ISO 22301 Clause 9.2: Internal Audit

Quick Reference (60 Seconds)

The single sentence to remember: an internal audit is the organisation's independent, evidence-based answer to the question "is our BCMS actually working, or do we just believe it is?" A BCMS that is never independently audited is a system whose performance is asserted, not verified. Clause 9.2 is the discipline that turns assertion into verified assurance, and verified assurance is what a certification body, a regulator, a board, a customer, and (when a real disruption hits) a recovery team can actually rely on.

What the Standard Actually Requires

Figure · Process

What Clause 9.2 asks you to do

ISO 22301 Clause 9.2 asks organizations to audit the BCMS at planned intervals to check it conforms to requirements and is effectively implemented. Read alongside ISO 22313:2020 (the companion guidance), ISO 22300:2021 (vocabulary) and the wider management-system genealogy (ISO 27001 Clause 9.2, ISO 9001 Clause 9.2, ISO 19011, the canonical auditing guidance), the requirement breaks into seven interlocking obligations.

What the clause requires in substance

1. Establish an internal audit programme. The organisation must put in place a programme, not just a series of audits, but a deliberate, documented plan that says what will be audited, when, by whom, against what criteria, and with what method. The programme must cover the entire BCMS scope (Clause 4.3) over a defined cycle; it must consider the results of previous audits (so findings drive the next plan); it must reflect the strategic and operational risk landscape (Clause 6.1); and it must be resourced. The programme is a living artefact, reviewed at least annually and re-based whenever the BCMS scope changes (new product, new site, new regulator, new outsourced activity). A common anti-pattern is the "annual circular audit", the same audit plan every year, irrespective of what changed or what previous audits found. The clause requires a risk-based programme that is sensitive to the organisation's actual continuity risk profile.

2. Define the audit programme's contents. A defensible audit programme contains, per audit engagement: the audit criteria (ISO 22301:2019 + the organisation's own documented BCMS requirements + applicable regulatory duties); the audit scope (which BCMS processes, sites, prioritised activities, suppliers); the audit methods (interview, observation, document review, sampling, walkthrough, re-performance); the audit schedule (when each engagement runs); the resourcing (auditor names, effort days, budget); the reporting destination (which managers receive which report); and the follow-up mechanism (how findings are tracked to closure). Where the audit programme is mature, it also contains a risk rating per auditable area that drives frequency (high-risk areas audited annually; medium every two years; low every three).

3. Pick auditors who are independent. The clause is unambiguous: auditors must not audit their own work. Independence means the auditor has no operational responsibility for the BCMS activity being audited, no line-management tie to its owner, and no incentive to find (or not find) any particular result. Independence is structural, not attitudinal, a well-meaning BCM who "promises to be objective" about their own measurement programme has still violated the clause. In a growing company where the BCMS team is small, the purest independence is achieved by (a) using the internal audit function (which reports to the Audit Committee, not to operations), (b) using external auditors from an internal-audit services provider or compliance and audit firm, or (c) using competent staff from a different function (e.g., the ISMS auditor audits the BCMS and vice versa) with documented conflict-of-interest review. Independence is not just about the BCM, it applies to the IT/DR lead, the CISO, the procurement lead for supplier-BC, the human-resources lead for awareness training, and any manager whose work the BCMS touches.

4. Pick auditors who are competent. Independence without competence produces no findings; competence without independence produces findings no one trusts. The clause requires both. Competence is built from four sources: (i) knowledge of ISO 22301:2019 and the ISO 223xx family; (ii) knowledge of the organisation's BCMS scope, prioritised activities, and applicable regulations (RBI/SEBI/IRDAI/CERT-In/DPDP as relevant); (iii) auditing skills, the discipline of ISO 19011-aligned audit conduct (planning, sampling, interviewing, evidence gathering, finding formulation); and (iv) continuing professional development. The organisation must demonstrate competence, not just assert it, through a documented auditor competency matrix (qualifications, certifications, audit experience, CPD log), and through audit-quality review (a sample of audit working papers reviewed by an experienced auditor each cycle).

5. Conduct each audit on the ground. The clause expects audits to be performed, not desk-researched. Each engagement follows a standard arc: a plan (criteria, scope, methods, schedule, opening-meeting agenda), an opening meeting (with auditees), evidence collection (interviews, observation of activities such as an exercise or a BIA workshop, document review, sampling of evidence such as BIA outputs, plan versions, drill reports, corrective-action records), evidence evaluation (against criteria, does the evidence support conformity, nonconformity, or an opportunity for improvement?), a closing meeting (preliminary findings communicated), and a report. The audit is risk-based and sampled, it does not re-examine every BIA, every plan, every drill; it picks a defensible sample weighted toward higher-risk areas, and tests the system of management, not every transaction.

6. Report results to the managers responsible. The audit report is the contractual output of the engagement. It contains: the audit criteria, scope, and methods; the auditors and the auditees; the findings (conformities, nonconformities, major and minor, and opportunities for improvement); the auditors' overall judgement on whether the BCMS conforms and is effectively implemented (the two-prong test, see §5); and any required follow-up. The report goes to the managers responsible for the audited area, not to the audit function alone. The clause requires that the report is acted on, which means there must be a handover into the corrective-action process (Clause 10.1) and a verification loop where the audit function confirms that the corrective action was effective.

7. Retain documented information. Both the audit programme and the audit results must be retained as documented information under Clause 7.5. Retention serves three purposes: it is the evidence a certification body and a regulator will request; it is the substrate for trend analysis across audit cycles (which findings recur? which areas never produce findings, and is that because they are good, or because they are not being audited deeply enough?); and it is the institutional memory that survives personnel turnover in both the BCMS team and the audit function. Retention should align with the longest applicable regulatory look-back (RBI supervisory cycles are typically five years; SEBI inspection windows are similar; the Companies Act and SEBI LODR effectively require listed entities to retain audit records for the foreseeable regulatory horizon).

What the clause does NOT require

This demarcation matters because over-building an internal-audit programme burns money and turns the audit into a bureaucracy:

• It does not require a separate internal audit function dedicated to the BCMS. A small organisation may run a defensible 9.2 programme with one qualified internal auditor (or an external services provider) covering the BCMS as one part of their portfolio. The constraint is independence and competence, not headcount.
• It does not require an annual full-scope BCMS audit. The programme must cover the whole scope over a cycle, typically three years. High-risk areas may be audited annually; low-risk areas less frequently. The cycle should be defensible against the audit's risk assessment, not asserted.
• It does not require re-performance of every BCMS measurement (Clause 9.1). Internal audit's role over 9.1 is to test the system of measurement, are the metric definitions valid? are thresholds set in advance? do breaches trigger actions?, not to recompute every dashboard number. Re-performance is sampling-based and risk-focused.
• It does not require the audit to be conducted by certified auditors (e.g., lead-auditor-certified under ISO 22301). Certification is one (strong) way to demonstrate competence, but the clause's requirement is competence, demonstrable through qualifications, experience, and CPD taken together. Lead-auditor certification alone, without sector and regulatory knowledge, is insufficient.
• It does not require every finding to be a nonconformity. A defensible audit will report conformities (the things that work, important for the certification body's and regulator's confidence), opportunities for improvement (things that work but could be better), and nonconformities (things that fail). A finding set with no nonconformities across multiple cycles is itself a red flag, either the BCMS is perfect (unlikely) or the audit is shallow.
• It does not require the audit to produce a pass/fail verdict. Internal audit reports findings and an overall judgement; the corrective-action loop closes them. Pass/fail is the certification body's role (Stage 1/Stage 2/surveillance/recertification), not internal audit's.

The 9.1 vs 9.2 vs 9.3 demarcation (the most-tested distinction)

Among the three performance-evaluation clauses, the boundary between 9.1, 9.2 and 9.3 is the single most frequently examined point in certification audits. The three lines of assurance must be visibly distinct in the organisation's documentation and conduct.

• 9.1 (Monitoring, measurement, analysis and evaluation) is first-line management measuring its own system, continuously. Owners: BCM, activity owners, IT/DR lead, SOC. Cadence: real-time (telemetry) through annual (programme review). Output: dashboards, trend packs, threshold-breach tickets, evaluation memos. Independence: none required (it is management measuring its own work). Question answered: "Is the BCMS performing, and where is it drifting?"
• 9.2 (Internal audit, this clause) is second-line independent assurance over the BCMS at planned intervals. Owner: internal audit function or external services provider, structurally independent of the BCMS first line. Cadence: planned intervals, risk-based, typically a three-year cycle with high-risk areas annual. Output: audit programme, audit reports, findings (conformities, nonconformities, OFIs), corrective-action verification. Independence: required. Question answered: "Does the BCMS conform to ISO 22301:2019 and to our own documented requirements, and is it effectively implemented?"
• 9.3 (Management review) is the third-line strategic review by top management at planned intervals. Owner: top management (CEO/COO/CISO), chaired by the BCMS sponsor. Cadence: planned intervals, typically annual with semi-annual in larger firms. Output: decisions on continuing suitability, adequacy, effectiveness; resourcing; strategic changes. Independence: top-management perspective over both 9.1 and 9.2. Question answered: "Is the BCMS still the right system for this organisation, at this scale, in this risk environment, and what should change?"

The flow is: 9.1 produces the evidence → 9.2 independently tests the system and the evidence → 9.3 consumes 9.1 and 9.2 outputs to make strategic decisions → 10.1/10.2 act on what 9.1/9.2/9.3 find. A common failure is to collapse the three into one "annual BCM review", which produces neither trustworthy first-line measurement (9.1), nor independent assurance (9.2), nor strategic challenge (9.3). They are distinct disciplines with distinct owners, cadences, and outputs.

The two-prong test, "conforms" and "effectively implemented"

ISO 22301 Clause 9.2's two-prong test is the conceptual core of the clause and is examined closely by certification auditors:

• Conformity, does the BCMS, as designed and documented, meet the requirements of ISO 22301:2019 and the organisation's own documented requirements? This is a paperwork-and-design test. It asks: is there a documented scope? a BIA that meets the requirements of Clause 8.2? a strategy under 8.3? plans under 8.4? an exercise programme under 8.5? documented information under 7.5? It is possible to conform on paper and still fail in practice.
• Effective implementation, does the BCMS, as actually practised, achieve the outcomes the standard intends? This is an evidence-and-behaviour test. It asks: is the BIA actually used to drive strategy? are the plans actually exercised, with real people and real failover? do the corrective actions actually close, with evidence of effectiveness? do the people named in the plans know their roles? A BCMS can be fully documented (conforms) and never used (not effectively implemented).

A defensible 9.2 programme tests both prongs. The most common, and most serious, audit finding is a system that conforms on paper but is not effectively implemented: the BIA exists but was last reviewed four years ago; the plans exist but were never exercised; the awareness training exists on the intranet but no employee can describe their continuity role; the corrective-action log shows actions "closed" with no evidence of effectiveness. A close second is the inverse, a system that is effective in pockets (a well-exercised IT DR plan) but does not conform (no BIA behind it; no upstream activity analysis; no strategy-selection traceability). The audit programme must surface both.

What auditors actually check

A certification body (BSI, DNV, SGS, TÜV, Bureau Veritas, Intertek, NQA, the bodies typically active in the Indian market) auditing your ISO 22301 system will examine Clause 9.2 with particular care, because 9.2 is the organisation's self-policing mechanism, a weak 9.2 is a leading indicator that other clauses are weak too. Expect the following:

• The audit programme, a documented multi-year plan that covers the whole BCMS scope, is risk-based, considers previous audit results, and is resourced. The auditor will sample audit engagements from the programme and trace them to completed audit reports.
• The auditor independence evidence, the auditor will ask for the auditor assignments for the last three engagements and confirm that none of the assigned auditors had operational responsibility for the areas they audited. In a small organisation, this is where many findings arise.
• The auditor competency matrix, qualifications, certifications, audit experience, CPD. The auditor will look for evidence that the auditors knew what they were doing.
• A sample of audit reports, looking for findings that are specific, evidenced, criteria-traced, and severity-rated; not vague ("some improvement needed") or untraceable.
• The corrective-action loop, every nonconformity from internal audit should have a corrective action under Clause 10.1, with root-cause analysis and effectiveness check. The auditor will trace the loop.
• The escalation to management review, internal audit findings should appear in the inputs to Clause 9.3 management review. The auditor will check that the management-review pack references the audit results.
• The two-prong coverage, the auditor will look for evidence that the audit programme tests both conformity (paperwork) and effective implementation (practice). An audit programme that only checks documentation and never observes an exercise, interviews an employee, or samples a real corrective action is a programme that fails the second prong.
• The timeliness, was the audit programme actually executed on the planned dates, or are there gaps? A two-year gap between planned audits is a finding.

Why This Control Matters

The business case for independent audit

A BCMS is a complex socio-technical system, people, processes, technology, suppliers, facilities, plans, exercises, all of which must work together under stress. The first line (BCM, IT/DR, activity owners) measures its performance continuously under Clause 9.1, but the first line has built the system it is measuring and is invested in the answer. The discipline that catches what the first line cannot see, the unintended gap between design and practice, the corrective action closed without effectiveness check, the plan that exists but is not used, the auditor-grade error in a BIA calculation, the supplier-BC certificate that has expired, the exercise that was logged but not actually conducted, is independent audit. Without it, the organisation is asking the architect to grade their own building.

The business case is sharper than "good governance". Three concrete returns make a defensible 9.2 programme worth the cost:

1. Findings are cheaper than incidents. A well-designed internal audit surfaces the gap between the plan and reality before a real disruption pays the price. The Cognizant Maze ransomware (April 2020; Cognizant's SEC filings put the expected Q2 2020 revenue impact at US$50–70 million) shows the scale a single ransomware event can reach. An internal audit programme that tests supplier-BC, segmentation and recovery capability costs a small fraction of that.
2. Independent assurance is a regulatory and customer currency. Indian regulators (RBI, SEBI, IRDAI) increasingly require independent assurance over ICT, BC, and cyber-resilience controls, System Audit Reports under SEBI CSCRF, IS audit under RBI Master Direction IT Governance, independent audit under IRDAI Guidelines 2023, DPIA and Data Audit for Significant Data Fiduciaries under DPDP. Customers (especially in regulated sectors) require independent assurance as part of vendor risk management. A 9.2 programme that satisfies ISO 22301 simultaneously produces the evidence these regulators and customers require.
3. Independent audit forces closure. A first-line measurement that the BCM closed a corrective action is one thing; an independent verification that the closure was effective, that the corrective action actually changed practice and that the root cause will not recur, is qualitatively different. Repeat-finding rates fall when the audit function verifies closure, not when the BCM self-certifies it. The single most-cited maturity indicator for a BCMS is the repeat-finding rate; it falls only when the audit function is real.

