ISO 22301:2019 Internal Auditor Training

Starts with four real cases: the July 2024 CrowdStrike update, with Parametrix estimating about 5.4 billion dollars of direct losses for Fortune 500 companies; the March 2025 substation fire that closed Heathrow; the Marks and Spencer cyber attack, expected to cut operating profit by about 300 million pounds; and the Jaguar Land Rover attack, estimated to cost the UK economy about 1.9 billion pounds. Each yields an audit question on dependencies, recovery times, duration and supplier continuity. Introduces Dunebridge Logistics, a worked example of a third-party logistics company in Dubai followed through the course, and contrasts two audits of its cold-chain plan, where an exercise took nine hours against a promised four. Explains what clause 9.2 asks of internal audit, the scope of ISO 22301:2019, the course structure and exam, and four myths about BCMS auditing.

What you will be able to do

• Explain why clause 9.2 audits test whether the BCMS works, not only whether it is written
• Identify audit questions on dependencies, recovery times and suppliers from real disruptions
• Distinguish four common myths about BCMS auditing from what the standard requires

Why it matters

Shows why evidence-based audits find the gaps a signed plan hides, so they are closed before a power cut, cyber attack or supplier failure tests the plans.

Practice: Practice: Welcome: why BCMS internal audit matters · 3 questions

Begins with a Dunebridge director who presents a binder of twelve plans as the whole BCMS, and shows why plans are only one output. Covers the second edition and what it changed from 2012, what a business continuity management system includes, and the Plan, Do, Check, Act structure shared with ISO 9001 and ISO/IEC 27001. Walks through clause 8 as a chain, from operational planning and the business impact analysis to strategies, plans, exercises and evaluation, and explains why there is no Annex A. Teaches shall, should, may and can, and how notes and ISO 22313 guidance differ from requirements. Defines the key terms and explains MTPD and RTO as optional labels in notes to clause 8.2.2. Covers Amendment 1 of February 2024 on climate change, four reading habits and a short exercise on a missing RTO label.

What you will be able to do

• Describe the structure of ISO 22301:2019 from clause 4 to clause 10 and its clause 8 core
• Distinguish shall, should, may and can, and explain why notes are not audited as requirements
• Check whether climate change was considered as the 2024 amendment requires

Why it matters

Keeps findings to real requirements, not missing labels, and puts audit time on the clause 8 chain where continuity capability is decided.

Practice: Practice: The standard through an auditor's eyes · 3 questions

Opens with a Dunebridge IT manager who audited his own recovery plan, reported no findings, and was followed by an eleven-hour restore. Explains the two questions in clause 9.2.1 and groups the clause 9.2.2 duties for the audit programme, including impartial auditor selection and verified follow-up. Introduces ISO 19011:2026, the fourth edition published in May 2026, and its expanded guidance on remote auditing. Defines an audit, objective evidence from interviews, records and observation using a driver call tree, and the chain of criteria, evidence, finding and conclusion. Shows an impression rewritten as a verifiable finding, the audit roles, first, second and third-party audits, and combined, joint and remote audits. Ends with the seven principles, cross-auditing for independence, a small hotel in Chicago with one auditor, and a quick principles check.

What you will be able to do

• Explain what clauses 9.2.1 and 9.2.2 require of internal audits and the audit programme
• Apply the chain of audit criteria, evidence, finding and conclusion to a continuity finding
• Plan cross-audits so that no internal auditor audits their own area or work

Why it matters

Builds independent, evidence-based audits that meet clause 9.2 and hold up when management, customers or a certification audit rely on the report.

Practice: Practice: Clause 9.2 and the principles of auditing · 3 questions

Starts with a Dunebridge context analysis written in 2023 that misses the 2025 pharmacy chain contract and its penalties for late delivery. Explains clause 4.1 with relevant issues such as a single cloud warehouse system and summer heat in Dubai, and why a template list of inflation and competition is useless. Compares climate change decisions at Dunebridge and a media company in Paris, and shows both can conform when answered with a reason. Covers interested parties and stated, implied or obligatory requirements, where requirements hide in contracts and complaints, and the three duties of clause 4.2.2, using a customs permission for bonded stock and a hospital in London. Traces context into scope, risks and management review, lists auditor questions and evidence, works two sample findings and ends with a hotel group in Chicago facing a new fire code.

What you will be able to do

• Assess whether the context analysis names issues specific to continuity, not template items
• Test interested parties for completeness by sampling contracts, complaints and regulators' letters
• Write findings against clauses 4.2.1 and 4.2.2 for missed requirements and a stale legal register

Why it matters

Catches contract penalties, customs permits and legal duties that never reached the plans, so the BCMS rests on what customers and regulators require.

