See where your business continuity management system stands against ISO 22301:2019, and what to fix first.
ISO 22301 Benchmarking gives you an honest, evidence-based picture of where your business continuity management system (BCMS) stands today against ISO 22301:2019. It is most useful before an audit, before an attempt at certification, or before management decides where to invest next.
It is a diagnostic, not a pass or fail. The result shows what is already working, what is partly in place and what is missing, so the next steps are chosen with facts rather than assumptions.
It builds on the BCMS Maturity Model and on the independent ISO 22301 review described on the BCMS Consultancy page. New to the standard? Start with ISO 22301.
A system can have every policy in place and still struggle on the day. So the benchmark looks at three things together.
Policies, procedures, impact analyses, risk assessments, plans, exercise reports and management review records, read against what the standard asks for.
Records that show the processes are actually run, such as dated reviews, signed decisions, completed exercises and closed actions.
Short conversations with those who hold continuity roles, to confirm they know what is expected of them and how they would act.
Documented and operating are different things. The benchmark shows both, and where the two have drifted apart.
The benchmark works through clauses 4 to 10 of ISO 22301:2019, the clauses that hold the requirements of the BCMS. Each area has a few plain-language focus points, shown below. Clause names and numbers are used only to refer to the standard.
These set out the scope, references and terms of the standard. They frame the work, so the benchmark itself concentrates on clauses 4 to 10.
Each area is rated on a simple traffic-light view, so you can see where to look first without reading a long report.
The requirement is missing or largely unmet. These areas come first.
Part of the requirement is in place, but key elements are missing or not yet shown in practice.
The requirement is met, with evidence that it is working.
The ratings combine into an overall maturity picture of your BCMS. See how maturity is described on the BCMS Maturity Model page.
Every organisation is different, but certain themes appear often. These are general patterns, not findings about any one client.
Leadership says continuity matters, but there are no dated decisions, review records or allocated resources to show it.
The business impact analysis identifies what matters most, but its findings never reach the strategies and plans.
Plans describe what should happen, without the steps, named roles and decision points that someone under pressure needs.
The same scenario, room and participants each year build familiarity, but do not test whether recovery would really work.
Plans sit in shared folders with no owners, versions or review dates, so people may be working from out-of-date copies.
Exercise reports list findings, but nobody owns them, so the same points return the following year.
The outcome is a clear, prioritised improvement roadmap: what to fix first, and why it matters, in a form that management can discuss and decide on.
This is an independent benchmarking and advisory review, not a certification audit. ADVOX does not issue ISO certificates. Certification is carried out by an accredited certification body, and ADVOX gives no certification, approval or compliance-approval. The approach mirrors the independent review described for ISO 22301.
The standard, what it covers and who it is for.
How maturity of a BCMS is described.
Independent reviews and advisory support.
A review of your business continuity framework.
A plain-language guide to the subject.
We aim to reply to your enquiry within 2 hours.
Topics informed by the RiskTemplates article on ISO 22301 gap analysis and BCMS maturity. This page is ADVOX’s own summary, written in its own words. It is general information, not legal, regulatory or compliance advice. Copyright in the sources named above belongs to their owners.