ISO 22301 Internal Auditor Training in USA
ISO 22301:2019 Business Continuity Management System Internal Auditor Course — Business Impact Analysis, Recovery Strategies, Exercise Evaluation and Practical BCMS Auditing
Develop practical skills to plan, conduct, report and follow up internal audits of business continuity management systems. Learn to evaluate business impact analyses, disruption risks, continuity strategies, recovery requirements, plans, exercises, corrective actions and resilience evidence.
Status: ISO 22301:2019 with Amendment 1:2024 is current. A revision is at committee draft stage and is not published. This EAS-certified two-day course is not CQI-IRCA certified; PR311 belongs to the separate Lead Auditor course.
Current standard
Learn the current international business continuity management standard
ISO 22301:2019 is current and not withdrawn. Amendment 1:2024 asks organizations to consider whether climate change is a relevant issue; it does not require a separate climate risk register or immediate recertification. A revision exists only as a committee draft, with no transition dates.
| Document | Status | What it means for internal auditors |
|---|---|---|
| ISO 22301:2019 | Current | The BCMS requirements you audit (Clauses 4–10) |
| ISO 22301:2019/Amd 1:2024 | Published | Climate action changes: consider climate change in context and interested parties; no recertification required by the amendment itself |
| ISO/CD 22301 | Committee draft; not published | A future edition; no transition dates exist yet |
| ISO 19011:2026 | Current | Guidance for auditing management systems |
| ISO 22313:2020 | Current guidance | How to apply ISO 22301; not audit criteria |
| ISO/TS 22317:2021 | Current guidance | Business impact analysis guidance |
| ISO 22398:2013 | Guidance | Exercise guidance |
ISO: ISO 22301 (opens in a new tab) · ISO: Amd 1:2024 (opens in a new tab) · ISO: ISO/CD 22301 (opens in a new tab) · ISO: ISO 19011 (opens in a new tab) · ISO 22313 (opens in a new tab) · ISO/TS 22317 (opens in a new tab) · ISO 22398 (opens in a new tab)
Course recognition
Understanding ISO 22301 internal auditor training recognition
IAS lists this course among its EAS-certified internal auditor courses. The live page names both IAS and EAS as certificate issuer; we resolve this before publication.
| Item | IAS listing | Other source | Status |
|---|---|---|---|
| This course (Internal Auditor) | Listed among EAS-certified internal auditor courses, 2 days / 16 hours | Live page: EAS “issues the applicable course certificate” and also “IAS certificate of completion” | Resolve the certificate issuer |
| ISO 22301 Lead Auditor (separate) | CQI-IRCA PR311 on the IAS accreditation page | EAS’s certified course list shows PR363 (ISO 22301:2019) | Not used for this course |
| Live page wording | Certificate confirms “competence as an ISO 22301 internal auditor” and is “recognized by employers” | Competence is evaluated by your organization; no employer survey supports the claim | Replace with course-achievement wording |
| Credential terms | Attendance · course completion · auditor competence · organizational authorization · IRCA registration · third-party auditor qualification | Each is different | Explained on this page |
The course
Develop practical business continuity management auditing skills
An ISO 22301 internal audit is not plan writing, a penetration test, a disaster recovery test, a general risk assessment, an evacuation drill or a certification audit. Those activities can provide audit evidence but serve different purposes.
- BCMS and organizational resilience
- Business impact analysis and risk assessment
- Strategies, plans and recovery requirements
- Incident response and exercising
- Audit programs and objective evidence
- Findings and corrective action
Who should attend
Who should attend?
Choose a role to see relevance, recommended knowledge and next steps.
Prerequisites
Is ISO 22301 internal auditor training suitable for you?
No prior audit experience is required, and basic BCMS awareness helps. Nothing you enter here is stored or sent.
Two-day syllabus
Explore the two-day ISO 22301 internal auditor training program
A proposed expanded syllabus for the advertised two-day, 16-hour course, to be confirmed against the approved EAS course.