Practice: Practice: Context, parties and legal requirements · 3 questions

Opens with Dunebridge excluding last-mile delivery as outsourced, although its own 120 vans deliver the pharmacy contract every day. Covers clause 4.3.1, including the mission, goals and obligations ISO 22301 adds, and clause 4.3.2, where exclusions shall not affect the ability and responsibility to provide continuity. Judges four exclusions, from the staff canteen to outsourced IT with no explanation, and uses the clause 3.22 definition of outsource to show an outsourced process stays in scope. Compares weak and strong scope statements, follows a bank in Singapore whose retail payments depend on group IT, and lists three common auditor mistakes. Explains clause 4.4 and process interactions, signs of shelf-ware, and two worked findings on the delivery exclusion and an unactioned exercise report. Ends with a data-centre operator in Frankfurt.

What you will be able to do

• Test each exclusion by placing the scope beside the business impact analysis
• Explain why an outsourced process remains within the scope under clause 3.22 and clause 8.1
• Identify signs that a BCMS is shelf-ware by reading the version history of key documents

Why it matters

Stops a scope from quietly leaving out the most urgent service, while respecting legitimate boundaries the analysis and the law allow.

Practice: Practice: Scope, exclusions and the BCMS · 3 questions

Begins with a Dunebridge warm standby site deferred three years running while the plan still assumes it exists. Walks through the eight ways clause 5.1 asks top management to show leadership, with emphasis on integrating continuity into contracts and system changes. Describes evidence of leadership in budgets, minutes, presence at exercises and messages to staff, and how to use ten minutes with the chief executive. Covers the four features of the policy in clause 5.2.1, the three conditions of clause 5.2.2, and a weak and strong policy compared. Explains clause 5.3, the difference between BCMS roles and response roles, and a water utility in Sydney whose board funded a second pump station after an exercise. Works two findings, on unfunded resources and a missing commitment to satisfy applicable requirements, and closes with an insurer in Toronto.

What you will be able to do

• Assess top management leadership from budgets, minutes, exercise participation and messages
• Read a business continuity policy against the four features and two commitments of clause 5.2.1
• Distinguish a recorded risk acceptance by management from a nonconformity on resources

Why it matters

Tests whether leadership truly resources business continuity, so gaps such as an unfunded standby site reach the board as clear findings.

Practice: Practice: Leadership, policy and roles · 3 questions

Begins with a Dunebridge register that lists floods, fires and cyber attacks but nothing on whether the management system itself could fail. Uses the notes to clauses 6.1.2 and 8.2.3 to show where each kind of risk belongs, with system risks such as one person running the whole BCMS. Covers opportunities, with a mutual-aid agreement for standby warehouse space, and the clause 6.1.2 duties to plan, integrate and evaluate actions. Explains clause 6.2.1 objectives and the five questions of clause 6.2.2, using a four-hour cold-chain dispatch objective and an airline caterer in Hong Kong with objectives at three levels. Covers clause 6.3 through a warehouse plan merger done badly and well, then auditor questions, evidence, two worked findings and an exercise on a university in Boston.

What you will be able to do

• Distinguish risks to the management system under clause 6.1 from risks of disruption under 8.2.3
• Test a business continuity objective against the five questions of clause 6.2.2
• Assess whether a significant change to the BCMS was planned and kept its integrity

Why it matters

Catches a BCMS that depends on one person or sets objectives nobody owns, so continuity keeps working as staff, contracts and plans change.

Practice: Practice: Risks to the BCMS, objectives, changes · 3 questions

Opens with a Dunebridge night-shift supervisor who joined the recovery team after the annual training and could not say which plan applied. Explains clause 7.1 resources for running the system, as distinct from recovery resources under clause 8.3.4, then the four steps of clause 7.2, including evaluating whether training worked rather than counting signatures. Covers who needs competence and why agency drivers and contractors must be sampled. Sets out the four awareness items of clause 7.3, with the role before, during and after disruptions, and a weak and strong way to test awareness. Covers the five communication decisions of clause 7.4 and how they differ from clause 8.4.3, a telecom operator in Mumbai whose alternate led the response in a monsoon flood, three common mistakes, two findings and a car-parts maker in Tokyo.

What you will be able to do

• Evaluate whether competence actions worked, using exercise results rather than attendance registers
• Test awareness on every shift by asking staff their role in the first hour of a disruption
• Distinguish communication about the BCMS under clause 7.4 from disruption communication

Why it matters

Looks past training files to the people who will run the plans, including night shifts, agency staff and alternates, before a real disruption arrives.

Practice: Practice: Resources, competence, awareness, communication · 3 questions

Starts with an emergency cabinet at the Dunebridge cold-chain warehouse holding version three of a plan whose current version is six, naming a former supplier and a manager who has left. Explains clause 7.5.1 and the two kinds of documented information, then groups the documents and records ISO 22301 names. Covers clause 7.5.2, the two purposes of control in clause 7.5.3.1, and the activities in clause 7.5.3.2, including documents of external origin such as a cloud provider's outage procedure. Links clause 8.4.4 to where plans are kept, the balance between protection and availability, and retention of post-exercise reports and disruption logs. Gives a ten-minute check of one plan and its copies, a media company in Paris testing a plan on a phone in flight mode, two findings, three mistakes and a retailer in New York.

