This checklist audits business continuity within an IMS1 management system, from the BCMS scope and lead to plans, supplier continuity and testing.

Effective Audit Checklists

Prepared using the F-Q2 Audit Checklist form template.

The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Checklist number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists developed over 25 years through practical use in the real world.

Further Reading

Further guidance on business continuity and internal auditing:

• ISO 22301 knowledge base
• Business Impact Analysis
• Backup, Disaster Recovery and ICT Continuity
• Internal Auditing knowledge base

Logo Update Service

Download this audit checklist template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This checklist is also included in the ISO 22301 Toolkit and the integrated toolkits that include ISO 22301, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

IMS1 Business Continuity Audit Checklist Template - ISO 22301

An audit checklist for the business continuity management system (BCMS) within a management system built on the alphaZ IMS1 manual, set against ISO 22301:2019. The questions are referenced to the IMS1 sections and to the alphaZ registers and procedures used with them. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.

Areas Covered

• IMS1 Section 1 - the BCMS in the context and scope, the business continuity policy, and legislative requirements
• IMS1 Section 2 - policies and the business continuity procedure PP-1-05, management review and objectives, the business continuity lead and responsibilities, and risks and business impact analysis on ER16, including climate change
• BCMS objectives - objectives that take account of the minimum acceptable level of products and services
• Interested parties - F-IMS22 covering the parties relevant to the BCMS
• Business continuity arrangements - plans, critical functions and assumptions, ER16 and F-IMS21
• Communication, supplier continuity, and monitoring and testing - incident communication, suppliers and outsourced services that affect critical functions, monitoring and testing the arrangements, and the records kept

Carrying Out the Audit

Follow one critical function through ER16, the continuity plan and the last test, and check the plan would still work with the people and suppliers in place today. The test records are the main evidence that the arrangements have been tried.

Planning the Audit

Have IMS1, PP-1-05, ER16, F-IMS21, F-IMS22 and the records of the last test to hand.

Who Should Carry Out the Audit?

Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.

Included in the ISO 22301 Toolkit

This checklist is part of the ISO 22301 Toolkit and the integrated toolkits that include ISO 22301.

Related Documents

Documents that work alongside this checklist:

• PP-1-05 Business Continuity Policy Procedure
• ER16 Business Continuity Risk Register
• F-IMS21 Business Continuity Register
• F-IMS22 Interested Parties Register
• F-Q93 Continuity Test Record

Part of the IMS1 Audit Checklists

The IMS1 audit checklists follow the sections of the alphaZ IMS1 manual. The IMS1 ISO 9001 Checklist covers Sections 1 to 5 in one audit, and the checklists for Section 1, Section 2, Section 3, Section 4 and Section 5 let the audit be spread across the year using the ER11 Audit Schedule. The results can be written up using the F-Q31 Audit Report.

Not Using IMS1?

For a management system that is not built on IMS1, the Business Continuity Management System Audit Checklist covers the same ground without the IMS1 references.

Using the Findings

Plans that are out of date or untested, or critical suppliers without continuity arrangements, are raised as actions, with a test planned before the next audit.