The Indian regulatory context, independence as a statutory duty

In India, internal audit independence is not optional, it is statutory. Section 177 of the Companies Act, 2013 mandates the Audit Committee for listed companies and certain classes of unlisted companies, and §177(4)(vii) explicitly places evaluation of internal financial controls and risk management systems within the Audit Committee's mandate. The Audit Committee reviews the internal audit function, including its programme and findings. SEBI LODR Regulation 21 requires listed entities to constitute a Risk Management Committee covering cyber, operational, and continuity risks. The board-level architecture explicitly separates first line (operations, including the BCM), second line (risk management, compliance) and third line (internal audit), and the board's oversight role is to ensure that the third line is genuinely independent of the first.

For regulated entities, the independence bar is higher still:

• RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 Nov 2023, effective 1 Apr 2024) requires independent assurance over IT controls, including IT service continuity / BCM, with internal audit reporting to the Audit Committee and (in larger banks) a dedicated IS audit function. The Master Direction also requires the board and senior management to receive independent assurance on the effectiveness of IT controls.
• RBI Cyber Security Framework in Banks (2 Jun 2016) expects independent assessment of cyber-resilience controls, including the SOC, incident management, and recovery capability. The framework's "baseline cyber security and resilience requirements" are the audit criteria.
• SEBI CSCRF (20 Aug 2024) requires SEBI Regulated Entities to submit a System Audit Report (SAR) and a CERT-In empanelled auditor's report, with grading of the RE by category. The CSCRF's six cybersecurity functions (Governance, Identify, Protect, Detect, Respond, Recover) are the audit criteria; an ISO 22301 9.2 programme covering the Recover function is direct evidence.
• SEBI BCP/DR for MIIs (22 Mar 2021) requires independent assessment of MII BCP/DR, including DR drill and live-trading-from-DR performance, RTO/RPO achievement, and Near Site + DRS architecture.
• IRDAI Information and Cyber Security Guidelines 2023 (24 Apr 2023) require insurers to conduct independent audit of ICT and BCP/DR, with annual compliance reporting to IRDAI within 90 days of FY end. The Board's Risk/IT Committee has explicit oversight.
• DPDP Act 2023 and DPDP Rules 2025, Significant Data Fiduciaries face a statutory Data Audit by a Data Auditor (independent of the SDF), with DPIA cadences and breach-notification clocks that the audit function tests for compliance.
• CERT-In Directions (28 Apr 2022), the 6-hour report clock, 180-day log retention, NTP clock-sync, and 5-year customer-KYC retention are explicit audit criteria; the audit function tests for compliance.
• Disaster Management Act 2005 and NDMA DMP template, independent post-disaster review is part of the national disaster-management discipline; for Major Accident Hazard units (NDMA Chemical Disaster Guidelines 2007), independent safety audit is statutory.

The Indian regulatory landscape, in short, treats internal audit as the third line whose independence is structurally protected and whose findings flow to the Audit Committee and to the regulator. Clause 9.2 of ISO 22301 is the management-system expression of that statutory architecture.

The cost of a weak or absent 9.2 programme

A weak or absent internal audit programme has predictable costs. The illustrative failure modes, drawn from documented Indian and global incidents, are these:

• Weak oversight surfaces as acute failure. SpiceJet's 2022 crisis, where DGCA enhanced surveillance culminated in a 50%-of-schedule cap on 27 Jul 2022 after the regulator cited poor internal safety oversight and inadequate maintenance actions, is a public example of a regulator finding what internal assurance should find first. The DGCA's show-cause notice referred to the airline's failure to "establish safe, efficient and reliable air services", the language of effective implementation. An honest internal audit of asset integrity and spares availability should have surfaced the chronic under-resourcing years before the regulator had to intervene.
• Recurrence as an audit signal. HDFC Bank's repeated digital outages (Nov 2018, Dec 2019, Nov 2020) and the resulting RBI action of 2 Dec 2020 (bar on new digital products and fresh credit cards, partially lifted Aug 2021, fully lifted March 2022, roughly 15 months) is a public example of recurrence ending in supervisory action; the RBI asked the bank's board to examine the lapses and fix accountability. Whatever the internal causes, repeat incidents are the signal that corrective action has not reached the root cause. An independent audit with statutory access to the board, willing to name the governance root cause, is the mechanism the clause requires.
• A real disruption exposes the gap between paper and practice. The AIIMS Delhi ransomware of 23 Nov 2022 (e-Hospital down about two weeks, primary and secondary database servers encrypted together, OPD/labs/billing reverted to paper, a Delhi Police cyber-terrorism case) is a public example of why audit must test effectiveness, not just documentation: an audit programme should check that a backup copy sits outside the primary's failure domain and that clinical failover has been exercised, and the Audit Committee should escalate gaps it finds.
• Regulatory penalties and supervisor-driven corrective action. The DPDP Act's penalty schedule (up to ₹250 crore for failure to take adequate security safeguards; up to ₹200 crore for failure to notify a breach) and the RBI's powers to impose monetary penalties and business restrictions make independent audit cheap at the price. The cost of an internal audit programme is a fraction of the cost of one material regulatory penalty.
• Customer assurance. Indian IT/ITeS firms serving EU financial entities inherit DORA obligations (Art 11 BIA, Art 12 RTO/RPO, Art 17–23 incident reporting, Art 26 TLPT every 3 years); the customer's vendor-risk management asks for evidence of independent assurance. A 9.2 programme produces that evidence.

The bottom line: a weak 9.2 programme is a leading indicator of a weak BCMS, and a weak BCMS is a leading indicator of a costly disruption or regulator action. The cost of a defensible internal audit programme is recoverable many times over by the disruptions and regulator actions it prevents.

Scope and Applicability

What 9.2 covers

Clause 9.2 covers the entire BCMS as scoped under Clause 4.3. The audit programme must, over its cycle, examine every BCMS process (4.1 through 10.2), every prioritised activity (per the BIA, Clause 8.2), every continuity strategy and plan (Clauses 8.3, 8.4), the exercise programme (Clause 8.5), the post-disruption review process (Clause 8.6), the measurement system (Clause 9.1), the management review process (Clause 9.3), yes, the audit function audits the management-review process for conformity and effectiveness, without crossing into performing the management review itself, and the corrective-action and continual-improvement processes (10.1, 10.2).

The audit also covers interfaces: the boundary between the BCMS and the ISMS (ISO 27001), between the BCMS and enterprise risk management, between the BCMS and supplier management, between the BCMS and crisis management. Interfaces are where the most consequential gaps live, the supplier whose BCP/DR certificate is on file but whose actual capability has never been tested; the IT DR plan that recovers the systems but not the upstream activity that depends on them; the awareness training that covers ISMS responsibilities but not continuity roles.

What 9.2 does not cover

• Strategic decisions about the BCMS. Whether to certify, whether to expand scope, whether to invest in a major capability upgrade, these are Clause 9.3 (management review) and Clause 5.1 (leadership) matters. Internal audit informs them but does not make them.
• First-line measurement. Recomputing every dashboard number is not the audit's job; testing the system of measurement is. Internal audit's role over 9.1 is to confirm that metric definitions are valid, thresholds are set in advance, breaches trigger actions, and the closure rate is acceptable. Re-performance is sampling-based.
• Operational response. When a disruption hits, the BCM and the response structure lead. Internal audit's role in a real incident is post-incident review (Clause 8.6), not real-time response, though an experienced auditor may observe the response for learning.
• Third-party certification. The certification body (BSI, DNV, SGS, TÜV, Bureau Veritas, Intertek, NQA) performs third-party audit for ISO 22301 certification. That is a different role from first-party internal audit; the two are complementary but distinct.

Applicability by organisation size

Applicability by industry

Multi-site and multi-legal-entity scope

For organisations with multiple sites or multiple legal entities within the BCMS scope, the audit programme must cover all sites/entities over the cycle. The audit programme may use a risk-based site selection (highest-impact sites audited annually; lower-impact sites on a longer rotation) but the rationale must be documented and defensible. Outsourced activities (Clause 8.1) are within scope; the audit may test the organisation's oversight of the outsourced activity (clause review, right of audit, supplier-BC test participation) and, where contractually permitted, the supplier's BC capability directly.

Key Definitions and Terminology

Clause 9.2 uses a specific vocabulary drawn from ISO 22300:2021 (vocabulary), ISO 19011 (auditing guidance), and the ISO management-system tradition. The terms below are the load-bearing ones; an organisation that confuses them will produce muddled audit reports.

• Internal audit (first-party audit). An audit conducted by, or on behalf of, the organisation itself, on the BCMS within the organisation's scope. Distinguished from second-party audit (a customer auditing a supplier) and third-party audit (a certification body auditing for certification).
• Audit programme. The set of one or more audit engagements planned for a period (typically three years), including all activities necessary to plan, organise, conduct, and follow up each engagement. The audit programme is itself a controlled document under Clause 7.5.
• Audit plan. A per-engagement document describing the activities and arrangements for a specific audit: criteria, scope, objectives, methods, schedule, team, auditees, opening and closing meetings.
• Audit charter. A document approved by top management (and, where applicable, the Audit Committee) that establishes the internal audit function's purpose, authority, accountability, scope, and independence. Not strictly required by ISO 22301 but the canonical mechanism for demonstrating the structural independence that 9.2 requires.
• Audit criteria. The set of policies, procedures, regulations, management-system requirements, and documented information against which audit evidence is compared: ISO 22301:2019 (the standard); the organisation's BCMS documented information (scope statement, BIA, strategies, plans, policies, procedures); and applicable regulatory requirements (RBI/SEBI/IRDAI/CERT-In/DPDP/NDMA/Companies Act as relevant).
• Audit scope. The extent and boundaries of an audit: which BCMS processes, which sites, which prioritised activities, which suppliers, which time period.
• Audit evidence. Records, statements of fact, or other information, relevant to the audit criteria and verifiable. Evidence may be documentary (the BIA, the plan, the policy), observational (watching an exercise, watching a BIA workshop), or testimonial (interview with an activity owner). Triangulation across types is the hallmark of strong evidence.
• Audit finding. The result of evaluating audit evidence against audit criteria. Findings may be conformities (evidence that the requirement is met), nonconformities (evidence that it is not), or opportunities for improvement (evidence that the requirement is met but could be exceeded).
• Nonconformity (major). A nonconformity that affects the BCMS's ability to achieve its intended outcomes, typically the absence of a required process, the breakdown of a process across the scope, or a finding that has recurred across multiple cycles without correction. A major nonconformity in certification leads to a major corrective-action request; in internal audit, it should trigger immediate corrective action under Clause 10.1 and escalation to top management.
• Nonconformity (minor). A single lapse or isolated gap that does not (yet) undermine the BCMS's intended outcomes, for example, an outdated contact list in one BC plan, a single missed BIA review, one corrective action closed without effectiveness check. Multiple related minors in the same area may aggregate to a major.
• Observation / Opportunity for improvement (OFI). A finding that is not a nonconformity but where the auditor sees potential for improvement. OFIs are not mandatory to act on but should be considered in continual improvement (Clause 10.2).
• Effectiveness (of the BCMS). The extent to which planned activities are realised and planned results are achieved. Effective implementation, the second prong of the 9.2 test, is the demonstration that the BCMS's planned activities (BIA, strategy, plans, exercises) actually produce the planned results (continuity of prioritised activities within tolerance during disruptions).
• Conformity. The fulfilment of a requirement. The first prong of the 9.2 test, does the BCMS, as designed and documented, meet ISO 22301:2019 and the organisation's own documented requirements?
• Independence (of the auditor). The structural condition in which the auditor has no operational responsibility for, line-management tie to, or incentive regarding the area audited. Independence is structural, not attitudinal; a well-meaning BCM who "promises to be objective" about their own work has still violated the clause.
• Competence (of the auditor). The demonstrated capacity to put knowledge and skill to work and deliver what the audit is meant to deliver, built from knowledge of ISO 22301:2019, knowledge of the BCMS scope and applicable regulations, auditing skills (ISO 19011), and continuing professional development. Competence must be evidenced, not asserted.
• Conflict of interest. A situation where the auditor's objectivity may be compromised, financial interest, personal relationship, prior operational responsibility, or any other tie to the area audited. Conflicts must be declared in writing before each engagement and either mitigated (different auditor assigned) or, where they cannot be mitigated, the engagement must be declined.
• Risk-based audit programme. An audit programme in which the frequency, depth, and resourcing of each engagement are driven by a documented risk assessment of the auditable area, not by a fixed annual circular. The risk assessment considers inherent risk (the disruption exposure of the area), control maturity, prior audit findings, regulatory exposure, and changes since the last audit.
• Two-prong test. The dual criterion of 9.2: the audit must test both conformity (paperwork and design) and effective implementation (evidence and behaviour). See §2.4.
• Three lines of assurance. The governance architecture that places operations (including the BCM) as the first line, risk management and compliance as the second line, and internal audit as the third line. Clause 9.2 is the third line. Companies Act §177 and SEBI LODR Reg. 21 codify this architecture for listed entities.

Relationship to Other Clauses

Clause 9.2 does not operate in isolation. Its inputs come from across the BCMS; its outputs flow back into the BCMS. The relationships below are the load-bearing ones.