Topics on the current IAS course page
- Introduction to business continuity and ISO 22301:2019
- BCMS terms and structure
- BIA, risk assessment, strategies, plans, exercising and testing
- Audit principles, audit types and ISO 19011
- Audit programs, planning and checklists
- Conducting audits: opening meeting, evidence, interviews
- Nonconformities and reporting
- Corrective action, follow-up and closure
Requirements explorer
Understand business continuity management requirements from an internal auditor’s perspective
ISO 22301:2019 Clauses 4–10 in our own words. Not the standard’s text.
BIA workshop
Learn to audit a business impact analysis
A fictional US financial services company using its own 1–5 impact scale. No universal scoring model exists, and nothing here approves real recovery requirements. See ISO/TS 22317 for guidance.
Recovery metrics
Understand RTO, RPO, MTPD and MBCO
A fictional payment-processing service. Change the IT values to see how they relate to business needs. These metrics are common terms, not mandatory fields for every activity, and an IT target alone does not prove the service recovers in time.
Risk assessment
How internal auditors evaluate disruption risks
BIA and risk assessment are related but different. A risk register is not BIA evidence, and no single scoring method is required.
| Scenario | What the record shows | Your view |
|---|---|---|
| Extended power outage | Generator tested quarterly; fuel for 24 h. | |
| Telecommunications failure | Single carrier; no assessment of a second route. | |
| Critical supplier disruption | Supplier rated low risk with no evidence. | |
| Severe weather | Assessed for two sites; third site added in 2026 not assessed. | |
| Loss of key personnel | Deputies named and trained. | |
| Data center unavailability | Risk register only; no BIA link. |
Dependency mapping
Understand the dependencies behind continuity
Customer payment processing, step by step. Fictional single points of failure only; no real infrastructure details.
Continuity strategies
How to audit business continuity strategies and solutions
A fictional manufacturer relying on one component supplier. Not every organization needs a second office, and cloud services do not guarantee continuity on their own.
| Item | What it shows | Your view |
|---|---|---|
| Recovery requirement | Production needs the component within 5 days of disruption (fictional). | |
| Strategy options | Second supplier considered; no evaluation recorded. | |
| Safety stock | 10 days of stock held. | |
| Resources | Stock count not verified since 2025. | |
| Responsibilities | Purchasing lead owns supplier switch. | |
| Exercise | Strategy never exercised. |
Business continuity plans
Learn to evaluate business continuity plans and procedures
A plan existing does not show an effective BCMS. Fictional records only; never publish real contact lists.
| Item | What it shows | Your view |
|---|---|---|
| Contact lists | Last updated 2024; 3 leavers listed. | |
| Activation criteria | Defined with authority to invoke. | |
| Recovery procedures | Procedures for payments; none for settlement. | |
| Resource information | Alternate site details listed. | |
| Recovery priorities | Match the BIA. | |
| Exercise records | Plan exercised May 2026; actions tracked. |
Crisis communication
Auditing response coordination and communication
A fictional prolonged connectivity loss at the main office. No real emergency instructions.
Exercise designer
How to audit business continuity exercises
Build an educational outline using ISO 22398 concepts. Never disrupt live production systems, and one tabletop does not prove every capability.
Exercise results
How internal auditors evaluate exercise outcomes
Fictional records. Distinguish simulated outcomes from observed recovery evidence.
| Item | What it shows | Your view |
|---|---|---|
| Objectives | Objectives stated and linked to the BIA. | |
| Scope | Tabletop only; recovery time not measured. | |
| Attendance | Settlement team absent. | |
| Observed recovery | Technical test restored payments in 5 h 10 min vs 4 h target. | |
| Lessons learned | Recorded with owners. | |
| Follow-up | Actions open beyond due dates. |
BC vs DR vs IR
Business continuity vs disaster recovery vs incident response
ISO 27001 certification does not satisfy ISO 22301, and a successful IT recovery test does not show the whole BCMS conforms.
