Business Continuity Management Systems
Prepare for disruption, maintain operations, and recover quickly when something goes wrong.
Who it is for: Financial services, healthcare, utilities, and critical suppliers.
At a glance
- Standard
- ISO 22301
- Edition
- 2019
- Abbreviation
- BCMS
- Main clauses
- 10
- Certification cycle
- 3 years
Indicative from
$2,400
Single site, 8–12 weeks. Final figure follows scoping.
What ISO 22301 is actually made of
Like every standard on this site, ISO 22301 follows Annex SL — the common high-level structure. Clause 8 is where it becomes specific to business continuity; the rest is the management-system spine you would build for any of them.
- 4
Context of the organisation
Issues, interested parties, scope, and the system itself.
- 5
Leadership
Commitment, policy, and assigned roles and authorities.
- 6
Planning
Risks and opportunities, objectives, and planning for change.
- 7
Support
Resources, competence, awareness, communication, documented information.
- 8
Operation
Operational planning and control — the clause most specific to each standard.
- 9
Performance evaluation
Monitoring, internal audit, management review.
- 10
Improvement
Non-conformity, corrective action, continual improvement.
Four stages to ISO 22301:2019
Each stage has one defined output. You always know what has been produced and what is next — which is the difference between a consultancy engagement and a retainer that quietly never ends.
Gap analysis
Every clause assessed against how you work today, delivered as a written finding list with owners and effort — not a score out of ten.
Documentation
Manual, procedures, forms and records written around your operation. A template pack passes nothing, because auditors sample records, not documents.
Implementation & training
Staff trained, controls put into use, the internal audit run and the management review held — the two clauses that can only produce evidence over time.
Certification audit
Stage 1 readiness review and Stage 2 operational audit with the registrar, and support closing any non-conformities they raise.
Notice: WCA Global™is a consultancy and advisory firm. We prepare your organisation for certification against ISO 22301:2019. The certificate itself is issued independently by an accredited third-party registrar.
ISO 22301, answered
How long does ISO 22301 certification take?
For a single site under a hundred people, typically eight to sixteen weeks from gap analysis to Stage 2. The variable is almost never us — it is how quickly your team can produce the records the standard requires, because several clauses need evidence accumulated over weeks rather than written in an afternoon.
Do you issue the certificate?
No, and no consultancy should. WCA Global™ prepares your organisation; an accredited third-party registrar audits it and issues the certificate. Anyone offering to consult and certify is offering you a certificate that a serious customer will not accept.
Which edition applies — is 2019 current?
ISO 22301:2019 is the edition we implement against. Where a newer edition is published mid-engagement there is normally a transition period, and the documented system is built so the delta is a revision rather than a rewrite.
What happens after the certificate?
The certificate runs on a three-year cycle: surveillance audits in years one and two, recertification in year three. A system that stops being used between audits fails surveillance, which is why the retainer exists.
Can we certify against more than one standard at once?
Yes, and it is usually cheaper than doing them in sequence. Clauses 4 to 10 are common, so the second standard reuses the context, leadership, planning, support and evaluation work already done. We quote additional standards at 55% for that reason.