Integrity
• Fair presentation
• Due professional care
• Confidentiality
• Independence
• Evidence-based auditing

Module 20: Managing a BCMS Audit Programme

• Programme objectives
• Audit priorities
• Audit frequency
• Resource allocation
• Auditor selection
• Programme monitoring

Module 21: Lead Auditor Responsibilities

• Audit leadership
• Team coordination
• Task allocation
• Professional judgement
• Communication
• Managing audit activities

Module 22: Audit Objectives, Scope & Criteria

• Defining objectives
• Determining scope
• Establishing criteria
• Organisational boundaries
• BCMS requirements
• Audit feasibility

Module 23: Risk-Based Audit Planning

• Business continuity risks
• Critical processes
• BIA results
• Previous findings
• Audit priorities
• Sampling strategies

Module 24: Audit Preparation & Document Review

• BCMS documentation
• BIA reports
• Risk assessments
• Continuity plans
• Exercise records
• Audit checklists

Module 25: Conducting BCMS Audits

• Opening meeting
• Process auditing
• Interviews
• Observations
• Record review
• Following audit trails

Module 26: Auditing Operational Continuity Controls

• BIA effectiveness
• Risk assessment
• Recovery objectives
• Continuity strategies
• Response procedures
• Exercise effectiveness

Module 27: Gathering & Evaluating Audit Evidence

• Objective evidence
• Evidence sources
• Audit sampling
• Evidence sufficiency
• Evidence reliability
• Evaluating conformity

Module 28: Audit Findings & Reporting

• Conformity
• Nonconformity
• Supporting evidence
• Writing findings
• Audit conclusions
• Audit reports

Module 29: Corrective Actions & Follow-Up

• Immediate correction
• Root cause analysis
• Corrective-action plans
• Reviewing responses
• Effectiveness verification
• Closing findings

Module 30: Audit Team Leadership & Continual Improvement

• Leading audit teams
• Managing conflicts
• Auditor performance
• Complex BCMS audits
• Lessons learned
• Improving audit effectiveness