The audit's inputs, what 9.2 needs from the rest of the BCMS

• From 4.1 / 4.2 / 4.3 (context, interested parties, scope). The audit's scope is the BCMS scope defined under 4.3; the audit's perspective on the interested parties and their requirements comes from 4.2. If the scope is muddled, the audit programme will be muddled.
• From 5.1 / 5.3 (leadership, roles and authorities). The audit tests whether leadership has actually integrated the BCMS into business processes and whether the roles and authorities assigned under 5.3 are functioning. A finding of "leadership commitment exists on paper but is not visible in resourcing decisions" is a 9.2 finding that traces to 5.1.
• From 6.1 (risks and opportunities). The audit programme is risk-based; the risk register under 6.1 is a primary input. Findings on risks that were identified in 6.1 but never treated feed back into 10.1.
• From 6.2 (BC objectives). The audit's evaluation of effective implementation tests whether the objectives are being achieved; the measurement of objectives under 9.1 is the auditee, and the audit tests the system of that measurement.
• From 7.5 (documented information). The audit's evidence base is the documented information; the audit tests whether the controlled documents exist, are current, are version-controlled, and are actually used.
• From 8.1–8.6 (operational core). The audit's deepest examination is here, BIA (8.2), strategies (8.3), plans (8.4), exercises (8.5), post-disruption review (8.6). Most audit days are spent here.
• From 9.1 (monitoring and measurement). The audit tests the measurement system's validity, not the numbers themselves.
• From previous 9.2 cycles. The audit programme is risk-based and considers previous audit results; the corrective-action log is the substrate for repeat-finding analysis.

The audit's outputs, where 9.2 findings go

• To 9.3 (management review). Internal audit findings are a primary input to management review. The 9.3 pack should include the audit reports, the open nonconformities, the closure rate, the repeat-finding rate, and the audit programme's forward look.
• To 10.1 (corrective action). Every nonconformity from internal audit flows into the corrective-action process: react to the nonconformity, deal with its consequences, correct the root cause so it does not recur, and review the effectiveness of the corrective action. Internal audit's role is to verify the closure, not to perform it.
• To 10.2 (continual improvement). Opportunities for improvement and the cross-cycle trend analysis drive the continual-improvement agenda. The maturity advancement in the BCMS is often traceable to an audit finding that named the constraint.
• To the Audit Committee (Companies Act §177) and Board Risk/IT Committee (SEBI LODR Reg. 21). For listed and regulated entities, audit findings on BCMS performance flow to the board. This is the statutory escalation path.
• To regulators. Internal audit findings inform the regulator-facing assurance, the System Audit Report under SEBI CSCRF, the IS audit submission under RBI Master Direction, the annual compliance report under IRDAI, the Data Audit for SDFs under DPDP. Internal audit's independence and findings are the substrate of the regulator's confidence.

Distinct from 9.1 and 9.3

The 9.1 / 9.2 / 9.3 demarcation (see §2.3) is the most-tested distinction in certification audits. The three lines must be visibly distinct in the organisation's documentation and conduct:

• 9.1 is first-line, continuous, operational, no independence required. The BCM and activity owners measure their own performance.
• 9.2 is second-line, planned intervals, independent, assurance-focused. Internal audit tests the system.
• 9.3 is third-line, planned intervals, top-management, strategic. Top management decides on the system.

Adjacent and overlapping disciplines

• ISO 27001 Clause 9.2 (Internal audit). Identical structure (Harmonised Structure). An organisation running an integrated ISMS+BCMS can run one internal audit programme covering both; the criteria differ (ISO 27001:2022 for ISMS, ISO 22301:2019 for BCMS) but the engagement, the independence, the competency framework, and the reporting can be unified.
• Quality management (ISO 9001 Clause 9.2). Same structure; integrated QMS+BCMS audit programmes are common in manufacturing.
• Operational risk management (APRA CPS 230, Basel Committee principles). Internal audit's review of operational-resilience controls (CPS 230 para 45 explicitly) overlaps with ISO 22301 9.2.
• DORA Arts 24–27 (digital operational resilience testing). The DORA testing programme is broader than internal audit (it includes vulnerability assessments, pen-testing, TLPT) but the independent testing aspect overlaps with 9.2. Threat-Led Penetration Testing (Art 26) is third-party specialist, not internal audit, but internal audit should oversee the programme.
• SOC 2 (AICPA Trust Services Criteria). The SOC 2 audit (performed by a CPA firm) is a second-party/third-party engagement, not internal audit; the criteria include the monitoring and risk-assessment points of focus (CC1, CC4) that overlap with 9.2. An organisation's 9.2 programme produces evidence the SOC 2 auditor will consume.

Detailed Implementation Guidance

This section is the operational core. It is structured as a tiered, step-by-step build of an internal-audit programme that satisfies ISO 22301 Clause 9.2 and that scales from a 50-person growing company to a 2,000-person growing firm.

Step 1, Establish the audit charter and the audit function

The first move is to put in place a written audit charter approved by top management and (where applicable) the Audit Committee. The charter is the structural-independence evidence. A defensible charter contains: (i) the purpose of the internal audit function (independent assurance over the BCMS); (ii) authority, the right of access to any BCMS document, person, or site; the right to communicate directly with the Audit Committee; the right to escalate findings to top management; (iii) accountability, to whom the function reports (functionally to the Audit Committee, administratively to the CEO/COO/CFO); (iv) scope, the BCMS scope per Clause 4.3 plus any other management systems the function audits (ISMS, QMS); (v) independence, the explicit prohibition on auditors auditing their own work and the conflict-of-interest declaration mechanism; (vi) competence, the requirements for auditor qualification, certification, experience, and CPD; (vii) programme methodology, the risk-based audit programme methodology (see §7.3); (viii) reporting, the standard audit report structure and the reporting destinations; (ix) follow-up, the corrective-action verification mechanism and the closure-evidence requirements; and (x) quality assurance, the periodic review of the audit function itself (a sample of engagements reviewed by an experienced auditor; a periodic external quality assessment every 3–5 years).

The charter is approved by top management (CEO/COO/CISO) and, for listed and regulated entities, by the Audit Committee. It is reviewed at least every three years and updated whenever the BCMS scope or the regulatory set changes.

For small and growing companies without an internal audit function, the charter establishes the outsourced or co-sourced arrangement: the internal-audit services provider or compliance and audit firm engaged under a written engagement letter that replicates the charter's terms (purpose, authority, accountability, independence, competence, reporting, follow-up). The Audit Committee (or the board) approves the engagement.

Step 2, Build the auditor competency matrix

Clause 9.2 requires demonstrable competence. The instrument is the auditor competency matrix, a controlled document listing every internal and external auditor used by the programme, with the following per auditor: name; role (lead auditor, auditor, technical expert, observer-in-training); qualifications (academic, professional); certifications (ISO 22301 lead auditor, ISO 27001 lead auditor, ISO 19011 auditing, sector-specific e.g., CISA / CISM / CBCP / MBCI); sector experience (years in BFSI / capital markets / insurance / healthcare / IT-ITeS / manufacturing); regulatory experience (which Indian or global regulators' frameworks the auditor has audited against); audit experience (number of engagements, lead-auditor vs auditor role, ISO 22301 specifically); CPD log (last 12 months, courses, conferences, reading); conflict-of-interest declarations (per engagement); last performance review (a sample of the auditor's working papers reviewed by an experienced auditor).

The matrix is reviewed annually by the head of internal audit and, for the lead auditors, by the Audit Committee. Where gaps are identified, a development plan is committed (training, mentoring, shadowing an experienced auditor, sector secondment).

The auditor selection per engagement matches the engagement's needs to the matrix: a BIA audit may need a CBCP-qualified lead; a supplier-BC audit may need a procurement and contracts specialist as technical expert; a CERT-In 6-hour-clock audit may need a cyber-incident specialist; a DORA TLPT oversight may need an ICT risk specialist. The matching is documented in the engagement's audit plan.

Step 3, Build the risk-based audit programme

The audit programme is a multi-year plan (typically three years) covering the entire BCMS scope. It is risk-based, the frequency, depth, and resourcing of each engagement are driven by a documented risk assessment of each auditable area.

The programme is built in four sub-steps:

1. Define the auditable universe. List every BCMS process (4.1 through 10.2), every prioritised activity (per the BIA, Clause 8.2), every site in scope, every critical supplier (Clause 8.1), every applicable regulatory duty. Each item is an auditable area.
2. Risk-rate each area. For each auditable area, score: inherent risk (the disruption exposure if this area fails, financial, regulatory, safety, reputational); control maturity (how well-designed and well-operated the controls are, per your maturity model); prior audit findings (areas with open or recurrent findings score higher); regulatory exposure (areas with explicit regulatory audit requirements, SEBI SAR, RBI IS audit, IRDAI compliance report, DPDP Data Audit, score higher); change (areas changed since the last audit, new product, new site, new supplier, new regulation, score higher). The combined score drives a frequency tier: high (annual), medium (every 2 years), low (every 3 years).
3. Sequence the engagements. Build a three-year calendar of engagements, with annual engagements for the high-tier areas and rotating engagements for the medium- and low-tier areas. Allow for triggered engagements, audits added to the programme in response to a major change, a real disruption (post-incident review under Clause 8.6), or a regulator request.
4. Resource the programme. For each engagement, estimate the effort (auditor days), the team composition (lead auditor + auditors + technical experts), the budget (internal cost or external fee), and the reporting destination. Confirm the programme is resourced; an under-resourced programme is a finding waiting to happen.

The programme is reviewed at least annually. The review considers: prior-year findings (which areas need re-audit?); changes in the risk landscape (Clause 6.1); changes in the BCMS scope (Clause 4.3); changes in the regulatory set; the closure rate of corrective actions; the audit function's capacity. The review produces an updated programme approved by top management and (where applicable) the Audit Committee.

Step 4, Plan each engagement

Each engagement is planned in advance, with a written audit plan approved by the audit function and shared with the auditee before fieldwork begins. The plan contains:

• Audit objectives, what the engagement is for (typically: to determine the extent to which the audited area conforms to ISO 22301:2019 and the organisation's documented requirements, and the extent to which it is effectively implemented).
• Audit criteria, ISO 22301:2019 (specific clauses), the organisation's documented BCMS requirements (policy, BIA, plans, procedures), and applicable regulatory requirements (specific instruments, RBI Master Direction, SEBI CSCRF, IRDAI Guidelines, CERT-In Directions, DPDP, NDMA).
• Audit scope, the auditable area, the sites, the prioritised activities, the time period, the suppliers. Explicit out-of-scope statements are good practice.
• Audit methods, interview list (with roles, not necessarily names), observation targets (an upcoming exercise, a BIA workshop, a corrective-action review meeting), document review list (the BIA, the plans, the exercise reports, the corrective-action log), sampling plan (which evidence will be sampled, and on what basis, risk-weighted, random, targeted).
• Schedule, opening meeting, fieldwork days, closing meeting, report draft, report final.
• Audit team, lead auditor, auditors, technical experts, with the competency matrix reference and conflict-of-interest declarations.
• Auditees, the activity owners and managers responsible for the audited area.
• Reporting, the report's structure (findings, criteria traceability, severity rating, overall judgement), the reporting destination, the follow-up mechanism.

The plan is communicated to the auditee in advance, audit is not a surprise inspection. Auditees are expected to make evidence and people available.

Step 5, Conduct the engagement

Fieldwork follows ISO 19011-aligned audit conduct. The arc is:

1. Opening meeting, confirm the plan, the scope, the methods, the schedule, the auditees, the reporting. Set the tone: the audit is independent, evidence-based, and improvement-oriented. Note any changes to the plan.
2. Evidence collection, interviews (with activity owners, with employees at the floor level, with critical suppliers where permitted, with the BCM, with the CISO, with internal audit of previous cycles where relevant); observation (attend an exercise; observe a BIA workshop; observe a corrective-action review meeting; walk the DR site); document review (the BIA, the strategies, the plans, the exercise reports, the corrective-action log, the management-review minutes); sampling (risk-weighted, with the sample basis documented); re-performance (a small, targeted re-performance, e.g., recompute one BIA impact score from source data; retest one restore; re-walk one plan).
3. Evidence evaluation, for each piece of evidence, evaluate against the criteria: does it support conformity, nonconformity, or an opportunity for improvement? Triangulate across evidence types, a documentary plan that exists but is not exercised (observation) and not known by employees (interview) is not effectively implemented.
4. Finding formulation, each finding is specific (which area, which requirement, what was observed), criteria-traced (which ISO 22301 sub-clause, which documented requirement, which regulation), evidenced (working-paper reference), and severity-rated (major nonconformity, minor nonconformity, OFI). The auditor's opinion is not a finding; observable evidence is.
5. Closing meeting, communicate the preliminary findings to the auditee. Confirm factual accuracy (the auditee may correct facts; the auditor's judgement stands). Agree the timeline for the draft report.

The two-prong test is applied throughout. The auditor explicitly evaluates: does the evidence support conformity (paperwork and design)? does the evidence support effective implementation (evidence and behaviour)? The closing meeting and the report make the two-prong evaluation explicit.

Step 6, Report results

The audit report is the contractual output of the engagement. A defensible report contains:

• Engagement identifiers, audit ID, audit plan reference, dates, auditors, auditees.
• Audit criteria, scope, objectives, methods, restated from the plan.
• Findings, each finding on its own: ID, criteria traceability (which ISO 22301 sub-clause, which documented requirement, which regulation), evidence (working-paper reference), evaluation (conformity / nonconformity major / nonconformity minor / OFI), severity rating, recommendation.
• Overall judgement, the lead auditor's evaluation of the audited area against the two-prong test: conforming and effectively implemented; conforming but not effectively implemented; not conforming (and therefore effective implementation not assessable).
• Cross-references, links to prior audit findings on the same area (repeat-finding analysis), links to corrective actions opened or closed since the last audit, links to related findings in other areas (systemic patterns).
• Sign-off, lead auditor's signature and date; audit function head's countersignature.

The report is delivered to the managers responsible for the audited area (not to the audit function alone) and, where the findings warrant, to the BCM steering group, the CISO/COO, top management, and (for material findings in regulated entities) the Audit Committee.

