This checklist audits the business continuity management system, from policy and responsibilities to plans, supplier continuity and testing.
Prepared using the F-Q2 Audit Checklist form template.
The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Checklist number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists
developed over 25 years through practical use in the real world.
Further guidance on business continuity and internal auditing:
Download this audit checklist template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This checklist is also included in the ISO 22301 Toolkit and the integrated toolkits that include ISO 22301, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Business Continuity Management System Audit Checklist Template
A management system audit checklist for a business continuity management system (BCMS) to ISO 22301, covering context and scope, policy and arrangements, responsibilities, risks and business impact analysis, objectives, interested parties, continuity plans, communication, supplier continuity, and monitoring and testing. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.
Areas Covered
- Context, scope and policy - the BCMS in the context and scope, and the business continuity policy and procedure
- Responsibilities - the business continuity lead and the other roles in the continuity arrangements
- Risks and business impact analysis - monitoring and controls, and review of risks and the business impact analysis
- BCMS objectives - objectives that take account of the minimum acceptable level of products and services
- Interested parties - those relevant to the BCMS
- Business continuity arrangements - plans, critical functions and assumptions
- Communication - what needs to be communicated in an incident
- Supplier continuity - suppliers and outsourced services that could affect critical functions
- Monitoring and testing - detecting incidents, testing the arrangements and the records kept
Carrying Out the Audit
Follow one critical function through the business impact analysis, the continuity plan and the last test, and check the plan would still work with the people and suppliers in place today. The test records are the main evidence that the arrangements have been tried.
Planning the Audit
Have the business continuity policy and procedure, the business continuity risk register, the continuity plans and the records of the last test to hand.
Who Should Carry Out the Audit?
Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.
Included in the ISO 22301 Toolkit
This checklist is part of the ISO 22301 Toolkit and the integrated toolkits that include ISO 22301.
Related Documents
Documents that work alongside this checklist:
Using the IMS1 Manual?
Where the management system is built on the alphaZ IMS1 manual, the IMS1 Business Continuity Checklist covers the same ground, with each question referenced to its IMS1 section and the alphaZ forms and registers used with it.
Using the Findings
Plans that are out of date or untested, or critical suppliers without continuity arrangements, are raised as actions, with a test planned before the next audit.
Would you rather we did it for you?
Our Internal Audit Training and Support service works through your internal audits with you while training your own people as internal auditors, so the audits are completed and the skills stay in the business.
Internal Audit Training and Support