ISO 22301 consultancy: make the BCMS work in practice
ISO 22301 sets requirements for a business continuity management system (BCMS)—the organised way a business establishes, operates, monitors, maintains and improves its ability to respond to disruption. Consultancy can help an organisation understand the standard, develop a programme, run a business impact analysis, establish recovery strategies and exercise plans, and prepare for an independent certification assessment if it chooses that route.
The published standard in October 2026 is ISO 22301:2019, with its 2024 amendment. ISO has also published an ISO/CD 22301 committee draft for a future edition; that draft is under development and must not be described as a current certification requirement. The standard’s copyrighted detailed text is not reproduced here.
What a BCMS implementation covers
Start by defining organisational scope, business continuity objectives, governance and interested parties. Establish criteria for impact and risk assessment, then identify priority activities, recovery requirements and options. Document workable plans for disruption, train the relevant people and exercise them. Internal review and management evaluation should turn the results into improvements rather than one-off audit preparation.
An ISO-aligned continuity programme still needs to reflect the actual organisation. A bank’s priority services differ from a professional-services firm’s. Even within one business, remote work might protect a sales function while failing a secure processing activity that requires specialist access or a physical facility.
ISO certification versus consultant support
Consultants can help implement and improve a BCMS and prepare evidence for certification, but an independent accredited certification body determines certification according to its own assessment. Hiring an ISO consultant does not itself confer certification. Any supplier promising a certificate without independent assessment warrants careful scrutiny.
Relating ISO 22301 to FCA operational resilience
ISO 22301 can support business continuity discipline. It does not replace the FCA’s important-business-service, impact-tolerance, mapping, testing and self-assessment requirements where SYSC 15A applies. The most efficient approach is usually to reuse factual dependencies, recovery plans and exercise results while preserving the distinct regulatory decisions and metrics.
The case for continuing management
BCMS arrangements become stale when business units change, tests are deferred or management review becomes ceremonial. A retained continuity programme can preserve the review cycle, evidence log and ongoing exercises after a focused implementation. Pricing should separate the establishment project from maintenance; certification fees are separately assessed by the certification body.
Frequently asked questions
Is ISO 22301:2019 still the published standard in October 2026?
Yes. ISO lists the 2019 edition as published while the proposed new edition is still under development.
Can a consultant certify my company?
Certification is granted through an appropriate independent certification process, not merely by a consultant writing plans.
Does an ISO 22301 certificate prove FCA resilience compliance?
No. Different obligations and evidence requirements apply under FCA SYSC 15A.