ISO 22301:2019 Business Continuity Management Systems Internal Auditor

About Course

Develop business-continuity internal audit skills through 12 modules and 36 text lessons with exercises and model feedback. Cover ISO 22301:2019 clauses 4–10 and Amendment 1:2024: context, leadership, business impact analysis, disruption risk assessment, strategies, response plans, exercises and improvement. Practise audit planning, sampling, evidence, findings and follow-up. Includes a 40-question exam and marked practical assignment. Total workload: 14 hours excluding breaks.

LO01: Explain the BCMS, key continuity concepts, current edition and audit criteria.
LO02: Evaluate context, interested parties, BCMS boundaries, leadership and accountability.
LO03: Assess BCMS objectives, resources, competence, communication and controlled information.
LO04: Audit impact analysis, recovery priorities, time/data objectives and disruption risks.
LO05: Evaluate strategy selection, resources, dependencies and implemented continuity capability.
LO06: Assess activation, communication, operational continuity, recovery and return arrangements.
LO07: Evaluate exercise evidence, capability reviews, performance, management review and corrective action.
LO08: Apply ethics, competence, independence and risk-informed audit programme planning.
LO09: Prepare audit objectives, criteria, process trails and justified continuity samples.
LO10: Collect reliable evidence through interviews, records and authorized demonstrations.
LO11: Write supported findings, communicate capability limits and verify corrective-action effectiveness.
LO12: Apply BCMS audit skills to a fictional recovery exercise and assessed assignment.

Course Content

Business continuity and audit foundations
Explain the BCMS, key continuity concepts, current edition and audit criteria.

What a business continuity management system does
Disruption, response, continuity and recovery
ISO 22301:2019 and Amendment 1:2024

Context, scope and leadership
Evaluate context, interested parties, BCMS boundaries, leadership and accountability.

Planning, people and documented information
Assess BCMS objectives, resources, competence, communication and controlled information.

Business impact analysis and risk assessment
Audit impact analysis, recovery priorities, time/data objectives and disruption risks.

Continuity strategies and solutions
Evaluate strategy selection, resources, dependencies and implemented continuity capability.

Response structure and continuity plans
Assess activation, communication, operational continuity, recovery and return arrangements.

Exercises, evaluation and improvement
Evaluate exercise evidence, capability reviews, performance, management review and corrective action.

Auditor principles and programme management
Apply ethics, competence, independence and risk-informed audit programme planning.

Planning and sampling the audit
Prepare audit objectives, criteria, process trails and justified continuity samples.

Conducting a BCMS internal audit
Collect reliable evidence through interviews, records and authorized demonstrations.

Findings, reports and follow-up
Write supported findings, communicate capability limits and verify corrective-action effectiveness.

Integrated business continuity audit practice
Apply BCMS audit skills to a fictional recovery exercise and assessed assignment.

Assignment

Assessment

Student Ratings & Reviews

No Review Yet

Share this course

About Course

What Will You Learn?

Course Content

Business continuity and audit foundations Explain the BCMS, key continuity concepts, current edition and audit criteria.

What a business continuity management system does

Disruption, response, continuity and recovery

ISO 22301:2019 and Amendment 1:2024

Context, scope and leadership Evaluate context, interested parties, BCMS boundaries, leadership and accountability.

Context and interested parties — clause 4

Scope and BCMS processes — clause 4

Leadership, policy and responsibilities — clause 5

Planning, people and documented information Assess BCMS objectives, resources, competence, communication and controlled information.

BCMS risks, objectives and planned changes — clause 6

Resources, competence, awareness and communication — clause 7

Controlled documented information — clause 7

Business impact analysis and risk assessment Audit impact analysis, recovery priorities, time/data objectives and disruption risks.

Business impact analysis — clause 8.2

Time, capacity and data recovery requirements

Disruption risks and dependency analysis — clause 8.2

Continuity strategies and solutions Evaluate strategy selection, resources, dependencies and implemented continuity capability.

Selecting strategies and solutions — clause 8.3

Resource requirements and external dependencies — clause 8.3

Implementing and maintaining solutions — clauses 8.1 and 8.3

Response structure and continuity plans Assess activation, communication, operational continuity, recovery and return arrangements.

Response structure and activation — clause 8.4

Warning and communication — clause 8.4

Continuity procedures, recovery and return — clause 8.4

Exercises, evaluation and improvement Evaluate exercise evidence, capability reviews, performance, management review and corrective action.

Exercise programme and capability evaluation — clauses 8.5 and 8.6

Monitoring, internal audit and management review — clause 9

Nonconformity and improvement — clause 10

Auditor principles and programme management Apply ethics, competence, independence and risk-informed audit programme planning.

Audit ethics, independence and confidentiality

Auditor competence and technical support

Risk-informed internal audit programme

Planning and sampling the audit Prepare audit objectives, criteria, process trails and justified continuity samples.

Objectives, scope, criteria and the audit plan

Process-based audit trails

Sampling priorities, sites and dependencies

Conducting a BCMS internal audit Collect reliable evidence through interviews, records and authorized demonstrations.

Opening the audit and safe evidence access

Interviews and corroborating evidence

Recovery timelines and digital evidence

Findings, reports and follow-up Write supported findings, communicate capability limits and verify corrective-action effectiveness.

Writing defensible BCMS findings

Reporting and closing the audit

Corrective-action review and effectiveness

Integrated business continuity audit practice Apply BCMS audit skills to a fictional recovery exercise and assessed assignment.

Integrated BCMS audit: planning and calculations

Integrated BCMS audit: conclusions and actions

Assessment preparation and continuing competence