ISO 22301 Business Continuity Audit Readiness: 20 Evidence Checks for Manufacturers

A business continuity plan is not evidence that a business can continue operating. A manufacturer may have a crisis contact list, alternate supplier names and a disaster recovery document, yet still be unable to explain which products must be delivered first when a critical machine, supplier, utility or IT service fails. The central question for ISO 22301 audit readiness is whether business continuity decisions are supported by realistic analysis, usable arrangements and evaluated exercises.

This practical guide is written for manufacturing leaders, supply-chain teams, internal auditors, operations managers and business continuity professionals. It provides 20 objective evidence checks, examples, document trails and a realistic readiness sequence. The checklist is an editorial preparation tool—not a substitute for the copyrighted standard, its amendment, customer obligations or qualified audit judgement.

1. Understand ISO 22301:2019 and its current revision status

ISO 22301:2019 is the published second edition of the international requirements standard for business continuity management systems (BCMS). Amendment 1:2024 adds climate-action changes. A third-edition ISO/CD 22301 is under development in 2026, but a committee draft should not be represented as a published replacement or a new certification requirement.

ISO 22301 is designed to help organizations prepare for, respond to and recover from disruption and maintain products and services at predefined acceptable capacity. A functioning BCMS is not a guarantee that no interruption will occur. Its effectiveness depends on the organization’s context, resources, tested response and actual recovery capabilities.

2. Establish business continuity scope and obligations

Define the products, services, sites, functions and activities included in the BCMS. For example, a manufacturer may need to cover production, quality release, purchasing, warehouse operations, dispatch and the IT applications supporting those activities. A narrow scope is not inherently wrong, but it must be clear enough for customers and auditors to understand what is and is not covered.

Connect the scope to relevant customer commitments, legal requirements, outsourced services and interested parties. Keep a traceable record of who approved the boundaries and why. Scope decisions should be revisited if a new plant, contract, logistics model or mission-critical supplier materially changes the organization’s exposure.

3. Make the business impact analysis decision-useful

A business impact analysis (BIA) examines how disruption affects an organization’s products, services and activities as time passes. It differs from a generic risk list: the BIA asks what becomes unacceptable, when, and which capabilities are needed for continuity. ISO/TS 22317:2021 provides guidance for a documented, adaptable BIA process; it does not impose one universal worksheet.

In manufacturing, ask how a four-hour, one-day or three-day stop would affect customer deliveries, material condition, safety, contractual commitments and cash flow. Identify priority products and linked activities. Obtain management agreement on the assumptions and priority decisions rather than accepting isolated department estimates.

4. Define recovery objectives that have operational meaning

Recovery objectives should reflect the BIA. The recovery time objective (RTO) indicates the target time for restoring a prioritized activity or resource; the recovery point objective (RPO) is relevant when the acceptable amount of lost data must be defined. The maximum tolerable period of disruption is a different boundary, not simply another name for RTO.

An illustrative factory might require order-release capability within eight hours but allow a longer interruption for a non-critical reporting function. Those figures are examples, not ISO-mandated thresholds. Inspect whether chosen targets align with tested backup arrangements, supplier agreements, alternate capacity and decision-making authority.

5. Identify single points of failure in production

A production process can depend on one machine, specialized tool, production recipe, utility connection or uniquely trained person. Map these dependencies for the prioritized activities identified in the BIA. A generic “equipment breakdown” risk entry is less useful than identifying which specific operation can stop shipment and what alternative is genuinely available.

Consider availability of spare parts, qualified repair personnel, validated subcontracting arrangements, alternate processes and the lead time to restart safely. Evidence should link each critical resource to a workable response. For an engineering-oriented parallel, Shark’s article on measurement system reliability shows why availability or calibration records alone may not establish process effectiveness.

6. Assess supplier continuity beyond declarations

Critical raw materials, specialist services, transport providers and utility vendors can interrupt production without any failure inside the factory. Review the concentration of supply, substitution constraints, lead times and upstream dependencies. Document whether an alternate supplier is actually approved for the relevant specification, rather than merely listed in a spreadsheet.

ISO/TS 22318:2021 gives guidance on supply-chain continuity management and supplier relationships. Trace one critical material from the BIA through supplier evaluation, alternate sourcing, customer approvals and evidence of a recent review. Shark’s supplier-declarations analysis explains why assurance claims need supporting verification.