Step 7, Follow up and verify corrective action

Every nonconformity from internal audit flows into the corrective-action process (Clause 10.1). The audit function's role is to verify the closure, not to perform it. Verification has three elements:

• Correction, the immediate fix has been applied (the contact list has been updated; the missing plan has been drafted; the missed drill has been scheduled).
• Root-cause analysis, the underlying cause has been identified and addressed (not just the symptom). The 5-Why technique, fishbone analysis, or fault-tree analysis are typical tools. An audit that finds a missing plan is one finding; the root cause (no plan-review schedule, no owner accountability, no escalation for overdue review) is the cause to treat.
• Effectiveness check, after a defined period (typically 30–90 days), the audit function re-tests whether the corrective action has actually worked, has the contact list been kept current? has the plan been reviewed on schedule? has the drill run on time? An action "closed" without an effectiveness check is not closed; the audit function's verification is the discipline that distinguishes closure from paperwork.

The closure rate and the repeat-finding rate are the two headline KPIs of the internal-audit programme. A defensible closure rate target is ≥85% within the agreed window (typically 90 days). A defensible repeat-finding rate is <10% over a 12-month cycle.

Tiered implementation guidance by organisation size

Small (10–50 people). Outsource the internal audit to an internal-audit services provider or compliance and audit firm with sector experience. The BCM is the audit customer (provides evidence, facilitates interviews, receives the report). Run a single engagement per year covering a rotating subset of the scope, with high-risk areas (priority activities, regulatory clocks) covered annually and lower-risk areas on a three-year rotation. The audit charter is a short engagement letter; the auditor competency matrix is the provider's CV set.

Growing (50–250). Build a small internal audit capability, one qualified internal auditor with a relevant certification (ISO 22301 lead auditor, ISO 27001 lead auditor, CISA, CBCP, or MBCI), reporting to the Audit Committee and administratively to the CFO or CEO. Co-source specialist engagements (DR drill observation, supplier-BC verification, sector-specific regulatory testing) from an external provider. Run a documented three-year programme; budget 8–15 auditor-days per year for the BCMS workstream.

Larger growing (250–2,000). A discrete internal audit function with IS audit specialisation, reporting to the Chief Audit Executive (CAE) and through the Audit Committee to the board. Run a multi-year risk-based programme with annual engagements for high-tier areas, triggered audits after major change or incident, and integration with ISMS / QMS / RBI IS audit / SEBI SAR / IRDAI compliance audit.

Large enterprise (2,000+). A dedicated IS audit / BCMS audit team within the internal audit function, with sector-specialist auditors and specialist co-source for threat-led penetration testing (DORA Art 26) and deep technical reviews. Data-assisted audit techniques (continuous auditing of BCMS telemetry, anomaly detection in measurement data, predictive trend analysis). Integration with ERM, compliance, and the three-lines model.

The audit programme calendar, a worked illustration

The table below illustrates a defensible three-year audit programme for a larger growing (700-person) Indian SaaS firm in the IT/ITeS sector, with RBI-regulated banking clients and EU financial-sector clients (DORA-inherited). The programme is risk-based; high-tier areas are audited annually, medium every two years, low every three.

A typical Year 1 calendar: Q1, planning, opening engagements; Q2, BIA, strategies, plans audit; Q3, exercise observation (an annual simulation); Q4, supplier-BC, regulatory-clock audit, year-end reporting to the Audit Committee and into the management review (9.3). The calendar is reviewed each Q4 and adjusted for change and findings.

Tools, Technologies, and Solutions

Internal audit is a discipline, not a tool, but the right tools make the discipline cheaper, faster, and more defensible. The category-level landscape below is vendor-neutral; tool-comparison decisions are made on organisation-specific criteria.

The audit management category

An audit management platform (category: enterprise GRC suite or BCM-specialist SaaS with an audit-workstream module) is the canonical tool for a multi-year risk-based audit programme. Capabilities that matter: a risk-based audit universe with risk rating per auditable area; an audit programme calendar (multi-year); per-engagement working papers (criteria traceability, evidence, finding formulation, severity rating); a corrective-action workflow with effectiveness-check verification; closure-rate and repeat-finding-rate dashboards; integration with the BCMS measurement system (Clause 9.1) and the corrective-action log (Clause 10.1); Audit Committee and board reporting views.

For most growing companies, an audit management platform is over-buying at L1–L2 maturity. A defensible L2 programme runs on Excel on SharePoint with a structured working-paper template, an evidence repository, and a corrective-action log. The migration to a dedicated platform is typically justified at L3, when the volume of engagements (10+ per year), the complexity of the audit universe (multi-site, multi-regulator), and the integration requirement (with the BCMS dashboard and the ERM register) out-grow the spreadsheet model.

The evidence-collection category

Evidence collection has three sub-categories:

• Document and record review, the audit's primary evidence source. For a BCMS audit, this is the BIA, the strategies, the plans, the exercise reports, the corrective-action log, the management-review minutes, the regulatory submissions. Tools: the organisation's existing document-management system (SharePoint / Google Workspace / Confluence); the BCMS documented information repository (Clause 7.5). No new tool required; the audit's need is access and traceability, both of which are policy matters, not tooling matters.
• Sampling and re-performance, picking a defensible sample of evidence and (selectively) re-performing a calculation, re-walking a process, re-testing a restore. Tools: spreadsheet for sampling and re-computation (Excel); technical re-performance tools where applicable (a restore test on a non-production copy of the DR site; a tabletop replay of an incident against the plan; a recomputation of a BIA impact score from source data).
• Observation, attending an exercise, a BIA workshop, a corrective-action review meeting, a DR failover test. Tools: scheduling and access (the organisation's calendar system); observation checklists (the audit's own working papers); for virtual engagements, video-conferencing with recording (subject to consent and data-protection constraints).

The auditor-competence category

Auditor competence is supported by: certification bodies (BCI, DRI, ISO 22301 lead-auditor courses from accredited training providers); professional bodies (BCI for CBCI/AMBCI/MBCI/FBCI, DRI for ABCP/CBCP/MBCP/FBCP, ISACA for CISA/CISM/CRISC); continuing-education platforms (the organisation's existing learning-management system, conference attendance, sector-specialist reading lists). These are investments in the auditor, not tools, but they appear in the auditor competency matrix (§7.2).

The data-assisted audit techniques (DAAT) category

For L4–L5 programmes, data-assisted audit techniques bring analytics to the audit function: continuous auditing of BCMS telemetry (replication health, backup success, exercise pass rate) with anomaly detection that flags potential findings for the auditor's attention; trend analysis across audit cycles; text-mining of audit reports for systemic patterns; predictive models that estimate the likelihood of findings in an auditable area before fieldwork begins. These techniques require clean data, defined metrics (Clause 9.1), and a multi-year baseline, the discipline 9.2 builds is the prerequisite.

Tool comparison matrix (category-level, vendor-neutral)

The category-level comparison below is what a defensible tool-selection process produces. Organisation-specific criteria (size, sector, integration requirements, budget) drive the actual selection.

What not to buy

• A compliance-automation tool that promises to "automate ISO 22301 internal audit". Internal audit's value is independent judgement, not automation; tools that pre-populate findings from telemetry produce shallow audits. The risk is audit theatre.
• An enterprise IRM suite at L1–L2 maturity. The implementation cost exceeds the value; the discipline is not yet there to feed the tool.
• A single-vendor lock-in without an exit strategy. The audit programme must outlive any particular tool; the audit working papers, the audit programme, and the audit reports are controlled documents that must be exportable and portable.

Policy and Procedure Templates

The toolkit that accompanies this guide includes the ready-to-customise documents. The two most load-bearing for 9.2 are the Internal Audit Charter and the Internal Audit Procedure; their skeleton appears below to show what the clause requires them to contain. (The full versions are in toolkit 01 and 02.)

Internal Audit Charter, skeleton (toolkit 01)

1. Purpose
   - Establish the internal audit function for the [Organisation Name] BCMS.
2. Scope
   - The BCMS scope per Clause 4.3, plus [ISMS / QMS / regulatory audit scopes as applicable].
3. Authority
   - Access to any BCMS documented information, person, or site.
   - Direct communication with the Audit Committee.
   - Escalation to top management and (for material findings) the regulator.
4. Accountability
   - Functionally to the Audit Committee (Companies Act §177); administratively to the [CEO/COO/CFO].
5. Independence
   - Auditors shall not audit their own work.
   - Conflicts of interest shall be declared per engagement and mitigated.
   - The audit function shall not have operational responsibility for any BCMS activity.
6. Competence
   - Auditors shall meet the competency requirements in the Auditor Competency Matrix [reference].
   - Lead auditors shall hold [ISO 22301 lead auditor certification or equivalent].
   - CPD: minimum [X] hours per year, documented in the matrix.
7. Programme methodology
   - Risk-based audit programme, three-year cycle, reviewed annually.
   - Two-prong test: conformity and effective implementation.
   - Triggered engagements for major change, real disruption, or regulator request.
8. Reporting
   - Standard audit report structure [reference].
   - Reporting destinations per finding severity.
9. Follow-up
   - Corrective-action verification per Clause 10.1.
   - Effectiveness check within [30–90] days of correction.
10. Quality assurance
    - Sample of engagements reviewed by an experienced auditor each cycle.
    - External quality assessment every [3–5] years.
11. Approval and review
    - Approved by [top management; Audit Committee for listed/regulates entities].
    - Reviewed at least every three years.

Internal Audit Procedure, skeleton (toolkit 02)

The procedure operationalises the charter in ten steps:

1. Maintain the audit universe and risk ratings (the auditable areas; the inherent-risk / control-maturity / prior-findings / regulatory / change scoring; the frequency tier).
2. Build and review the audit programme (the three-year calendar; the annual review and re-base).
3. Plan each engagement (the audit plan: criteria, scope, methods, team, schedule).
4. Conduct fieldwork (opening meeting, evidence collection, evaluation, finding formulation, closing meeting).
5. Report (the standard report; the reporting destinations; the corrective-action handover).
6. Track corrective actions (the corrective-action log; the closure-rate KPI; the repeat-finding KPI).
7. Verify closure (effectiveness check; closure evidence; closure decision).
8. Report to the Audit Committee and (for material findings) top management and the regulator.
9. Feed management review (Clause 9.3) with audit findings, trends, and programme forward look.
10. Continually improve the audit programme (lessons learned per engagement; annual programme review).

Risk Assessment and Treatment

What is the risk that 9.2 itself mitigates?

The risk that 9.2 mitigates is the risk of undetected failure, the risk that the BCMS, as designed and as practised, has gaps that the first line (9.1) cannot see because the first line built the system. Without independent audit, the organisation is flying on instruments it has calibrated itself, with no independent cross-check. The cost of undetected failure is the cost of a real disruption that the BCMS should have prevented or contained but did not, measured in lost revenue, regulatory penalty, customer loss, reputational damage, and (in safety-critical sectors) harm to people.

The risk-based audit programme is itself a treatment of this risk: it focuses audit effort where the risk of undetected failure is highest. The high-tier auditable areas (priority activities, regulatory clocks, supplier-BC for critical suppliers, exercise programme effectiveness) are the areas where undetected failure is most costly.

What are the risks to a successful 9.2 programme?

The internal audit programme is itself subject to risk, risks that, if untreated, undermine its value:

• Independence risk. Auditors who are not genuinely independent produce findings that are not trusted. Treatment: the charter; the conflict-of-interest declaration; the structural reporting line to the Audit Committee; the periodic rotation of auditors.
• Competence risk. Auditors who do not know ISO 22301, the BCMS scope, or the applicable regulations produce shallow findings. Treatment: the competency matrix; the development plan; the quality-assurance review of working papers.
• Programme-design risk. An audit programme that is not risk-based, or that is not re-based after change, produces the wrong audits. Treatment: the documented risk assessment; the annual programme review; the triggered engagements.
• Finding-quality risk. Vague, untraceable, or unevidenced findings do not drive improvement. Treatment: the standard report structure; the criteria-traceability requirement; the working-paper review.
• Closure risk. Corrective actions closed without effectiveness check are paperwork. Treatment: the verification step; the effectiveness check; the closure-rate KPI.
• Escalation risk. Material findings that do not reach top management or the Audit Committee are buried. Treatment: the reporting destinations; the Audit Committee reporting cadence; the regulator-facing assurance link.
• Single-auditor dependence. A programme that depends on one auditor (internal or external) is fragile. Treatment: the deputy designation; the rotation; the cross-training; the documented working papers that survive personnel change.

Risk treatment in the audit charter

Each of the risks above is treated by a specific charter provision (see §9.1). The risk treatment is preventive (charter, competency matrix, programme methodology) and detective (quality-assurance review, Audit Committee oversight, external quality assessment). The residual risk, that the audit function fails to find a material gap, is treated by the periodic external quality assessment, by the certification body's third-party audit, and by the regulator's independent inspection (where applicable).

Risk-based audit programme, the scoring model

A defensible risk scoring model for the audit universe uses five factors, each scored 1–5:

The combined score (sum or weighted sum) drives the frequency tier: ≥15 = high (annual); 9–14 = medium (every 2 years); ≤8 = low (every 3 years). The scoring is documented per auditable area and reviewed annually.

Audit and Compliance Checklist

The 30-item checklist below is the pre-audit self-assessment for Clause 9.2, the questions a certification body will examine. Use it quarterly as a self-check and before every surveillance or recertification audit. Each item lists the expected evidence and the red flag that produces a finding.

Audit programme (Items 1–7)

1. Is there a documented audit programme covering the entire BCMS scope over a defined cycle (typically three years)? Evidence: the audit programme document, with the auditable universe, the risk ratings, the three-year calendar, the annual engagements. Red flag: no documented programme; or a programme that does not cover the full scope.
2. Is the programme risk-based, with a documented risk assessment per auditable area? Evidence: the risk scoring (inherent risk, control maturity, prior findings, regulatory exposure, change) per area; the frequency tiering; the rationale. Red flag: an annual circular with the same audit every year.
3. Does the programme consider the results of previous audits? Evidence: the programme's references to prior findings; the repeat-finding analysis; the re-audit decisions. Red flag: a programme that ignores what previous audits found.
4. Is the programme resourced, auditor days, team composition, budget? Evidence: the resourcing plan per engagement; the budget approval. Red flag: a programme with no resourcing estimate; an under-resourced programme.
5. Is the programme reviewed at least annually and re-based on change? Evidence: the annual review minutes; the programme version history; triggered engagements added for change. Red flag: a programme that has not been reviewed in 18+ months; no re-base after a major scope change.
6. Does the programme cover outsourced activities and critical suppliers (Clause 8.1)? Evidence: supplier-BC audit engagements; the contract-right-of-audit exercise; the supplier-BC findings. Red flag: a programme that audits only internal operations.
7. Does the programme include triggered engagements for major change and post-incident review (Clause 8.6)? Evidence: triggered engagements added after changes and incidents. Red flag: no triggered engagements despite material changes or incidents in the period.