| Business continuity | IT disaster recovery | Cyber incident response | Information security (ISO 27001) | |
|---|---|---|---|---|
| Purpose | Continuity of prioritized activities | Restore IT systems and data | Detect and handle cyber incidents | Protect information security |
| Scope | Whole organization within scope | Technology | Security incidents | Information assets |
| Typical evidence | BIA, strategies, plans, exercises | DR plans, restore tests | Incident logs, playbooks | Risk treatment, controls |
| Standard or framework | ISO 22301 | No single standard | NIST and others | ISO/IEC 27001 |
| Replaces ISO 22301? | — | No | No | No |
Supplier continuity
Auditing critical supplier and third-party continuity
A fictional logistics company relying on a transport platform. Not every supplier needs ISO 22301, and questionnaires are not always enough.
| Item | What it shows | Your view |
|---|---|---|
| Supplier list | Critical suppliers identified from the BIA. | |
| Transport platform | Contract lists recovery commitments. | |
| Evidence | Questionnaire only; no test results. | |
| Alternative arrangements | No alternative carrier. | |
| Monitoring | Annual supplier review held. |
Climate context
Understanding climate-related business continuity context
Amendment 1:2024 asks organizations to consider climate change. Whether it matters depends on documented evidence for each site; no standalone climate plan is required.
| Situation | Your view |
|---|---|
| Coastal warehouse in a flood zone with two flood closures in 3 years | |
| Office in an area with recorded wildfire smoke closures | |
| Fully remote software team with cloud services | |
| Site with no records of climate-related disruption and no data | |
| Key supplier in a region with repeated heat-related outages |
Performance and management review
How internal auditors evaluate BCMS performance
Fictional indicators; no universal targets.
Audit program builder
Plan a risk-based business continuity internal audit program
Clause 9.2 requires planned audits; no single annual schedule applies. A fictional sample, not a certification readiness approval.
Auditor competence and objectivity
Who can conduct ISO 22301 internal audits?
Internal auditors need not be external consultants, but they must be competent and objective. Judge each fictional assignment.
| Assignment | Your view |
|---|---|
| The BCMS manager audits the BIA they wrote | |
| The quality auditor audits the exercise program | |
| The IT recovery manager audits DR tests they ran | |
| The risk manager audits supplier continuity | |
| The operations manager audits the whole BCMS alone | |
| An untrained engineer audits continuity strategies |
Checklist builder
Create practical BCMS internal audit questions
Educational examples; they do not replace the standard.
Interview simulator
Practice interviewing BCMS and business process owners
Choose a fictional role and the questions you would ask.
Mock BCMS audit
Practice a complete business continuity management system internal audit
A fictional US multi-site organization with eighteen audit areas. Not an EAS examination or a certification decision.
Findings laboratory
Write evidence-based BCMS internal audit findings
Nine fictional cases. Grade findings only under defined criteria; an imperfect plan is not automatically a nonconformity.
Corrective action
How to evaluate business continuity corrective actions
A fictional exercise found payments could not recover within target. No real recovery action is recommended.
Correction, corrective action or effectiveness check?
| Action | Your view |
|---|---|
| Activating a manual payment procedure | |
| Automating the database restore | |
| Retesting recovery in October | |
| Updating the restore runbook | |
| Notifying affected customers |
Audit evidence
What does effective ISO 22301 audit evidence look like?
Fictional comparisons; not IAS client data.
| Area | Strong evidence | Weak evidence |
|---|---|---|
| BIA | Current review with impact and dependency information. | Old BIA with no updates or review evidence. |
| Recovery strategy | Approach linked to verified recovery requirements. | Strategy exists but recovery needs not evaluated. |
| Business continuity plan | Maintained responsibilities and procedures with exercise evidence. | Uncontrolled or outdated plan. |
| Exercise program | Objectives, records, findings and follow-up. | A calendar with no evidence of exercises. |
| Corrective action | Cause investigation and effectiveness review. | Closed with no evidence of action. |
Industries
US industry applications
Requirements differ by organization and sector; choose an industry.