7. Include workforce availability and decision authority

People-related disruption may arise from transport restrictions, illness, severe weather, labour shortages or unavailability of key specialists. The organization should consider which roles are essential, what cross-training exists and how safe work can continue with a reduced workforce. Critical activities need more than names on an emergency call tree.

Clarify who can activate continuity arrangements, prioritize orders, approve substitutions, authorize exceptional spending and communicate with customers. A single named decision-maker with no delegate is itself a vulnerability. Test whether deputies understand the authority they are expected to exercise.

8. Examine utilities, physical site and environmental disruption

Manufacturing continuity may depend on electrical supply, water, compressed air, cooling, ventilation, transport access, buildings and safe storage. Consider credible site-level scenarios and practical constraints: a backup generator might support lighting and IT but not an entire high-load production line. Do not treat installed equipment as proof of tested capacity.

The 2024 amendment requires consideration of climate change in relevant management-system context. That does not mean ISO 22301 imposes the same climate risk assessment for every facility. Examine whether relevant hazards such as flooding, extreme heat or severe storms affect dependencies and planning assumptions, and document the organization’s conclusion.

9. Separate IT disaster recovery from overall continuity

ERP, production scheduling, quality records, dispatch systems, access control and customer communications may depend on digital infrastructure. The IT disaster recovery plan should support the business recovery objectives; restoring a server without restoring the usable workflow may not meet the operational need.

Evidence can include backup coverage, restoration tests, access to offline procedures, dependency maps and decision authority for failover. Coordinate with cybersecurity and information-security personnel where relevant. A company with information-security governance still needs to establish whether critical business functions can operate during an actual outage.

10. Plan crisis communication before the disruption

A continuity response can fail when decisions are delayed or different stakeholders receive conflicting information. Define who communicates internally and externally, which channels are available if normal systems fail, and when customer, supplier, emergency-service or regulatory notifications may be needed.

During an exercise, ask whether contact details worked, whether message approvals were clear and whether operational facts reached decision-makers in time. Avoid promises that a normal production date will be maintained until engineering and logistics teams have verified feasible recovery options.

11. Distinguish emergency response, continuity and recovery

Emergency response prioritizes immediate protection of people and property; business continuity focuses on maintaining prioritized products and services at acceptable capacity; recovery covers restoring operations toward normal conditions. These activities interact, but a fire evacuation instruction does not replace a plan for delivering critical customer orders.

For example, a warehouse fire scenario may require safe evacuation, incident command, stock assessment, alternate warehouse capacity, updated customer commitments and controlled restart. Review whether interfaces among safety, production, warehouse and commercial teams are assigned and rehearsed.

12. Confirm that business continuity plans are usable

Plans should answer practical operational questions: who activates them, what triggers a response, which first actions matter, where essential records are held, which workarounds are approved and who decides when normal activity can resume. A very long document may be less effective than accessible decision cards backed by complete procedures.

Select a planned workaround and interview its owner. Can they locate the latest instructions when the network is unavailable? Are contact lists controlled? Would the workaround preserve necessary safety, product quality and customer commitments? The audit trail needs to connect written arrangements to the people who will use them.

13. Test the assumptions through exercises

Tabletop discussions, communications drills, partial technical tests and more complex simulations can all provide evidence, depending on risk and scope. A signature on an exercise attendance register does not establish that recovery objectives were met. Define exercise objectives, realistic inputs, roles, expected decisions and criteria for evaluating the outcome.

After each exercise, document limitations, measured times, unexpected constraints, corrective actions and their owners. If an alternate site could not achieve required capacity, revise the strategy or the recovery assumptions instead of reporting the exercise as an unqualified success. Relevant practical planning examples also appear in Ready.gov’s business emergency guidance.

14. Keep changes, incidents and lessons linked

Process layouts, machinery, software, suppliers and customer demands change. A BCMS can become unreliable when the BIA and recovery plans remain frozen after a major operational change. Include continuity implications in appropriate purchasing, capital-project and process-change reviews.

Following real incidents or near misses, record what happened, which arrangements worked, where delays occurred and which corrective actions were effective. Trace an action beyond closure status to updated documents, retraining or exercises. Shark’s corrective-action analysis discusses this distinction in management-system practice.