Auditor independence and competence (Items 8–14)

8. Are the auditors demonstrably independent of the activities they audit? Evidence: the auditor assignments per engagement; the organisational reporting lines; the conflict-of-interest declarations. Red flag: a BCM, IT/DR lead, or CISO auditing their own work.
9. Is the audit function's independence structurally protected (reporting to the Audit Committee; not operationally responsible)? Evidence: the charter; the reporting lines; the Audit Committee minutes. Red flag: an audit function reporting to the BCM or to operations.
10. Is there a documented auditor competency matrix? Evidence: the matrix (qualifications, certifications, audit experience, CPD log, performance review). Red flag: no matrix; or a matrix not updated annually.
11. Do the auditors have appropriate certification (e.g., ISO 22301 lead auditor, ISO 19011, sector-specific)? Evidence: the certification records. Red flag: lead auditors without recognised certification.
12. Do the auditors have sector and regulatory knowledge (the applicable Indian regulators, the sector's continuity risks)? Evidence: the matrix's sector-experience and regulatory-experience columns. Red flag: auditors without sector experience in BFSI / capital markets / insurance / healthcare / manufacturing as applicable.
13. Are the auditors' working papers reviewed for quality (by an experienced auditor each cycle)? Evidence: the quality-assurance review records. Red flag: no quality-assurance review.
14. Is there an external quality assessment of the audit function every 3–5 years? Evidence: the external quality assessment report. Red flag: no external assessment (a finding at higher maturity levels).

Audit engagement conduct (Items 15–20)

15. Is each engagement planned in a written audit plan (criteria, scope, methods, schedule, team)? Evidence: the audit plan per engagement. Red flag: engagements conducted without a plan; or plans that are generic.
16. Are the audit criteria explicit (ISO 22301:2019 sub-clauses + documented BCMS requirements + applicable regulations)? Evidence: the criteria section of the audit plan and the criteria traceability in findings. Red flag: criteria that are vague ("good practice") or untraceable.
17. Does fieldwork use multiple evidence types (interview, observation, document review, sampling, re-performance)? Evidence: the working papers' evidence-type diversity. Red flag: desk audit only (document review, no interviews or observation).
18. Does the engagement explicitly test both conformity and effective implementation? Evidence: the working papers' two-prong evaluation. Red flag: engagements that test only documentation (the first prong) and not practice (the second prong).
19. Are findings specific, criteria-traced, evidenced, and severity-rated? Evidence: the standard report structure; the working-paper references. Red flag: findings that are vague ("needs improvement") or untraceable.
20. Is the closing meeting conducted with the auditee, with factual accuracy confirmed? Evidence: the closing meeting minutes. Red flag: no closing meeting; findings appearing in the report that the auditee first sees in the report.

Reporting, follow-up, and closure (Items 21–26)

21. Is the audit report delivered to the managers responsible for the audited area? Evidence: the report distribution list. Red flag: reports that go only to the audit function or to the BCM.
22. Does every nonconformity flow into the corrective-action process (Clause 10.1) with root-cause analysis? Evidence: the corrective-action log; the root-cause analysis per action. Red flag: nonconformities without corrective actions; or actions that address symptoms not causes.
23. Does the audit function verify the closure of each corrective action through an effectiveness check? Evidence: the effectiveness check records; the closure decision. Red flag: actions "closed" without effectiveness check.
24. Is the closure rate of corrective actions a tracked KPI (target ≥85%)? Evidence: the KPI on the audit dashboard. Red flag: no closure-rate KPI; or a closure rate persistently below target.
25. Is the repeat-finding rate a tracked KPI (target <10% over 12 months)? Evidence: the KPI; the trend analysis. Red flag: no repeat-finding analysis; or a rate above target.
26. Do material findings reach top management and the Audit Committee? Evidence: the reporting destinations; the Audit Committee minutes. Red flag: material findings buried at the BCM level.

Integration, retention, and continual improvement (Items 27–30)

27. Do internal audit findings flow into the management review (Clause 9.3) as a documented input? Evidence: the management-review pack's reference to the audit reports. Red flag: a management review that does not consume audit findings.
28. Are the audit programme and the audit results retained as documented information (Clause 7.5) for the regulatory look-back period? Evidence: the retention policy; the document repository. Red flag: no retention policy; or retention shorter than the regulatory look-back.
29. Does the audit programme integrate with adjacent management systems (ISMS, QMS, ERM) and with regulatory submissions (SEBI SAR, RBI IS audit, IRDAI compliance report, DPDP Data Audit)? Evidence: the integrated programme; the regulator-facing submissions referencing the audit findings. Red flag: parallel and duplicative audit programmes.
30. Is the audit programme itself continually improved (lessons learned per engagement; annual programme review; periodic external assessment)? Evidence: the lessons-learned log; the annual programme review minutes; the external assessment. Red flag: a programme that never changes; no learning captured.

Metrics and KPIs

The KPIs below measure the internal audit programme itself. They are distinct from the BCMS performance KPIs (Clause 9.1), those measure the BCMS; these measure the audit of the BCMS. A defensible 9.2 programme publishes these KPIs to the BCM steering group quarterly and to the Audit Committee and top management annually.

The 15 KPIs (minimum defensible set)

The dashboard, four audience views

Anti-patterns in 9.2 metrics

• The "zero findings" anti-pattern. A programme that produces zero findings across multiple cycles is shallow, not excellent. Treatment: deeper sampling; more observation; more re-performance; rotation of auditors to bring fresh eyes.
• The "high closure rate but high repeat-finding rate" anti-pattern. This combination means closures are paperwork, the symptom is treated, the root cause is not. Treatment: tighten root-cause analysis; require effectiveness checks.
• The "low cost per engagement" anti-pattern. Audit cost cut too far produces shallow audits. Treatment: benchmark cost against engagement scope and risk; do not optimise cost at the expense of finding quality.
• The "high auditee feedback" anti-pattern. Auditees love audits that find nothing; a high feedback score with low findings is a red flag. Treatment: weight feedback on the audit's process (professionalism, planning, communication), not on its outcome (how many findings).

Common Pitfalls / Audit Failures

The pitfalls below are the recurring failure modes that certification bodies see. They are the anti-patterns to design out of the programme.

The "self-audit" anti-pattern

The single most common 9.2 finding is auditors auditing their own work. The BCM audits the BCMS; the IT/DR lead audits the DR plan; the CISO audits the cyber-resilience controls. This violates the independence requirement outright. Treatment: the structural reporting line (audit reports to the Audit Committee, not to operations); the conflict-of-interest declaration per engagement; the rotation of auditors; for small organisations, the outsourced arrangement.

The "annual circular" anti-pattern

The same audit plan every year, irrespective of change or findings. The programme is not risk-based and does not consider previous results. Treatment: the documented risk assessment; the annual programme review with explicit consideration of change and findings; the triggered engagements.

The "documentation-only" anti-pattern

The audit tests documentation (the first prong, conformity) but not practice (the second prong, effective implementation). Findings are about paperwork gaps; the gap between paper and practice goes unseen. Treatment: every engagement explicitly evaluates the two prongs; fieldwork includes observation and interview, not just document review; exercises and corrective-action reviews are observed.

The "vague finding" anti-pattern

Findings that are not specific ("BCP needs improvement"), not criteria-traced, not evidenced, not severity-rated. Such findings cannot drive corrective action. Treatment: the standard report structure; criteria traceability as a quality gate; the working-paper review.

The "closed without effectiveness check" anti-pattern

Corrective actions marked "closed" the moment the correction is applied, with no effectiveness check. The audit function's verification is bypassed. Treatment: the effectiveness check as a closure requirement; the closure-evidence review; the closure-rate KPI defined strictly (closed with effectiveness check ÷ due).

The "no escalation" anti-pattern

Material findings that sit in the audit report and never reach top management or the Audit Committee. The audit is conducted; the report is filed; nothing changes. Treatment: the reporting destinations defined by severity; the Audit Committee reporting cadence; the regulator-facing assurance link.

The "parallel programme" anti-pattern

Internal audit of the BCMS runs in parallel with (and duplicative of) ISO 27001 internal audit, RBI IS audit, SEBI SAR, IRDAI compliance audit, and DPDP Data Audit. Effort is duplicated; findings are inconsistent across the parallel programmes. Treatment: the integrated audit programme; the multi-framework audit universe; a single corrective-action log with framework traceability.

The "checklist-only" anti-pattern

The audit is a generic checklist applied without sector or regulatory context. The audit produces generic findings; the BCMS's actual risks go unexamined. Treatment: the criteria section of the audit plan including ISO 22301 sub-clauses, the organisation's documented requirements, and applicable regulations; sector-specialist auditors on the team.

The "forever-zero findings" anti-pattern

A programme that has produced no nonconformities for multiple cycles. Either the BCMS is perfect (unlikely) or the audit is shallow. Treatment: deeper sampling; re-performance; observation; fresh auditor rotation; an external quality assessment.

The "single-auditor dependence" anti-pattern

The programme depends on one auditor (internal or external); when they leave, the programme stops. Treatment: deputy designation; rotation; cross-training; documented working papers that survive personnel change.

The "non-improvement" anti-pattern

The audit programme finds the same things year after year; the repeat-finding rate is high; the BCMS does not visibly improve. The audit is a ritual, not a discipline. Treatment: root-cause analysis on recurrent findings; escalation to top management for systemic issues; the continual-improvement link (Clause 10.2).

The "regulator-blind" anti-pattern

The audit programme ignores the applicable Indian regulators (RBI/SEBI/IRDAI/CERT-In/DPDP) and audits only against ISO 22301. Treatment: the criteria section including the applicable regulations; the integrated programme producing regulator-facing submissions.

Illustrative Scenario 1: Failure

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Disclaimer: The following is a fictional, composite scenario written for teaching. The regulator and its powers are real; the airline, its BCMS, its audit history and its regulatory history are invented and describe no real organisation.

The company

A growing Indian regional airline (fictional; let us call it "the Airline"), operating ~45 aircraft across domestic routes, with a BCMS that had been ISO 22301 certified at Stage 2 two years earlier. The certification had been a customer requirement (the Airline's largest corporate client, a public-sector bank, had made ISO 22301 a vendor-risk condition). The Airline had built a BCMS to pass the certification: a documented BIA, a strategy document, plans per operational area, an annual exercise, an internal audit, and a management review. The internal audit was outsourced to a category-level internal-audit services provider engaged on a low-fee basis, producing an annual audit report.

The catalyst

One summer, the regulator, the Directorate General of Civil Aviation (DGCA), capped the Airline's schedule at half its approved flights, finding that it had not shown it could run a safe and reliable service (in ISO terms, a failure of effective implementation). The cap, initially for 8 weeks, was extended. The regulatory action followed a series of in-flight snags and the regulator's "enhanced surveillance", in effect, the regulator doing the audit work the Airline's own internal audit had not done.

What the internal audit had missed

A post-event review (commissioned by the new CEO) examined the last three years of internal audit reports on the BCMS and found the following:

• The internal audit was a checklist walkthrough. Each annual report ran to ~12 pages of "Yes/No/Partial" responses against a generic checklist. There were no interviews with maintenance engineers; no observation of a turnaround; no observation of a spares-availability review; no sampling of MEL (Minimum Equipment List) decisions.
• The audit criteria did not include sector-specific continuity risks. The reports audited against ISO 22301 but not against the DGCA's Civil Aviation Requirements (CARs) on continuous airworthiness, MRO, and spares. The audit did not test the operational-risk spine (engine availability, spares inventory, MRO turnaround) that was, in retrospect, the Airline's primary continuity exposure.
• Auditor competence was thin. The internal-audit services provider assigned a generalist ISO 22301 lead auditor with no aviation experience. The competency matrix (which the audit firm had provided) showed the auditor's sector experience as "manufacturing, IT-ITeS", not aviation.
• Findings were vague. Where the audit did note issues (e.g., "the BCP should be updated for the new fleet type"), the findings were not criteria-traced, not severity-rated, and not linked to corrective actions with effectiveness checks. The corrective-action log showed the finding "closed" three months later with a one-line note ("BCP updated").
• The two-prong test was not applied. The audit tested the documentation (the first prong, conformity) but did not test practice (the second prong, effective implementation). No employee interviewed during the post-event review could describe their continuity role; no MRO engineer had ever been interviewed by an auditor; no spares-availability review had ever been observed.
• The audit reported to the wrong destination. The audit report was delivered to the BCM (the audit customer in the outsourced arrangement) and to the COO. It was not delivered to the Audit Committee; the Audit Committee minutes made no reference to BCMS audit findings.
• No triggered engagement after the first snags. When the in-flight snags began (the precursor to the DGCA action), no triggered audit engagement was added to the programme. The audit programme's annual cycle continued unchanged.

The cost

The DGCA action was costly: the schedule cap cut revenue across the affected quarters, and the reputational impact (corporate-client review, lessor scrutiny, recruitment difficulty) compounded the direct cost. The certification body, on the next surveillance audit, suspended the ISO 22301 certification pending corrective action.

