What evidence does an ISO 22301 auditor ask for?
Evidence that each requirement produced its outcome: a context analysis with issues tied to continuity outcomes, an impact analysis with impact over time and approved recovery targets, a strategy traceable to those targets, plans derived from the strategy, an exercise programme with aims and reports, and an evaluation that updates the documentation.
For the impact analysis
Impact types and criteria, the activity inventory, impact over time, the maximum tolerable period, prioritized resumption time frames at a stated minimum capacity, and the dependencies and resources of the prioritized activities.
For the strategy and plans
A strategy traceable to the impact and risk findings, a selection rationale, resource requirements per solution, implementation and maintenance records, and plans that derive from the selected solutions.
For the exercise programme
A programme with scenarios, stated aims, formal reports after each exercise, actions tracked to closure, and a coverage analysis showing every strategy and solution is validated over the cycle.
Check it yourself
The ISO record for the draft / The stage timeline / What is not stated / The ISO 22301 clause register