ISO 22301 Internal Auditor Training
Plan, conduct, report and follow up internal audits of a business continuity management system against ISO 22301:2019 — clause by clause, with clause 8 in full and the evidence an auditor should demand.
29
Lessons
~15h
Study time
30
Exam questions
Earns a QR-verifiable Certificate of Training
Overview
About this course
ISO 22301:2019 is the international standard for business continuity management systems, and across the GCC it has become the reference point regulators, central banks and government audit functions use when they require an organisation to demonstrate that it can keep operating through a disruption. This course qualifies you to audit a BCMS from the inside: to plan the audit, gather and weigh evidence, interview incident response roles, write findings that survive challenge, and verify that corrective action actually corrected something.
The programme works through clauses 4 to 10 in the order an auditor meets them, with clause 8 taught in full — the business impact analysis at 8.2.2 read alongside the guidance in ISO/TS 22317, the business continuity risk assessment at 8.2.3, strategies and solutions at 8.3, plans and procedures at 8.4 including response structure, warning and communication and recovery, and the exercise programme and evaluation at 8.5 and 8.6. ISO 22313:2020 is used throughout to explain what the requirements look like when they are met well.
Along the way the course fixes the vocabulary auditors most often muddle — maximum tolerable period of disruption, recovery time objective, recovery point objective, minimum business continuity objective and prioritised activities — and shows exactly what evidence tests each one. It draws a precise boundary between business continuity, IT disaster recovery and crisis management, and it trains you to find the classic failures: the BIA completed once and never revisited, recovery time objectives the IT recovery capability cannot meet, a strategy never costed or approved, a plan with an out-of-date call tree, and an exercise programme that never leaves the comfortable scenario. The audit cycle follows ISO 19011:2018, and nonconformities are written using problem–location–requirement.
Assessment is a 30-question online exam with a 70% pass mark. Successful learners receive a verifiable SKEDMIA certificate. Approximately 15 hours of self-paced study.
Practise the audit before you do it for real
Reading a clause and auditing against it are different skills. Enrol on this course and you also get 6 months of AuditVerse, our interactive practice platform — you work through ISO audit scenarios, decide what to sample, and see how a finding holds up when it is challenged.
Sign in with the same email address and password you use here. Access runs for 6 months from the day you enrol, and there is nothing to buy or activate.
Open AuditVerseWhat you earn
A certificate anyone can verify in seconds
Score 70% or better on the final exam and Skedmia issues your Certificate of Training with a unique certificate number. Every certificate carries a QR code that resolves to our public register, so an employer or auditor can confirm it is genuine without contacting anyone.
Verified at skedmia.com/verify
Certified by
Syllabus
Course content
10 modules · 29 lessons · ~15h
01Module 1 — Business Continuity and the BCMS — Foundations and the Internal Auditor's Remit3 lessons
- What a BCMS Is and What ISO 22301:2019 Requires of It34 min
- Business Continuity, IT Disaster Recovery and Crisis Management — Drawing the BoundaryPreview35 min
- The Internal Auditor's Remit, Independence and the GCC Regulatory Backdrop30 min
02Module 2 — The Language of Continuity — MTPD, RTO, RPO, MBCO and Prioritised Activities3 lessons
- MTPD and RTO — Reading the Timeline of a Disruption33 min
- RPO, MBCO and Prioritised Activities — Acceptable Loss and Minimum Capability35 min
- Tracing the Terms Through Evidence — A Worked Audit Trail30 min
03Module 3 — Context, Leadership and Interested Parties — Auditing Clauses 4 and 53 lessons
- Clause 4 — Context, Interested Parties and the Scope of the BCMS34 min
- Clause 5 — Leadership, Policy and Roles35 min
- Auditing Governance in Practice — Interviews, Minutes and Budget Trails30 min
04Module 4 — Planning and Support — Auditing Clauses 6 and 73 lessons
- Clause 6 — Risks and Opportunities, Objectives and Planning of Changes31 min
- Clause 7 — Resources, Competence, Awareness and Communication35 min
- Clause 7.5 — Documented Information and Version Control in a BCMS30 min
05Module 5 — Business Impact Analysis and Risk Assessment — Auditing Clause 8.23 lessons
- Clause 8.1 and the Business Impact Analysis — Auditing 8.2.2 with ISO/TS 2231733 min
- Clause 8.2.3 — Auditing the Business Continuity Risk Assessment35 min
- Testing Analysis Against Reality — RTOs the Recovery Capability Cannot Meet30 min
06Module 6 — Business Continuity Strategies and Solutions — Auditing Clause 8.33 lessons
- Clause 8.3 — Identifying, Selecting and Approving Strategies and Solutions32 min
- Resource Requirements and Implementation — People, Premises, Technology, Suppliers35 min
- Auditing Strategy Fitness — Does the Solution Deliver the MBCO Within the RTO?30 min
07Module 7 — Business Continuity Plans and Procedures — Auditing Clause 8.43 lessons
- Clauses 8.4.1 and 8.4.2 — Response Structure and Plan Content33 min
- Clause 8.4.3 — Warning and Communication35 min
- Clauses 8.4.4 and 8.4.5 — Continuity Plans, Recovery and Return to Normal30 min
08Module 8 — Exercising, Evaluation and Performance — Auditing Clauses 8.5, 8.6 and 93 lessons
- Clause 8.5 — Auditing the Exercise and Testing Programme32 min
- Clause 8.6 — Evaluation of Documentation and Capabilities, and Post-incident Review35 min
- Clause 9 — Monitoring, Measurement, Internal Audit and Management Review35 min
09Module 9 — Conducting the Internal Audit — ISO 19011:2018 from Programme to Verification3 lessons
- Planning the Audit — Programme, Plan, Checklist and Sampling33 min
- Fieldwork — Evidence, Interviews with Incident Response Roles and Walkthroughs35 min
- Findings, the Report, Corrective Action and Verification — with Clause 1035 min
10Course materials & downloads2 lessons
- BCMS Internal Audit Checklist — ISO 22301:2019 Clauses 4 to 10 (PDF)
- MTPD, RTO, RPO and MBCO — Definition and Evidence Comparison Chart (PDF)
Free Zone
Free documents for this standard
Keep browsing