The lessons

The post-event review named the lessons bluntly:

1. An internal audit conducted without sector competence is not an internal audit. A generalist ISO 22301 lead auditor without aviation experience cannot find aviation's continuity risks. Sector-specialist auditors (or technical experts) are non-negotiable for sector-specific scopes.
2. A checklist walkthrough is not an audit. The audit's value is independent judgement, expressed in specific, criteria-traced, evidenced findings. A Yes/No checklist produces neither judgement nor findings.
3. The two-prong test is not optional. Auditing documentation but not practice misses the gap between paper and reality, which is exactly the gap the regulator found.
4. Findings without closure discipline are paperwork. "BCP updated" as a one-line closure note, with no effectiveness check, treats the audit as a ritual.
5. Reporting to the BCM (not the Audit Committee) buries material findings. The Audit Committee's statutory oversight (Companies Act §177) is the escalation path that would have surfaced the chronic under-resourcing of asset integrity.
6. The audit programme must respond to change. When the in-flight snags began, the audit programme should have added a triggered engagement on operational continuity. The fact that the cycle continued unchanged is a programme-design failure.
7. A weak internal audit is a leading indicator of a weak BCMS, which is a leading indicator of a costly regulatory action. The DGCA's enhanced surveillance was, in effect, the regulator substituting its own audit for the Airline's missing one.

The Airline's new CEO commissioned a rebuilt internal audit programme: an in-house head of internal audit (reporting to the Audit Committee), sector-specialist co-source (an aviation continuity specialist), a risk-based three-year programme with operational continuity as a high-tier area, the two-prong test applied explicitly, and reporting to the Audit Committee with material findings escalated to the board. The certification was reinstated at the next surveillance audit, with the audit programme noted as a programme strength. The illustrative lesson: the cost of a defensible internal audit programme is a small fraction of the cost of the regulatory action a weak programme fails to prevent.

Illustrative Scenario 2: Success

Disclaimer: The following is an illustrative scenario written for teaching purposes. The composite company is fictional; the patterns are drawn from documented Indian and global cases.

The company

A 700-person Indian SaaS firm (illustrative; let us call it "the SaaS Firm"), providing a critical SaaS platform to banking, insurance, and capital-markets clients in India and (increasingly) the EU. The SaaS Firm had been ISO 27001 certified for four years and was pursuing ISO 22301 certification as a strategic differentiator for the regulated client base. The internal audit function was a two-person team reporting to the CFO administratively and to the Audit Committee functionally; the head of internal audit was a CISA with eight years of audit experience but limited BCM-specific depth.

The challenge

The SaaS Firm's first ISO 22301 readiness self-assessment (using the gap-analysis template) found the BCMS at L1 on internal audit: there was no documented audit programme for the BCMS (the ISMS audit programme existed but did not cover continuity); the prior year's "BCMS audit" had been a half-day walkthrough by the ISMS auditor with no findings; the audit charter did not mention BCMS; the Audit Committee had never received a BCMS audit report. The CEO and the Audit Committee chair agreed that this was a material gap, both for ISO 22301 certification and for the DORA-aligned assurance the EU clients were starting to require.

The intervention

Over 14 months, the head of internal audit led a programme to move the 9.2 maturity from L1 to L3:

1. Audit charter rebuild. The charter was rewritten to cover both ISMS and BCMS, approved by the CEO and the Audit Committee, and explicitly established independence (no operational BCMS responsibility for the audit function), authority (access to any BCMS document, person, or site), and reporting (functional to the Audit Committee). The charter was a controlled document under Clause 7.5.
2. Auditor competency build. The head of internal audit completed the ISO 22301 lead auditor certification; one of the two auditors completed the BCI CBCI certification; the team recruited a third auditor with sector experience in BFSI operational resilience. The competency matrix was documented and reviewed annually. For specialist engagements (DR drill observation, supplier-BC verification, DORA TLPT oversight), a co-source arrangement was put in place with a category-level compliance and audit firm with BFSI and DORA experience.
3. Risk-based audit programme. A documented audit universe was built: 27 auditable areas covering the BCMS scope (prioritised activities, BIA, strategies, plans, exercises, supplier-BC for the top 12 critical suppliers, regulatory clocks for CERT-In/RBI/SEBI/DPDP, DORA Art 11/12 for the EU clients). Each area was risk-scored (inherent risk × control maturity × prior findings × regulatory exposure × change). The scoring produced a three-year programme with nine annual engagements and rotating coverage of the medium- and low-tier areas.
4. Per-engagement quality. Each engagement had a written audit plan (criteria, scope, methods, team, schedule, reporting). Fieldwork included interviews (with activity owners and with floor-level engineers), observation (an annual DR simulation; a BIA workshop; a corrective-action review meeting), document review (the BIA, the plans, the exercise reports, the supplier-BC certificates), and re-performance (a BIA impact-score recomputation; a restore test; a plan walkthrough). Findings were specific, criteria-traced, evidenced, and severity-rated. The standard report structure was used.
5. Closure discipline. Every nonconformity flowed into the corrective-action log with root-cause analysis (5-Why; fishbone for systemic findings). The audit function verified closure through an effectiveness check 30–90 days after correction. The closure rate and the repeat-finding rate became headline KPIs on the audit dashboard.
6. Audit Committee reporting. Material findings were escalated to the Audit Committee quarterly. The annual audit report was presented by the head of internal audit at the Audit Committee, with the BCM attending to address actions. The Audit Committee, for the first time, engaged substantively with BCMS performance, asking informed questions about prioritised activities, RTO/RPO achievement, and supplier-BC posture.
7. Integration. The audit programme integrated with the ISMS audit programme (one team, one charter, one reporting line, integrated working papers where ISMS and BCMS controls overlapped, e.g., A.5.30 ICT readiness and Clause 8.5 exercises). The programme also produced the evidence for the SEBI CSCRF System Audit Report (the SaaS Firm had capital-markets clients), the RBI-aligned IS audit submissions (for the banking clients), and the DORA Art 11/12 evidence base (for the EU clients).

The programme

Over 14 months: head-of-internal-audit time (the rebuild was a significant part of their work for the period); ISO 22301 lead-auditor certification; BCI CBCI certification for one auditor; one additional auditor hire (BFSI-experienced); three co-sourced specialist engagements; and an audit management platform (mid-segment GRC SaaS, integrated with the ISMS module the firm already operated).

The results

• Audit programme execution rate at 100% in Year 1 (nine engagements completed as planned).
• Findings, 14 minor nonconformities, 2 major nonconformities, 9 opportunities for improvement across the year. The majors were on supplier-BC (two tier-1 suppliers without exercised failover) and on exercise programme depth (the annual simulation had not tested full failover). Both majors were closed within 90 days with effectiveness checks.
• Corrective-action closure rate at 92% (within 90-day window) by Year 1 end. The repeat-finding rate at 8% over the first cycle (no recurrence of the supplier-BC majors at the mid-Year-2 re-audit).
• Time-to-closure (mean) at 67 days, well within the 90-day target.
• ISO 22301 Stage 2 certification achieved at first attempt, with zero nonconformities against Clause 9.2 (the certification body noted the programme as a strength) and three minor nonconformities elsewhere (in BIA documentation, awareness training, and one corrective action's effectiveness check), all closed before the surveillance audit.
• DORA Art 11/12 readiness. The EU client that had been pressing for DORA evidence accepted the SaaS Firm's audit reports and the underlying programme as the assurance substrate; the contract was retained and expanded.
• SEBI CSCRF SAR submission for the capital-markets client used the BCMS audit evidence base; the SAR grading was "broadly compliant with minor improvements".
• Audit Committee engagement. The Audit Committee's quarterly engagement with BCMS performance moved from absent to substantive. Two material findings were escalated to the board Risk Committee, which approved a strategic investment in dual-region DR failover (a direct consequence of the audit's systemic finding on single-region DR exposure).
• Insurance premium. The cyber-insurance and business-interruption insurer reduced the premium at renewal by 9%, citing the documented internal audit programme and its closure discipline.

The outcome

The CFO presented the results to the Audit Committee at month 14. The conservative case: the retained EU client (a major contract that had been at risk without DORA-grade assurance) and the avoided cost of one regulator-driven assessment (a SEBI/RBI IS audit, on the conservative assumption that no business restriction would have followed). Beyond the conservative case, the certification (which the largest banking client had begun to require) unlocked further contracted revenue in the following year.

The intangibles

The SaaS Firm's BCM, who had initially been wary of the rebuilt audit programme ("just another compliance overhead"), became its strongest advocate: the audit's findings drove real improvements (the dual-region DR investment; the exercised supplier failover; the deepened exercise programme) that the BCM had wanted for years but could not fund without the independent evidence base. The Audit Committee chair, in the year-end review, described the programme as the change that had moved BCMS oversight "from a paper exercise to a real governance discipline". The certification body's lead auditor, at the surveillance audit, named the internal audit programme as the single strongest element of the BCMS.

The lessons

The transformation succeeded because: the charter established structural independence before any audit was conducted; the competency build (certification plus sector-experienced hire) preceded the programme; the risk-based programme focused effort where exposure was greatest; the two-prong test was applied explicitly; the closure discipline (with effectiveness checks) made findings stick; the Audit Committee reporting brought material findings to the board; and the integration with ISMS and with regulator-facing submissions turned the audit programme from a compliance overhead into a business asset. The programme is the illustration of the principle: an honest, independent, competent, risk-based internal audit programme is not a cost of certification, it is the mechanism by which the BCMS actually improves.

Multi-Framework Mapping

Clause 9.2 maps to the internal-audit and independent-assurance requirements of every major resilience, governance, and sector framework. The mapping below uses real control numbers and article references. An integrated audit programme produces the evidence each framework consumes.

ISO 22301 ↔ ISO/IEC 27001:2022

ISO 22301 ↔ SOC 2 (AICPA Trust Services Criteria)

ISO 22301 ↔ NIST SP 800-34 Rev 1

ISO 22301 ↔ NIST CSF 2.0

ISO 22301 ↔ DORA (Regulation (EU) 2022/2554)

ISO 22301 ↔ APRA CPS 230

ISO 22301 ↔ FFIEC BCM Booklet (Nov 2019)

ISO 22301 ↔ MAS TRM Guidelines

ISO 22301 ↔ HKMA SPM (TM-G-2 / OR-2 / SA-2)

ISO 22301 ↔ Indian regulators (summary)

A practical implication: an Indian regulated entity running a strong ISO 22301 9.2 programme satisfies a substantial portion of its regulatory assurance burden simultaneously. The audit programme's "regulator hook" column should make this explicit. The integrated programme produces the SEBI SAR, the RBI IS audit submission, the IRDAI compliance report evidence, the DPDP Data Audit (for SDFs), and the ISO 22301 internal audit report from one engagement per auditable area.

Implementation Roadmap

A 30 / 90 / 180 / 365-day roadmap from L1 to L3, with the Year 2 and Year 3 horizon to L4–L5.

First 30 days (foundational)

• Day 1–5: Charter the programme. Sponsor approval (CEO/COO/CISO). Head of internal audit designated. Audit Committee (or board) briefed. (Owner: Sponsor + head of internal audit)
• Day 6–15: Inventory current state. Pull the last three years of internal audit reports on the BCMS (if any); the existing audit charter (if any); the auditor competency matrix (if any); the corrective-action log; the Audit Committee minutes referencing BCMS. Identify the gaps. (Owner: head of internal audit)
• Day 16–25: Draft the Internal Audit Charter (toolkit 01) and the Internal Audit Procedure (toolkit 02). Draft the auditor competency matrix. Draft the audit universe (the list of auditable areas). (Owner: head of internal audit)
• Day 26–30: Route the charter through approval (CEO + Audit Committee). Communicate the programme to the BCM, the CISO, the COO. (Owner: Sponsor + head of internal audit)

Days 31–90 (defined)

• Approve the Charter, Procedure, competency matrix, and audit universe.
• Risk-rate each auditable area; build the three-year programme.
• Plan the first engagement (a high-tier area, typically the BIA, Clause 8.2, or the exercise programme, Clause 8.5).
• Conduct the first engagement end-to-end (opening meeting, fieldwork, closing meeting, report). For the first engagement, consider a co-source specialist to demonstrate method and quality.
• Open the first corrective actions. Begin the closure workflow.
• Report to the BCM steering group. Brief the Audit Committee at the next meeting.
• (Owner: head of internal audit + Sponsor + Audit Committee)

Days 91–180 (managed)

• Run engagements 2–4 per the programme (typically the BIA, the exercise programme, the supplier-BC for top tier-1 suppliers, the regulatory-clock audit for CERT-In/RBI/SEBI/IRDAI as applicable).
• Establish the standard report structure; the criteria traceability; the finding quality.
• Establish the corrective-action verification with effectiveness checks. Track the closure rate.
• Begin the integration with the ISMS internal audit programme (if running separately).
• Conduct a lessons-learned review of the first cycle; adjust the programme.
• (Owner: head of internal audit + audit team)

Days 181–365 (embedded)

• Complete the Year 1 engagements per the programme.
• Build the audit dashboard with the 15 KPIs (§12.1). Publish quarterly to the steering group.
• Conduct the first annual Audit Committee reporting on the BCMS audit programme. Escalate material findings.
• Feed the management review (Clause 9.3) with the audit findings as a documented input.
• Conduct an internal quality-assurance review (a sample of engagements reviewed by an experienced auditor).
• Maturity self-assessment: target L3 by end of Year 1.
• (Owner: head of internal audit + Audit Committee + Sponsor)

Year 2 (L3 to L4)

• Run the Year 2 engagements per the programme (typically the medium-tier areas, monitoring & measurement 9.1, awareness 7.3, documented information 7.5, communication 7.4, management review 9.3).
• Begin data-assisted audit techniques (continuous audit of BCMS telemetry; anomaly detection in measurement data).
• Begin integration with ERM, compliance, and the three-lines model.
• Engage an external quality assessment (every 3–5 years).
• Annual programme review; maturity self-assessment; target L4 by end of Year 2.

Year 3+ (L4 to L5)

• Multi-year risk-based programme with sector-specialist auditors and integrated GRC platform.
• Predictive analytics (forecasting finding likelihood by auditable area).
• Continuous auditing of high-tier areas.
• External benchmarking with peer organisations (anonymised).
• Continual-improvement cadence that pushes the maturity frontier each year.

