The ISO 22301
Certification Guide

Seven, in a fixed order: a readiness and gap assessment against the standard; building the BCMS (BIA, risk assessment, strategies, plans); exercising the plans so real evidence exists; an impartial internal audit plus a management review; the certification body’s Stage 1 documentation review; the Stage 2 implementation audit; and finally the certificate, which runs on a three-year cycle with annual surveillance audits. A typical single-scope organisation is certification-ready in 8–14 weeks of preparation.

Stage 1 is a documentation and readiness review: the auditor checks your BCMS documents — scope, policy, BIA, strategies, plans — and confirms the internal audit and management review have happened, flagging areas of concern to fix before proceeding. Stage 2 tests implementation: interviews with leadership and continuity teams, sampling of records, and scrutiny of exercise results. Stage 1 asks “is the system designed and described?”; Stage 2 asks “does it actually operate?”.

Yes — Stage 2 findings are classified as major or minor nonconformities. A major (for example, no exercise evidence, no internal audit, or a missing BIA) blocks certification until corrective action is taken and verified, sometimes requiring a follow-up visit. Minors require a corrective-action plan but do not block the certificate. Preparation is how you avoid both: TCSA’s internal audit applies the same lens the certification body will.

Only independent certification bodies accredited for ISO 22301 by a recognised national accreditation body — TÜV, BSI, and DNV are well-known examples we regularly coordinate with. Consultants cannot certify their own work; the accreditation rules deliberately separate the two roles. When a bank or regulator reviews your certificate, the issuing body’s accreditation is one of the first things its vendor-assessment team checks.

In each of the two years after certification, the certification body returns for a shorter surveillance audit. It always checks the heartbeat of the system — internal audits, management reviews, corrective actions, and recent exercise reports — plus a rotating sample of other clauses, changes to scope, and use of the certification mark. The practical implication: your exercise programme and review cadence must keep producing evidence year-round, not just before audits.

There are two components, and we deliberately quote neither as a flat figure. TCSA’s preparation work is custom-scoped to your headcount, sites, existing maturity, and deadline, and confirmed as a fixed, all-inclusive quote after a short scoping call — no hourly billing, no scope creep. The certification body’s Stage 1 and Stage 2 audit fee is quoted separately by that body, based on audit-day calculations driven by your size and scope. An existing ISO 27001 ISMS typically reduces the preparation effort, since the governance machinery is shared.