Frameworks
ISO 22301 vs ISO 27001 vs NIST vs disaster recovery
NIST compliance and ISO 27001 certification do not provide ISO 22301 certification.
| ISO 22301 | ISO/IEC 27001 | ISO 22313 | NIST Cybersecurity Framework | IT disaster recovery program | |
|---|---|---|---|---|---|
| Primary purpose | Business continuity management system | Information security management system | Guidance on applying ISO 22301 | Cybersecurity risk management | Restore IT systems |
| Audit criteria | Yes (requirements) | Yes (requirements) | No (guidance) | Framework, not certification | Organization’s own plans |
| Certification available | Yes | Yes | No | No | No |
| Replaces ISO 22301? | — | No | No | No | No |
NIST (opens in a new tab) · CISA (opens in a new tab) · FEMA (opens in a new tab) · Ready.gov (opens in a new tab)
Choosing a course
Choose the right ISO 22301 auditor training pathway
Lead Auditor completion does not automatically give IRCA registration or certification-body authorization.
| ISO 22301 Internal Auditor | ISO 22301 Lead Auditor | |
|---|---|---|
| Duration | Two days / 16 hours | Separate five-day / 40-hour course |
| Audit type | First-party BCMS audits | Audit team leadership; broader method |
| Recognition | EAS certified (IAS accreditation page) | CQI-IRCA (IAS lists PR311; EAS lists PR363) |
| Registration or authorization | None | IRCA registration is a separate application; certification bodies authorize their own auditors |
Delivery formats
Choose your ISO 22301 internal auditor training format
Outcomes, assessment and certificate are confirmed per format before you enrol.
Training dates
Upcoming ISO 22301 internal auditor training dates in USA
The IAS schedule lists one ISO 22301:2019 Internal Auditor virtual session, 9:00–18:00 with no time zone. The November and December IRCA sessions are the separate Lead Auditor course.
| Course | Edition | Provider | Start | End | Time zone | Format | Duration | Fee | Status | Enquire |
|---|
Assessment and certificate
What certificate will you receive?
EAS conducts the training and assessment as advertised, but no examination, pass mark or resit rule is published, and the issuer must be resolved. A course certificate is not ISO 22301 certification, auditor authorization, IRCA registration or third-party auditor approval.
EAS: training certificate search (opens in a new tab)
- Provider
- EAS (as advertised).
- Assessment
- To confirm.
- Passing requirements
- Not published.
- Certificate issuer
- IAS or EAS — to resolve.
- Verification
- To confirm.
- Reassessment
- To confirm.
Fees and corporate training
ISO 22301 internal auditor training fees in USA
Quoted in USD once approved. No fees or discounts are published, and in-house pricing is quoted per group rather than from a fixed five-learner break-even point.
- Classroom
- Request course fee
- Live virtual
- Request course fee
- Self-paced
- Request fee
- Corporate in-house
- Request a group quotation
- Confirmed with your quotation
- Duration, materials, assessment, certificate, taxes, payment terms, refund and cancellation
Registration
Register for ISO 22301 internal auditor training
Send a registration or information request. A coordinator confirms dates, fees, certificate and availability. You are registered only after written confirmation.
Enrollment journey
From enquiry to internal BCMS audits
An enquiry does not reserve a seat.
- 1
Understand ISO 22301
- 2
Review the current standard
- 3
Explore course recognition
- 4
Check course suitability
- 5
Review the two-day syllabus
- 6
Explore BIA and recovery concepts
- 7
Practice BCMS audit exercises
- 8
Compare formats
- 9
Select confirmed dates
- 10
Review approved fees
- 11
Submit registration
- 12
Receive confirmation
- 13
Attend training
- 14
Complete the assessment
- 15
Receive the applicable certificate
- 16
Apply skills to internal BCMS audits
Tutors and responsibilities
Learn from experienced business continuity auditing professionals
Tutor profiles will appear once verified.
| Responsibility | Organization | Status |
|---|---|---|
| Owns the course | EAS | To confirm |
| Markets the course | IAS | Confirmed |
| Delivers training | EAS | As advertised |
| Conducts assessments | EAS | Confirm rules |
| Issues certificates | IAS or EAS (live page says both) | Resolve |
| Manages online learning | EAS portal | Confirm |
| Collects fees | IAS or EAS | Confirm |
| Handles complaints | IAS and EAS | Confirm |
| Handles resits | EAS | Confirm |
| Maintains records | EAS | Confirm |
FAQ
ISO 22301 internal auditor training questions
98 answers. Course rules are confirmed when you enrol.