15. Internal audits must follow evidence, not confidence

Auditors should establish criteria from the applicable ISO 22301 requirements, the organization’s commitments and defined BCMS scope. They can then sample real dependencies, exercises, change records and management decisions. An auditor’s impression that the company “seems resilient” or “has weak resilience culture” is not sufficient on its own.

Where a nonconformity is identified, show exactly which criterion is unmet and which verifiable evidence supports that finding. For example, an approved recovery arrangement may never have been evaluated for the stated operating conditions. Relevant audit discipline is discussed in Shark’s internal audit effectiveness article.

16. Management review should change actual priorities

Management review should consider disruption-related changes, performance of continuity arrangements, exercise results, audit conclusions, resources and unresolved actions. It should inform decisions on whether the BCMS remains suitable and effective. Meeting minutes become valuable when they trace real matters to leadership decisions and follow-through.

An illustrative example is a repeated generator test failure that leads to approved investment, a revised interim arrangement and a verified follow-up test. Recording “business continuity reviewed” without considering the operational implication does not show the same level of management-system effectiveness.

17. A 20-point ISO 22301 audit readiness checklist

Use this practical evidence checklist to prepare for discussion with an internal auditor or certification body. It is not a reproduction of the standard’s clauses and does not introduce fixed universal limits. Record each item’s owner, sample evidence, current status and follow-up action.

1. 01. The BCMS scope clearly identifies covered sites, activities and services.
2. 02. Relevant customer, legal and other obligations are documented and reviewed.
3. 03. Interested parties and material context changes are identified.
4. 04. Leadership responsibilities and deputies are assigned.
5. 05. A BIA identifies prioritized products, services and activities.
6. 06. The BIA examines impacts over time and justifies continuity priorities.
7. 07. Recovery targets align with approved business impact requirements.
8. 08. Critical production resources and single points of failure are mapped.
9. 09. Critical suppliers and approved alternatives are assessed.
10. 10. Personnel, skills and decision authorities are available during disruption.
11. 11. Utility and physical-site dependencies have workable response arrangements.
12. 12. Relevant climate-related context is considered and documented.
13. 13. IT restoration assumptions support prioritized business operations.
14. 14. Incident activation and crisis communication routes are defined.
15. 15. Emergency response interfaces with continuity and recovery plans.
16. 16. Plans are accessible, version-controlled and understood by relevant personnel.
17. 17. Exercises evaluate realistic scenarios and record actual outcomes.
18. 18. Problems lead to verified corrective action and plan revision.
19. 19. Internal audits sample real operational evidence against valid criteria.
20. 20. Management reviews produce decisions, responsibilities and tracked follow-up.

18. Frequently asked questions about ISO 22301

Is ISO 22301:2019 still the published edition in October 2026?

Yes. ISO 22301:2019 is published with Amendment 1:2024 on climate action changes. The developing third edition is not yet the published replacement. Check the ISO catalogue before formal certification planning.

Does a business continuity policy prove conformity?

No. A policy is only one part of a management system. Auditors need objective evidence showing that relevant requirements are met and arrangements work as intended.

Is a risk register the same as a business impact analysis?

No. Risk assessment considers uncertainty and possible disruptive events; a BIA identifies the consequences of disruption over time, critical priorities and continuity requirements. Their findings should inform one another.

Does ISO 22301 require every manufacturer to restore operations in 24 hours?

No universal 24-hour restoration requirement is set by this guide. Appropriate recovery targets must be derived from the organization’s BIA, commitments, resources and the applicable requirements.

Does an ISO 27001 certificate automatically cover business continuity certification?

No. Information security and business continuity may have overlapping controls, but certification scope and standards are different. Examine the stated scope and evidence rather than assuming equivalence.

Primary standards and guidance: ISO 22301:2019; ISO 22301 Amendment 1:2024; ISO 22313:2020 guidance; ISO/TS 22317:2021 business impact analysis; ISO/TS 22318:2021 supply chain continuity. The normative requirements should be checked in the actual standard during conformity assessment.

Planning a management-system audit or continuity readiness review? Contact Shark Certification to discuss your business context, applicable scope and relevant services. Confirm the specific ISO 22301 certification offering and any accreditation scope before selecting a certification body. The strongest audit preparation is evidence that your organization can respond, sustain prioritized activities and improve its recovery capability.