CHECKLIST – ISO 22301 (BCMS) AUDIT – JDA ADVISORY

Organisational context (point 4)

4.1 Understanding the organisation and its context

Kryteria oceny:

• Identification of internal and external factors
• Linking the context to operational risks and business continuity

Audit questions:

• Has the organization identified the factors influencing the BCMS?
• Is the context updated periodically?
• Does the context influence BIA, TRA, and plans?

Evidence: context analysis, risk registers, strategic documents.

4.2 Interested parties

Criteria:

• Identification of stakeholders
• Determining their business continuity requirements

Questions:

• Have stakeholders and their requirements been identified?
• Is the list up-to-date?

Evidence: party register, regulatory requirements, SLAs.

4.3 Scope of BCMS

Criteria:

• Clearly defined scope
• Linked to processes, locations, systems, and suppliers

Questions:

• Is the scope adequate to operational reality?
• Does it cover critical processes?

Evidence: scope document, process map, IT architecture.

4.4 BCMS

Criteria:

• Establishing, implementing, maintaining and improving the BCMS

Questions:

• Is the BCMS formally established?
• Are there roles and responsibilities?

Evidence: policies, procedures, RACI.

Leadership (pkt 5)

5.1 Management commitment

Criteria:

• Active BCMS support
• Providing resources

Questions:

• Does management participate in BCMS reviews?
• Does it provide resources for testing and recovery?

Evidence: minutes, board decisions.

5.2 Business Continuity Policy

Criteria:

• Timeliness, approval, communication

Qiuestions:

• Is the policy known to employees?
• Does it reflect the BCMS objectives?

Evidence: politics, messages.

5.3 Roles and responsibilities

Criteria:

• Clearly Assigned Roles
• Critical Process Owners

Questions:

• Are roles defined and assigned?
• Is there a crisis team?

Evidence: RACI, job descriptions.

Planning (pkt 6)

6.1 Risk and opportunities

Criteria:

• TRA Methodology
• Linking Risks to Plans

Questions

• Is the TRA up to date? Are risks monitored?

Evidence: TRA, risk register.

6.2 Business Continuity Objectives

Criteria:

• Measurability Linking to KPIs/KRIs

Questions:

• Are the goals measurable and monitored?

Evidence: dashboards, reports.

Support (pkt 7)

7.1 Resources

Questions:

• Are resources adequate to implement BCMS?

Evidence: budgets, resource plans.

7.2 Competences

Questions:

• Do employees have the competencies to implement BCP/DRP?

Evidence: competency matrices, training.

7.3 Awareness

Questions:

• Do employees know their roles in a crisis?

Evidence: knowledge tests, awareness campaigns.

7.4 Communications

Questions:

• Is there a crisis communications plan?

Evidence: procedures, contact lists.

7.5 BCMS documentations

Questions:

• Are documents monitored and updated?

Evidence: document register.

5. Operational activities (pkt 8)

8.1 Operational planning and control

Questions:

• Are BCM processes defined and operational?

Evidence: procedures, logs, registers.

8.2 BIA – Business Impact Analysis

Criteria:

• Identification of critical processes
• RTO, RPO, MTPD
• Dependencies (IT, people, suppliers, locations)

Questions:

• Is the BIA up to date?
• Are the RTOs/RPOs realistic?

Evidence: BIA, dependency maps.

8.3 TRA – Disruption Risk Assessment

Questions:

• Does the TRA consider disruption scenarios?
• Do TRA results impact plans?

Evidence: TRA, risk register.

8.4 Business Continuity Strategy

Questions:

• Are the strategies adequate to the BIA/TRA results?

Evidence: strategies, management decisions.

8.5 Business Continuity Plan (BCP)

Questions:

• Are the plans complete, up-to-date, and feasible?
• Do they include roles, procedures, communication, and scenarios?

Evidence: BCP, operational instructions.

8.6 IT Recovery Plans (DRP)

Questions:

• Is the DRP aligned with the RTO/RPO?
• Is DR testing being performed?

Evidence: DRP, test logs.

8.7 Supplier Management

Questions:

• Do critical suppliers have BCM requirements?
• Are SLAs monitored?

Evidence: contracts, supplier register, monitoring results.

8.8 Tests and exercises

Questions

• Are tests planned and implemented?
• Do test results lead to corrective actions?

Evidence: test plans, reports, NC.

6. Performance evaluation (pkt 9)

9.1 Monitoring and measurement

Questions:

• Are there KPIs/KRIs for the BCMS?
• Are they reported?

Evidence: dashboards, reports.

9.2 Internal audit

Questions:

• Are audits being conducted as planned?
• Are corrective actions being implemented?

Evidence: audit reports, NC.

9.3 Management review

Questions:

• Does the inspection include all required elements?

Evidence: minutes, decisions.

7. Improvements (pkt 10)

10.1 Non-conformities and corrective actions

Questions:

• Are non-conformities recorded and analyzed? Are the actions effective?

Evidence: NC register, root cause analysis.

10.2 Continuous improvement

Questions:

• Is the organization continually improving its BCMS?

Evidence: roadmaps, initiatives.

8. Assessment statuses

N/A – not applicable

OK – compliant

OBS – observations

MINOR NC – minor non-conformity

MAJOR NC – major non-conformity