What is ISO 22301 Internal Auditor Training?
A two-day course that teaches you to plan, conduct, report and follow up internal audits of a business continuity management system.
What is ISO 22301:2019?
The international standard setting requirements for a business continuity management system (BCMS).
Is ISO 22301:2019 still current?
Yes.
What is Amendment 1:2024?
An ISO amendment adding climate change considerations to the organization’s context and interested parties.
Is ISO 22301:2026 published?
No. A revision is at committee draft stage (ISO/CD 22301) and has no publication or transition dates.
What is ISO 19011:2026?
The current guidelines for auditing management systems.
What is ISO 22313:2020?
Guidance on using ISO 22301. It is not audit criteria.
What is ISO/TS 22317:2021?
Guidelines for business impact analysis.
What is a Business Continuity Management System?
The part of a management system that establishes, implements, maintains and improves business continuity.
What is organizational resilience?
The ability to absorb and adapt in a changing environment; business continuity contributes to it.
What is a business impact analysis?
An analysis of the impact over time of disrupting activities, used to set priorities and recovery requirements.
Why is a BIA important?
It sets which activities to recover first and how quickly, which drives strategies and plans.
What is the difference between BIA and risk assessment?
BIA looks at the impact of disruption over time; risk assessment looks at the risks that could cause disruption.
What is a critical business activity?
An activity the BIA prioritizes because disruption would cause unacceptable impact within a short time.
What is impact over time?
How the consequences of a disruption grow the longer it lasts.
What is RTO?
Recovery time objective: the target time to resume an activity or resource after disruption.
What is RPO?
Recovery point objective: the point to which data must be restored, often expressed as maximum acceptable data loss.
What is MTPD?
Maximum tolerable period of disruption: the time after which the impact of not resuming becomes unacceptable.
What is MBCO?
Minimum business continuity objective: the minimum acceptable level of products or services during disruption.
Are RTO and RPO the same?
No. RTO is about time to resume; RPO is about data loss.
Are all recovery metrics mandatory for every process?
No. Organizations use the terms that fit their BIA; ISO 22301 does not require every metric for every activity.
What are continuity strategies?
Approaches and solutions that let the organization meet recovery requirements.
What is a business continuity plan?
Documented information guiding response, continuity and recovery during disruption.
What are critical dependencies?
People, technology, facilities, suppliers and other resources a prioritized activity relies on.
What is a single point of failure?
A dependency whose failure alone stops an activity.
What is a crisis management process?
How the organization assesses, escalates and leads its response to a serious incident.
What is incident response?
The immediate actions taken to manage an incident.
What is IT disaster recovery?
Restoring IT systems and data after disruption.
How does ISO 22301 differ from ISO 27001?
ISO 22301 covers business continuity; ISO/IEC 27001 covers information security.
Does ISO 27001 certification replace ISO 22301?
No.
What is a business continuity exercise?
A planned activity to validate strategies, plans and people.
What is a tabletop exercise?
A discussion-based exercise around a scenario.
What is a technical recovery test?
A test that actually restores systems or services.
How are exercises evaluated?
Against objectives and criteria, with observations, findings and follow-up.
What is objective recovery evidence?
Records of what actually happened, such as measured restore times.
What is a supplier continuity assessment?
An evaluation of whether a supplier can continue or recover the service you rely on.
What is ISO 22301 internal auditing?
A first-party audit of the BCMS against ISO 22301 and the organization’s own requirements.
What does Clause 9.2 require?
Internal audits at planned intervals under an audit program, with objective auditors and reported results.
Who should attend?
Continuity managers and coordinators, internal auditors, risk, resilience, IT recovery, supply chain and compliance staff.
Is the course suitable for beginners?
Yes. No prior audit experience is required.
What are the prerequisites?
None mandatory; basic BCMS awareness helps.
Is prior auditing experience necessary?
No.
Does the course cover BIA?
Yes.
Does it cover risk assessment?
Yes.
Does it cover continuity strategies?
