ISO 22301 Internal Auditor Training
Plan, conduct, report and follow up internal audits of a business continuity management system against ISO 22301:2019 — clause by clause, with clause 8 in full and the evidence an auditor should demand.
29
Lessons
~15h
Study time
30
Exam questions
70%
Pass mark
QR-verifiable Certificate of Training
Self-paced online, start today
About this course
ISO 22301:2019 is the international standard for business continuity management systems, and across the GCC it has become the reference point regulators, central banks and government audit functions use when they require an organisation to demonstrate that it can keep operating through a disruption. This course qualifies you to audit a BCMS from the inside: to plan the audit, gather and weigh evidence, interview incident response roles, write findings that survive challenge, and verify that corrective action actually corrected something.
The programme works through clauses 4 to 10 in the order an auditor meets them, with clause 8 taught in full — the business impact analysis at 8.2.2 read alongside the guidance in ISO/TS 22317, the business continuity risk assessment at 8.2.3, strategies and solutions at 8.3, plans and procedures at 8.4 including response structure, warning and communication and recovery, and the exercise programme and evaluation at 8.5 and 8.6. ISO 22313:2020 is used throughout to explain what the requirements look like when they are met well.
Along the way the course fixes the vocabulary auditors most often muddle — maximum tolerable period of disruption, recovery time objective, recovery point objective, minimum business continuity objective and prioritised activities — and shows exactly what evidence tests each one. It draws a precise boundary between business continuity, IT disaster recovery and crisis management, and it trains you to find the classic failures: the BIA completed once and never revisited, recovery time objectives the IT recovery capability cannot meet, a strategy never costed or approved, a plan with an out-of-date call tree, and an exercise programme that never leaves the comfortable scenario. The audit cycle follows ISO 19011:2018, and nonconformities are written using problem–location–requirement.
Assessment is a 30-question online exam with a 70% pass mark. Successful learners receive a verifiable SKEDMIA certificate. Approximately 15 hours of self-paced study.
- Standards referenced
- ISO 22301:2019, ISO 22313:2020, ISO/TS 22317, ISO 19011:2018
- Level
- Internal Auditor
- Subject
- Quality & Management
- Format
- Self-paced online — the lessons open as soon as you enrol
- Study time
- About 15 hours across 29 lessons
- Assessment
- Final Exam: 30 questions, 70% pass mark
- Exam attempts
- Unlimited, at no extra cost
- Certificate
- Skedmia Certificate of Training, valid for 1 year and verifiable at skedmia.com/verify
- Access
- Lifetime access with a one-time payment
Practise the audit before you do it for real
Reading a clause and auditing against it are different skills. Enrol on this course and you also get 6 months of AuditVerse, our interactive practice platform — you work through ISO audit scenarios, decide what to sample, and see how a finding holds up when it is challenged.
Sign in with the same email address and password you use here. Access runs for 6 months from the day you enrol, and there is nothing to buy or activate.
Open AuditVerseCourse content
10 modules · 29 lessons · about 15h · final exam
01Module 1 — Business Continuity and the BCMS — Foundations and the Internal Auditor's Remit3 lessons · 100 min
- What a BCMS Is and What ISO 22301:2019 Requires of It34 min
- Business Continuity, IT Disaster Recovery and Crisis Management — Drawing the BoundaryPreview35 min
- The Internal Auditor's Remit, Independence and the GCC Regulatory Backdrop30 min
02Module 2 — The Language of Continuity — MTPD, RTO, RPO, MBCO and Prioritised Activities3 lessons · 100 min
- MTPD and RTO — Reading the Timeline of a Disruption33 min
- RPO, MBCO and Prioritised Activities — Acceptable Loss and Minimum Capability35 min
- Tracing the Terms Through Evidence — A Worked Audit Trail30 min
03Module 3 — Context, Leadership and Interested Parties — Auditing Clauses 4 and 53 lessons · 100 min
- Clause 4 — Context, Interested Parties and the Scope of the BCMS34 min
- Clause 5 — Leadership, Policy and Roles35 min
- Auditing Governance in Practice — Interviews, Minutes and Budget Trails30 min
04Module 4 — Planning and Support — Auditing Clauses 6 and 73 lessons · 100 min
- Clause 6 — Risks and Opportunities, Objectives and Planning of Changes31 min
- Clause 7 — Resources, Competence, Awareness and Communication35 min