FAQ

Q1. We are a 60-person SaaS company with no internal audit function. How do we satisfy 9.2? Outsource. Engage an internal-audit services provider or compliance and audit firm under a written engagement letter that replicates the audit charter (purpose, authority, accountability, independence, competence, reporting, follow-up). The BCM is the audit customer; the engagement letter preserves independence. Run a single engagement per year covering a rotating subset of the scope, with high-tier areas (priority activities, regulatory clocks) covered annually.

Q2. Our ISMS internal audit covers most of what the BCMS needs. Can we extend it? Substantially, yes. ISO 27001 and ISO 22301 share the Harmonised Structure; Clause 9.2 has the same title and requirement shape. An integrated ISMS+BCMS audit programme is the efficient model. Extend the ISMS audit universe to include the BCMS-specific areas (BIA, strategies, plans, exercises, supplier-BC, post-incident review). Ensure the auditor competency matrix includes BCM-specific competence (ISO 22301 lead auditor, BCI CBCI, or DRI CBCP, or equivalent). Do not duplicate.

Q3. Our CEO says we do not need an internal audit programme, we have an external certification audit every year. That is a misunderstanding of the roles. The certification body's audit is third-party audit for certification (Stage 1, Stage 2, surveillance, recertification). Internal audit (9.2) is first-party audit, the organisation's own self-policing. The certification body expects to see your internal audit programme and its findings as an input to their audit; a weak or absent internal audit is a finding in the certification audit and may indicate that other clauses are weak too. The two are complementary, not substitutes.

Q4. Our last three internal audits found no nonconformities. The BCM is delighted. Should we be? No. A programme that finds nothing across multiple cycles is shallow, not excellent. Either the BCMS is perfect (very unlikely for a growing company) or the audit is shallow. Treatment: deeper sampling; more observation (attend an exercise, a BIA workshop); more re-performance (recompute a BIA score; retest a restore); rotate the auditors for fresh eyes; commission an external quality assessment. The repeat-finding rate and the finding-quality review are the diagnostic KPIs.

Q5. Our auditors close corrective actions the moment the correction is applied. Is that compliant? No. Closure without an effectiveness check is the most common 9.2 finding. The clause requires that findings are acted on; the audit function's role is to verify the closure, which means confirming the corrective action was effective (not just applied). The effectiveness check is typically a re-test 30–90 days after the correction. A closure-rate KPI defined as "closed with effectiveness check ÷ due" is the discipline.

Q6. We measure time-to-notify CERT-In (under 9.1). Does the audit need to recompute it? No, that would be re-performance of first-line measurement, which is not the audit's role. The audit's role over 9.1 is to test the system of measurement: is the time-to-notify metric's definition valid (numerator, denominator, inclusions, exclusions)? are the thresholds set in advance? do breaches trigger actions? is the closure rate acceptable? The audit may sample-recompute one or two metrics (re-performance as an audit technique) but should not recompute every dashboard number.

Q7. Our BCM is excellent. Can they lead the BCMS internal audit? No. The clause requires independence: the auditor cannot audit their own work. An excellent BCM auditing their own BCMS is still a structural conflict of interest, and the certification body will find it. Treatment: the BCM is the audit customer (provides evidence, facilitates interviews, receives the report); the auditor is independent (internal audit function reporting to the Audit Committee, or external services provider).

Q8. Our Audit Committee does not currently receive BCMS audit reports. How do we change that? The audit charter (approved by the Audit Committee) should specify the reporting destinations for material findings. The head of internal audit should present the annual BCMS audit report to the Audit Committee, with the BCM attending to address actions. The Companies Act §177 and SEBI LODR Reg. 21 give the Audit Committee statutory oversight of internal audit and risk management; the BCMS is part of that. Begin with the next Audit Committee meeting.

Q9. We are an Indian firm serving EU financial clients. Does 9.2 satisfy DORA? Partially. DORA Arts 25–26 require vulnerability assessment, pen-testing, and threat-led penetration testing (TLPT), these are technical testing activities, broader than internal audit. The internal audit programme should oversee the testing programme even when the testing itself is performed by a third-party specialist. ISO 22301 9.2 produces the assurance evidence that the DORA Article 11(4) testing expectation is being met; the TLPT itself is separate.

Q10. Our audit programme is integrated with our ISMS audit. Should it also be integrated with our QMS audit? If your QMS scope overlaps with your BCMS scope (common in manufacturing), yes. An integrated ISMS+BCMS+QMS audit programme reduces duplication, improves consistency, and lowers total cost. The constraint is auditor competency, the integrated team needs competence across ISO 27001, ISO 22301, and ISO 9001. For most growing companies, ISMS+BCMS integration is the sweet spot; QMS integration comes at higher maturity.

Q11. Our internal audit report says our BCMS "conforms" but is "not effectively implemented" in some areas. What does that mean? It means the documentation meets the standard (the first prong, conformity) but practice does not (the second prong, effective implementation). This is the most common and most consequential audit finding. Treatment: identify the specific practices that fail (an unexercised plan; an unaware workforce; an ineffective corrective action); apply the corrective-action process (10.1) to each; re-audit at the next cycle to confirm effective implementation.

Q12. Our auditor wants to observe our next DR simulation. Is that allowed? Yes, observation is one of the canonical audit methods (alongside interview, document review, and sampling). Observing an exercise allows the auditor to test the effective implementation prong directly: do the people know their roles? does the plan work under stress? does the failover achieve the RTO? An audit that has never observed an exercise is a documentation-only audit. Welcome the observer.

Q13. Our certification body said our internal audit programme needs an external quality assessment every 3–5 years. Is that an ISO 22301 requirement? Not strictly in the clause text, but it is the canonical mechanism for demonstrating the audit function's own quality (ISO 19011 guidance). At higher maturity levels (L4–L5), the periodic external quality assessment is expected. For most growing companies at L2–L3, the internal quality-assurance review (a sample of engagements reviewed by an experienced auditor each cycle) is sufficient; the external assessment comes as the programme matures.

Q14. How do we handle internal audit of the management review process itself (9.3)? Carefully. The audit's role is to test whether the management review (9.3) is being conducted at planned intervals, with the required inputs, by top management, and producing decisions, not to perform the management review (which is top management's role). The audit's criteria for the 9.3 engagement are the requirements of Clause 9.3 (planned intervals, inputs, outputs, top management). The findings are about the process of the management review, not the substance of the strategic decisions.

Q15. Our last surveillance audit found a nonconformity against 9.2, the auditor said our auditor competency matrix was out of date. Is that a major? Likely a minor, unless the matrix gap has resulted in audit findings being missed (which could aggregate to a major). Treatment: update the matrix; review the engagements affected by the gap; consider whether re-audit is warranted; add an annual matrix-review step to the procedure. The minor itself is straightforward to close; the systemic risk (auditor competence not maintained) is what the closure's root-cause analysis should address.

Industry-Specific Requirements

BFSI (banks, NBFCs, payment system operators)

The most prescriptive continuity-audit regime in India. RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 Nov 2023, effective 1 Apr 2024) requires internal audit / IS audit / concurrent audit over IT and BCM, with internal audit reporting to the Audit Committee and (in larger banks) a dedicated IS audit function. The RBI Cyber Security Framework (2 Jun 2016) requires independent assessment of cyber-resilience controls. RBI Master Direction on Outsourcing of IT Services (10 Apr 2023) requires independent audit of outsourced-IT continuity and concentration risk. Specific 9.2 expectations for BFSI:

• An IS audit function (or co-sourced equivalent) with banking-sector experience; the function reports to the Audit Committee.
• Concurrent audit of high-risk IT operations (payments, treasury, card processing), continuous, not periodic.
• Independent assessment of DR drill performance, observation of the DR switchover and verification of RTO/RPO achievement.
• Independent audit of supplier-BC for outsourced IT, including the supplier's own DR posture and the concentration-risk register.
• Audit Committee oversight of BCMS performance; the audit findings feed the Audit Committee's quarterly review and the regulator-facing submissions.
• The two-prong test is a supervisory expectation: the RBI treats repeated digital outages (the HDFC pattern) as a matter for the board.

Capital markets (MIIs, brokers, AMCs)

SEBI CSCRF (20 Aug 2024) requires SEBI Regulated Entities to submit a System Audit Report (SAR) by a CERT-In empanelled auditor, with grading of the RE by category. The CSCRF's six cybersecurity functions (Governance, Identify, Protect, Detect, Respond, Recover) are the audit criteria. MIIs additionally operate under SEBI BCP/DR for MIIs (22 Mar 2021) with RTO 45 minutes and RPO 15 minutes for critical systems, Near Site + DRS architecture, and quarterly DR drills and half-yearly live trading from the DR site. Specific 9.2 expectations:

• A CERT-In empanelled auditor for the SAR (the SAR is a regulator-facing form of 9.2).
• Independent observation of a DR drill or live trading session from the DR site and verification of RTO/RPO achievement.
• Audit criteria that include the CSCRF six functions explicitly, not just ISO 22301.
• Audit Committee oversight of cyber-resilience and BCMS performance.
• For MIIs, frequency at least annual; for brokers/AMCs, the CSCRF cadence by category.

Insurance

IRDAI Information and Cyber Security Guidelines 2023 (24 Apr 2023) require insurers to conduct independent audit of ICT and BCP/DR, with annual compliance reporting to IRDAI within 90 days of FY end. The Board Risk/IT Committee has explicit oversight. Specific 9.2 expectations:

• An independent audit of ICT and BCP/DR, with the audit report submitted to the Board Risk/IT Committee.
• Annual compliance reporting to IRDAI (within 90 days of FY end) drawing on the audit findings.
• 180-day log retention (aligned with CERT-In) as the audit's evidentiary substrate.
• DPDP Data Audit if the insurer is a Significant Data Fiduciary (health and life insurers, with their large policyholder datasets, are likely SDFs).
• ICT outsourcing oversight, audit of the insurer's oversight of outsourced ICT, including supplier-BC.

Healthcare

Hospitals, diagnostics, and health-tech operate under the Clinical Establishments Act (where applicable at state level), NABH accreditation standards, the DPDP Act (health data is sensitive, Significant Data Fiduciary duties potentially engaged), and the NDMA framework for hospital-disaster planning. The AIIMS Delhi ransomware (23 Nov 2022) is the canonical reminder for healthcare audit: test that a backup copy sits outside the primary's failure domain and that clinical failover has been exercised. Specific 9.2 expectations:

• Critical-care continuity audit, MBCO at the bed / ICU / OT level; recovery capability for the hospital information system.
• Patient-data availability audit, DPDP §8(5); breach notification clock (DPDP §8(6) + DPDP Rules 2025; intimation without delay, detailed report to the Board within 72 hours).
• Clinical failover exercise observation, does the hospital have a tested paper-based fallback for OPD, billing, labs, pharmacy?
• Supplier-BC audit for critical suppliers (pharmaceuticals, oxygen, blood, diagnostics, laundry, food).
• NDMA hospital-disaster planning, integration with the district disaster-management plan; on-site and off-site emergency plans.

IT / ITeS & SaaS

Indian IT services and SaaS firms serving global clients inherit client continuity requirements contractually and, where the client is an EU financial entity, DORA obligations (Art 11 BIA, Art 12 RTO/RPO, Art 17–23 incident reporting, Art 25–26 testing). Specific 9.2 expectations:

• Customer-driven assurance, SOC 2 Availability, ISO 27001, ISO 22301, DORA-aligned evidence; the firm's own BCMS audit produces evidence for vendor-risk questionnaires.
• Per-client RTO/RPO achievement as an audit criterion; the audit verifies the measurements.
• DORA TLPT oversight, internal audit's oversight of the testing programme even when TLPT is performed by a third-party specialist.
• Supplier-BC, the firm is a supplier; it must audit its own supplier-BC (sub-processors, infrastructure providers, key SaaS dependencies) and report to clients.
• Time-to-notify clients per contractual clocks, an audit criterion.

Manufacturing, energy, chemicals, pharma

NDMA Chemical Disaster Guidelines 2007, the OSH Code 2020 (which replaced the Factories Act 1948), PESO and CPCB regulations, and sector-specific standards impose independent-audit obligations on Major Accident Hazard units. Sun Pharmaceutical's 2023 ransomware disclosure (in which India's largest drugmaker publicly warned of revenue hit and litigation risk from containment) is a public case of a continuity containment decision being a production-stoppage decision. Specific 9.2 expectations:

• Independent safety audit for MAH units (NDMA Chemical Guidelines 2007), statutory.
• OT/IT segmentation audit, has the OT network been segmented from the IT network; are OT recovery capabilities tested independently of IT?
• Production continuity audit, RTO for tier-1 production activities; supplier-BC for critical raw materials and single-source components (the Go First / Pratt & Whitney PW1100G engine-failure case is the aviation-sector analogue).
• Environmental-continuity audit, effluent continuity, emissions monitoring during disruptions, hazardous-material handling during degraded operations.
• Regulator-facing submissions, audit evidence feeding CPCB / PESO / state-pollution-control-board compliance returns.

Government and PSUs

NDMA guidelines, the National Policy on Disaster Management 2009, the DMP template, and CAG audit expectations. Specific 9.2 expectations:

• Departmental DMP currency, audit of the departmental disaster-management plan per NDMA template.
• Inter-departmental exercise observation, does the audit observe the inter-departmental exercise; does it test the integration with state and district plans?
• Critical-public-service availability, the audit's outcome criterion: does the BCMS protect the continuity of the public service the department exists to deliver?
• CAG audit closure, continuity-related CAG findings closed with effectiveness check.
• For PSUs, CAG Standing Committee on Public Sector Undertakings scrutiny of BCM investments and outcomes.

Maturity Model

The L1–L5 maturity model for Clause 9.2, described for a 250–2,000-person growing company.

Level 1, Ad hoc / reactive

• Practice. No documented audit programme for the BCMS. A "BCMS audit" is conducted annually as a half-day walkthrough by the BCM's own team or by the ISMS auditor with no BCM-specific scope. No charter; no competency matrix; no audit universe; no risk-based programme. Findings (if any) are vague; closure is paperwork.
• Tools. Word/Excel checklist; no dedicated tool.
• Audit outcome. Major nonconformity likely. The 9.2 programme is the absence of a programme.
• Path to L2. 2–3 months: charter, competency matrix, audit universe, first engagement end-to-end with a co-source specialist to demonstrate method.