Yes.
Does it teach recovery planning?
It teaches how to audit recovery planning, not how to write plans for your site.
Does it include crisis communications?
Yes, as an audit topic.
Does it cover exercise evaluation?
Yes.
How long is the course?
Two days.
Is it two days?
Yes.
Is it 16 hours?
Yes, for instructor-led formats.
What does Day 1 cover?
ISO 22301 requirements, BCMS processes and audit principles.
What does Day 2 cover?
Conducting audits, auditing operational continuity, reporting and corrective action.
Does it include practical workshops?
Yes.
Does it include a mock internal audit?
Yes, with a fictional organization.
Will I learn audit planning?
Yes.
Will I learn checklists?
Yes.
Does it teach interviewing?
Yes.
What is objective evidence?
Verifiable records, observations or statements.
What is a nonconformity?
Failure to meet a requirement.
How are nonconformities classified?
By your organization’s defined criteria; there is no universal internal grading.
How are corrective actions verified?
By checking the cause was removed, often by retesting.
How frequently must internal audits occur?
At planned intervals set by the organization; no single frequency fits all.
Must internal auditors be independent?
They must be objective and not audit their own work.
What competence does a BCMS auditor need?
BCMS and audit knowledge, process understanding and objectivity, evaluated by the organization.
Does the training certificate establish full auditor competence?
No.
Is the course EAS certified?
Yes, IAS lists ISO 22301 among its EAS-certified internal auditor courses.
Is it CQI-IRCA certified?
No.
What is CQI-IRCA PR311?
The reference IAS lists for its separate ISO 22301 Lead Auditor course; EAS’s list shows PR363. Neither applies to this course.
What is the difference between Internal Auditor and Lead Auditor Training?
Internal is two days for first-party audits; Lead Auditor is five days and covers audit leadership.
Does Lead Auditor training automatically grant IRCA registration?
No. Registration is a separate application.
Who delivers the training?
EAS, IAS’s training partner.
Who issues the certificate?
The live page says both IAS and EAS; we confirm the issuer before you enrol.
Does ISO issue training certificates?
No.
Can the certificate be verified?
EAS offers a certificate search; we confirm it covers this course.
Does the certificate expire?
Confirmed with the certificate wording.
Is classroom training available?
Advertised; no public venue is published.
Is live virtual training available?
Yes. The IAS schedule lists November 2–3, 2026.
Is corporate in-house training available?
Yes.
Is self-paced training available?
Yes, with 30 days of portal access as advertised.
Is 30-day portal access included?
For self-paced study. It is access, not 30 days of instruction.
Are all formats assessed identically?
Not confirmed.
Is there an examination?
To confirm with EAS.
What is the passing score?
Not published.
Can I retake the examination?
Not published; we confirm.
What are upcoming USA training dates?
A virtual session on November 2–3, 2026 is listed. Confirm availability before registering.
What time zone applies?
The schedule lists 9:00–18:00 without a time zone. We confirm it.
What is the training fee?
Request a fee. No price is published.
Is group training available?
Yes.
Can training be conducted at our company?
Yes, as in-house training.
Are group discounts offered?
None are published; in-house pricing is quoted per group.
Can international delegates participate?
Usually for virtual sessions.
Does ISO 22301 certification guarantee business continuity during every incident?
No.
Can ISO 22301 certification replace a disaster recovery test?
No.
Does training guarantee employment?
No.
What is the cancellation policy?
See the refund policy and your quotation.
How do I register?
Use the registration form. A coordinator confirms dates, fees and availability.
What happens after registration?
You receive confirmation and joining instructions once your place is confirmed in writing.
Related courses
Training and continuity resources.
- ISO 22301 Lead Auditor
- ISO 22301 certification
- ISO 27001 Internal Auditor
- ISO 9001 Internal Auditor
- Internal Auditor training
- Lead Auditor training
- ISO training
- Training schedule
- Accreditation information
- About IAS
- IAS Insights
- Contact IAS USA
- ISO audit procedure
- Training nomination form (DOC)
- Course or service brochure (PDF)
- Frequently asked questions