- Clause 7.5 — Documented Information and Version Control in a BCMS30 min
05Module 5 — Business Impact Analysis and Risk Assessment — Auditing Clause 8.23 lessons · 105 min
- Clause 8.1 and the Business Impact Analysis — Auditing 8.2.2 with ISO/TS 2231733 min
- Clause 8.2.3 — Auditing the Business Continuity Risk Assessment35 min
- Testing Analysis Against Reality — RTOs the Recovery Capability Cannot Meet30 min
06Module 6 — Business Continuity Strategies and Solutions — Auditing Clause 8.33 lessons · 100 min
- Clause 8.3 — Identifying, Selecting and Approving Strategies and Solutions32 min
- Resource Requirements and Implementation — People, Premises, Technology, Suppliers35 min
- Auditing Strategy Fitness — Does the Solution Deliver the MBCO Within the RTO?30 min
07Module 7 — Business Continuity Plans and Procedures — Auditing Clause 8.43 lessons · 100 min
- Clauses 8.4.1 and 8.4.2 — Response Structure and Plan Content33 min
- Clause 8.4.3 — Warning and Communication35 min
- Clauses 8.4.4 and 8.4.5 — Continuity Plans, Recovery and Return to Normal30 min
08Module 8 — Exercising, Evaluation and Performance — Auditing Clauses 8.5, 8.6 and 93 lessons · 105 min
- Clause 8.5 — Auditing the Exercise and Testing Programme32 min
- Clause 8.6 — Evaluation of Documentation and Capabilities, and Post-incident Review35 min
- Clause 9 — Monitoring, Measurement, Internal Audit and Management Review35 min
09Module 9 — Conducting the Internal Audit — ISO 19011:2018 from Programme to Verification3 lessons · 105 min
- Planning the Audit — Programme, Plan, Checklist and Sampling33 min
- Fieldwork — Evidence, Interviews with Incident Response Roles and Walkthroughs35 min
- Findings, the Report, Corrective Action and Verification — with Clause 1035 min
10Course materials & downloads2 lessons
- BCMS Internal Audit Checklist — ISO 22301:2019 Clauses 4 to 10 (PDF)
- MTPD, RTO, RPO and MBCO — Definition and Evidence Comparison Chart (PDF)
What you earn
A certificate anyone can verify in seconds
Score 70% or better on the final exam and Skedmia issues your Certificate of Training with a unique certificate number. Every certificate carries a QR code that resolves to our public register, so an employer or auditor can confirm it is genuine without contacting anyone. Certificates state a validity of 1 year from issue and can be renewed.
Verified at skedmia.com/verify
Certified by
Before you enrol
How is the course delivered?
Entirely online and self-paced. Once you enrol, the lessons open immediately in your Skedmia account on any device, and you can stop and resume whenever you like.
How do I earn the certificate?
Complete the lessons, then sit the 30-question final exam. Score 70% or more and your Certificate of Training is issued straight away with a unique certificate number and QR code. The PDF downloads from your account.
What happens if I don't pass?
Review the lessons and retake the exam as many times as you need, at no extra cost. Each attempt is marked immediately.
How does an employer verify my certificate?
Every certificate carries a QR code and a certificate number. Scanning the code, or entering the number on our verification page, returns the holder’s name, the course and the issue date. No account is needed.
How can I pay?
By card through our secure Stripe checkout, with access opening instantly. Or by bank transfer: we show our account details and an order reference, you send the receipt, and the course opens once the payment is verified.
Can I enrol a team?
Yes. Organisations enrol staff as a cohort, follow progress on a manager dashboard and receive completion reports formatted for an audit file. See corporate training or send an enquiry.
For organisations
Training a whole team on this course?
Enrol staff as a cohort, follow progress from one dashboard and receive completion reports ready for your audit file.
Free Zone
Free documents for this standard
- ISO 22301 Business Continuity Self-Assessment ChecklistBuild your business continuity plan section by section with this self-assessment checklist.Free
- SOC Analyst (L1) Masterclass: Triage Method, 10 Incident Scenarios, 11 Labs & 111 Interview Questions KitA condensed SOC analyst handbook that takes a new analyst from SOC basics and alert triage to incident scenarios, hands-on labs and interview readiness.Free
- Detection Engineering 2026: 100 SIEM Use Cases, ATT&CK v19.2 Mapping, Tuning, Response & Validation KitA 40-page summary of 100 detection rules across 20 domains, with tuning, investigation, response, validation and roll-out guidance.Free
Keep browsing
More quality & management training
Certification Programs
ISO 9001 Awareness
Certified Quality Engineer
NEW