Level 2, Defined

• Practice. A documented charter and procedure exist. A risk-based audit universe and a three-year programme exist. Annual engagements are conducted with independence (audit function or external services provider). Standard report structure used. Findings are specific and criteria-traced. Closure is documented but the effectiveness check is inconsistent.
• Tools. Excel on SharePoint with structured working-paper templates; or a basic audit module in a BCM-specialist SaaS.
• Audit outcome. Minor nonconformities likely on effectiveness-check consistency and integration with regulator-facing submissions. Survives surveillance with corrections.
• Path to L3. 6–12 months: effectiveness-check discipline; closure-rate and repeat-finding-rate KPIs; Audit Committee reporting; integration with ISMS audit; first internal quality-assurance review.

Level 3, Managed

• Practice. A discrete internal audit function with IS audit specialisation, reporting to the Audit Committee. Risk-based multi-year programme with annual engagements for high-tier areas. Two-prong test applied explicitly. Closure discipline with effectiveness checks; closure rate ≥85%; repeat-finding rate <10%. Audit Committee reporting quarterly; material findings escalated. Integration with ISMS, QMS, and regulator-facing submissions (SEBI SAR, RBI IS audit, IRDAI compliance report).
• Tools. Mid-tier GRC platform with audit workstream; integration with the BCMS measurement system (Clause 9.1) and the corrective-action log (Clause 10.1).
• Audit outcome. Zero to minor nonconformities. The 9.2 programme is a programme strength.
• Path to L4. 12–18 months: data-assisted audit techniques; integration with ERM and the three-lines model; first external quality assessment.

Level 4, Predictive

• Practice. Data-assisted audit techniques (continuous audit of BCMS telemetry; anomaly detection). Predictive analytics forecasting finding likelihood by auditable area. Sector-specialist auditors and external quality assessment every 3–5 years. Integration with ERM, compliance, and operational risk.
• Tools. Enterprise GRC platform with DAAT capability; integrated with the operational-technology and business-technology stacks.
• Audit outcome. Strength noted. Programme is regulator-confidence-building.
• Path to L5. 18–24 months: continuous auditing of high-tier areas; integrated BCMS/ERM/operational-risk audit; external benchmarking; real-time board reporting.

Level 5, Resilience by design

• Practice. BCMS internal audit is integrated with enterprise risk, operational risk, technology, and compliance audit on a single assurance map. Continuous auditing of high-tier areas. Predictive analytics. Self-healing controls (finding recurrence triggers automated control adjustment where feasible). External benchmarking with peer organisations. Real-time Audit Committee and board reporting.
• Tools. Enterprise IRM suite with predictive analytics and continuous-audit feeds.
• Audit outcome. Exemplary programme; the firm is a reference for the certification body.

Maturity advancement principles

• Move one level at a time. Trying to skip L2 to L4 fails because the discipline (independence, competency, finding quality, closure) is not yet there.
• Independence and competence precede tooling. An enterprise GRC platform at L1 maturity produces shallow audits with rich dashboards. Build the discipline first.
• The closure rate is the leading indicator of maturity. If the closure rate (with effectiveness check) is <85%, you are not L3, regardless of tooling.
• The repeat-finding rate is the leading indicator of root-cause discipline. If the repeat-finding rate is >10%, closures are paperwork, not correction.
• Sponsorship drives advancement. L3 to L4 requires real investment (function, tooling, integration); the sponsor's commitment is the constraint.

Emerging Trends

Data-assisted audit techniques (DAAT)

The historical cadence of internal audit (annual engagements, sample-based fieldwork) is being overtaken by continuous audit of BCMS telemetry. Replication health, backup success, exercise pass rate, corrective-action closure, all are available continuously from the BCMS measurement system (Clause 9.1). DAAT lets the audit function monitor these feeds, detect anomalies that warrant deeper fieldwork, and target engagements on the areas where the data indicates risk. The L4 organisation uses DAAT routinely; the L5 organisation uses DAAT to drive continuous auditing of high-tier areas, with periodic deep-dive engagements for areas where the data cannot substitute for human judgement.

Integrated assurance mapping

The three-lines model is converging on a single assurance map, a documented view of every assurance activity (first-line measurement, second-line risk and compliance review, third-line internal audit, external audit, certification, regulator inspection) against the critical-risk landscape. The integrated assurance map eliminates duplication, identifies gaps, and gives the Audit Committee and the board a single view of "what is being assured, by whom, and with what finding". The 9.2 programme in a mature organisation is one (the most independent) line on the assurance map.

Operational resilience as the successor frame

The "operational resilience" frame (HKMA OR-2, UK FCA/PRA/CB policy, APRA CPS 230 para 37, DORA) is shifting the audit question from "does the BCMS conform?" to "do the critical operations remain within impact tolerance, end-to-end, including third parties, under severe-but-plausible scenarios?" The end-to-end frame forces the audit to examine the entire critical-operation chain (people + process + technology + supplier + facility), not just the IT recovery or the documented plan. The 9.2 programme in a mature organisation tests the tolerance-compliance evidence, not just the BCMS documentation.

Climate-driven continuity audit

ISO 22301:2019 Amendment 1:2024 (climate) added climate change to Clauses 4.1 and 4.2 (4.1: determine whether climate change is a relevant issue; 4.2: interested parties can have climate-related requirements). The downstream effect on 9.2: the audit programme must test the BCMS's treatment of climate-related continuity risks (extreme-weather event frequency at each site; flood-risk trend; heat-stress impact on outdoor and facility operations; water-stress impact on cooling-dependent sites). For Indian organisations with sites in climate-vulnerable geographies (coastal Tamil Nadu and Andhra Pradesh; flood-prone Mumbai, Assam, and parts of Kerala; heat-prone northern plains; cyclone-prone Odisha and West Bengal), climate-driven continuity audit is moving from optional to expected.

DPDP-driven Data Audit

The DPDP Act 2023 and DPDP Rules 2025 made Data Audit a statutory duty for Significant Data Fiduciaries (SDFs), performed by a Data Auditor independent of the SDF. The Data Audit covers the SDF's data-processing activities, security safeguards, breach-notification capability, DPIA cadence, and data-retention and erasure practices. For SDFs (which include large BFSI entities, healthcare providers with substantial patient datasets, large e-commerce and social-media platforms, and likely some large IT/ITeS firms handling personal data at scale), the Data Audit is a regulatory form of 9.2, and the integrated audit programme produces the Data Audit evidence alongside the ISO 22301 audit.

Cyber-physical convergence

OT (operational technology) and IT convergence, visible in Indian manufacturing, energy, and critical infrastructure, is forcing the BCMS audit across the IT/OT boundary. An audit that tests IT recovery but not OT recovery is half an audit; an audit that observes an IT DR exercise but not an OT failover test is half an observation. The 9.2 programme must include OT continuity explicitly for organisations with operational technology. The Mumbai 12 October 2020 blackout (cyber link contested, Maharashtra state's "cyber sabotage" attribution vs the Union Power Ministry's "human error, not cyber attack", both positions on record) is the canonical illustration that OT continuity is a national-resilience-grade concern.

AI in the audit function

AI/GenAI is appearing in three places in the 9.2 programme: (a) as a data source, AI-driven log analysis that surfaces anomalies the SOC may have missed; AI-driven supplier-news scanning that flags supplier-financial-health deterioration; (b) as an analytical aid, AI-driven trend analysis across audit cycles; AI-driven finding-pattern recognition; AI-driven narrative generation for the audit report (subject to auditor review and sign-off); and (c) as an audit target, AI systems used in BCMS decision-support (predictive analytics, automated controls) require their own audit criteria. The technology is immature; the data-quality and validation discipline 9.2 builds is the prerequisite for trustworthy AI use in the audit function.

Continuous closure verification

The historical "effectiveness check 30–90 days after correction" cadence is being overtaken by continuous closure verification, the audit function monitoring the corrective action's effect on the underlying metric in near real time, with closure granted when the metric returns to target and stays there for a defined window. Continuous closure verification reduces the closure lag, improves the closure-evidence quality, and reduces the repeat-finding rate. It depends on the BCMS measurement system (Clause 9.1) producing clean, real-time data.

Board reporting standards

Board-level reporting of audit findings and BCMS performance is becoming standardised, driven by SEBI LODR Reg. 21 (Risk Management Committee for listed entities), RBI board-risk-oversight expectations, and the global operational-resilience movement. The board view of BCMS audit performance is converging on: programme execution; finding trend; closure and repeat-finding rate; material findings; systemic patterns; regulator-facing submissions. The 9.2 programme must produce this view; the head of internal audit must be able to present it verbally to the Audit Committee.

Regulatory convergence on independent assurance

RBI, SEBI, IRDAI, CERT-In, DPDP, and the global prudential regulators (DORA, APRA CPS 230, MAS TRM, HKMA SPM) are converging on the expectation that regulated entities maintain independent assurance over operational resilience and continuity. The Indian regulatory architecture (Companies Act §177 Audit Committee; SEBI LODR Reg. 21 Risk Management Committee; the RBI Master Direction's IS audit expectations; the IRDAI Guidelines' independent audit; the DPDP Data Audit) places independent audit at the centre of the regulatory confidence mechanism. A 9.2 programme that satisfies ISO 22301 simultaneously produces the evidence these regulators require, the most significant convergence in Indian regulatory architecture in a decade.

References and Further Reading

The standard and its companions

• ISO 22301:2019 Security and resilience, Business continuity management systems, Requirements (with Amendment 1:2024, Climate action changes).
• ISO 22313:2020 Security and resilience, Business continuity management systems, Guidance on the use of ISO 22301.
• ISO 22300:2021 Security and resilience, Vocabulary (note: the 2018 edition is withdrawn).
• ISO/TS 22317:2021 Security and resilience, Business continuity management systems, Guidelines for business impact analysis (note: the 2015 edition is withdrawn).
• ISO/TS 22318:2021 Security and resilience, Business continuity management systems, Guidelines for supply chain continuity (note: the 2015 edition is withdrawn).
• ISO/TS 22330 Security and resilience, Business continuity management systems, Guidelines for people preparedness.
• ISO/TS 22331 Security and resilience, Business continuity management systems, Guidelines for business continuity strategy.
• ISO 19011:2018 Guidelines for auditing management systems, the canonical auditing guidance.
• ISO/IEC 27001:2022 Information security management systems, Requirements (Clause 9.2 in particular, identical Harmonised Structure).

Practitioner bodies of knowledge (citable, not quoted)

• BCI practitioner guidance (Edition 7.0, launched 31 October 2023).
• DRI professional-practice framework (living framework).
• BCI Horizon Scan 2025 ("Complex and Interconnected Risk"), citable BCM industry dataset.
• IIA (Institute of Internal Auditors) International Professional Practices Framework (IPPF), the global internal-audit standard.

Indian regulatory instruments (primary sources)

• Companies Act 2013 §177 (Audit Committee) and §134(3)(n) (board's report on risk).
• SEBI LODR Regulation 21 (Risk Management Committee for listed entities).
• RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024), rbi.org.in.
• RBI Cyber Security Framework in Banks (2 June 2016), rbi.org.in.
• RBI Master Direction on Outsourcing of Information Technology Services (10 April 2023), rbi.org.in.
• SEBI Cybersecurity and Cyber Resilience Framework, CSCRF (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024), sebi.gov.in.
• SEBI BCP/DR for MIIs (SEBI/HO/MRD1/DTCS/CIR/P/2021/33, 22 March 2021), sebi.gov.in.
• IRDAI Information and Cyber Security Guidelines 2023 (24 April 2023), irdai.gov.in.
• CERT-In Directions No. 20(3)/2022-CERT-In (28 April 2022), cert-in.org.in.
• Digital Personal Data Protection Act 2023 (Act 22 of 2023) and Digital Personal Data Protection Rules 2025, meity.gov.in.
• Disaster Management Act 2005 (Act 53 of 2005); NDMA Chemical Disaster Guidelines 2007; NDMA DMP template, ndma.gov.in.
• Information Technology Act 2000 (as amended 2008), particularly §70B (CERT-In) and §70A (NCIIPC), indiacode.nic.in.

Global frameworks (citable)

• NIST SP 800-34 Rev 1 Contingency Planning Guide for Federal Information Systems (May 2010).
• NIST SP 800-160 Vol 1 + Vol 2 Rev 1 (cyber resilience).
• NIST Cybersecurity Framework 2.0 (26 February 2024).
• FFIEC IT Examination Handbook, Business Continuity Management Booklet (November 2019).
• Regulation (EU) 2022/2554, DORA (applicable from 17 January 2025).
• APRA CPS 230 Operational Risk Management (effective 1 July 2025), para 45 (internal audit review of BCM).
• MAS Technology Risk Management Guidelines (18 January 2021).
• HKMA Supervisory Policy Manual TM-G-2 / OR-2 / SA-2.
• Basel Committee on Banking Supervision, Principles for operational resilience.

Incident anchors (factual events referenced)

• Cognizant Maze ransomware (April 2020), SEC-filed 10-Q/K disclosed Q2 2020 impact of US$50–70 million.
• HDFC Bank repeated digital outages and RBI action (2 December 2020; restrictions partially lifted August 2021, fully lifted March 2022).
• AIIMS Delhi ransomware (23 November 2022), public reporting and the government's reply to Parliament.
• SpiceJet DGCA enhanced surveillance and 50%-of-schedule cap (27 July 2022), public DGCA order.
• Sun Pharmaceutical ransomware (2023), public disclosure warning of revenue hit and litigation risk.
• Mumbai power grid blackout (12 October 2020), cyber link contested (Maharashtra vs Union Power Ministry).
• Chennai floods (December 2015), Cognizant official statement on BCP activation.

A note on this guide's sources

The clauses, regulations, and incidents cited above are drawn from primary sources (the standards bodies, the regulators, the official disclosures) wherever primary sources are available. Where a number or date could not be confirmed from a primary source, it has been left out. Regulations change, so check the current version before relying on a specific provision.