What you will be able to do

• Identify which documented information ISO 22301 requires and which the organisation decides it needs
• Check controlled copies of a continuity plan against the approved version and test their content
• Assess whether plans are both protected and available when networks or buildings are down

Why it matters

Catches obsolete plans in emergency cabinets and plans unreachable when systems fail, so teams hold the right version on the day they need it.

Practice: Practice: Documented information · 3 questions

Starts with a Dunebridge fulfilment plan that relies on a peak-week haulier whose contract says nothing about disruption response. Explains clause 8.1, the organisation's own criteria for continuity processes, and control of planned and unintended changes, including a haulier depot moved an hour away. Shows why outsourced processes stay in scope and how Dunebridge controls its cloud warehouse system, telecom carrier, haulier and contact partner in Mumbai. Revisits the Jaguar Land Rover attack, with around 5,000 UK organisations affected, and a bank in Singapore that sets a two-hour recovery time for its card processor. Covers clause 8.1 c) records, then clause 8.2.1: systematic BIA and risk assessment processes, review at planned intervals and on significant change, and the organisation's choice of order. Ends with two findings and a hotel group in Chicago.

What you will be able to do

• Assess whether outsourced processes are controlled through contract terms, evidence and joint exercises
• Check that the BIA and risk assessment were reviewed after significant changes
• Trace one prioritised activity through the analysis, the risk assessment and the strategy

Why it matters

Finds supplier promises nobody made and analyses that miss new contracts, so the supply chain can support recovery and continuity rests on current facts.

Practice: Practice: Operational control and the supply chain · 3 questions

Opens with a Dunebridge analysis that rates all fourteen activities high and leaves out returns processing for recalled medicines. Explains the BIA as a statement and justification of continuity requirements, and groups the eight items of clause 8.2.2. Covers item a) with Dunebridge's own severe-level criteria for patient safety, contract penalties, financial loss and legal breaches. Covers item b) with three cross-checks for completeness: tracing services, checking contract promises and walking the site. Covers item c) with an impact curve for cold-chain dispatch compared with payroll. Uses a hospital in London to show impact types fitted to context, and explains how interviews, workshops and data show a systematic process. Distinguishes the BIA from a risk assessment, lists three common mistakes, works two findings and closes with a water utility in Sydney.

What you will be able to do

• Check that impact types and criteria are defined, fit the context and are applied consistently
• Test the completeness of the activity list by tracing services, contracts and a site walk
• Distinguish a business impact analysis from a risk assessment of causes and likelihoods

Why it matters

Tests the base of every continuity plan, so an analysis with undefined ratings or missing activities is fixed before strategies and budgets rely on it.

Practice: Practice: Auditing the BIA, part 1 · 3 questions

Begins with a Dunebridge line for e-commerce returns showing a twelve-hour tolerable period, a twenty-four-hour recovery time, no capacity and one dependency called IT. Explains item d) and the maximum tolerable period of disruption read from the impact curve, then item e) and the RTO with its two tests: inside the tolerable period and at a stated minimum acceptable capacity. Uses Dunebridge's own figures for four activities and four quick checks: traceable, inside, capacity and agreed. Covers prioritised activities, resources for the first four hours, and dependencies and interdependencies. Recalls the CrowdStrike losses of about 5.4 billion dollars as a hidden dependency, and an insurer in Toronto whose claims line outran its policy system. Shows resources rising over time, three common mistakes, two worked findings and an exercise on a university in Boston.

What you will be able to do

• Check that every recovery time objective sits inside its maximum tolerable period of disruption
• Assess whether minimum acceptable capacity is stated in a way that can be measured on the day
• Compare interdependent recovery times to find contradictions between activities

Why it matters

Catches recovery times beyond what the business can tolerate and dependencies hidden behind one word, so plans are sized to real, testable targets.

Practice: Practice: Auditing the BIA, part 2 · 3 questions

Opens with a Dunebridge register of earthquake, war, pandemic and a meteor strike that misses the cold store controls only one engineer can reset, which failed twice this year. Explains the three steps of clause 8.2.3, with ISO 31000 as guidance, and why risks must link to prioritised activities and their resources. Lists risks by resource for cold-chain dispatch and a range of risk categories to prompt a register review. Separates analysis from evaluation, and shows how treat decisions feed strategies while untreated risks need a named owner. Follows one risk through decision, strategy, solution and exercise, and uses a data-centre operator in Frankfurt to show data-based likelihoods. Covers review triggers, auditor questions, evidence, two findings, three mistakes and an exercise on a media company in Paris.

What you will be able to do

• Assess whether risks of disruption are identified for each prioritised activity and its resources
• Follow one risk marked treat through the strategy and solution to an exercise
• Cite the clause where an audit trail breaks rather than the last clause that worked

Why it matters

Exposes registers of generic hazards that miss real single points of failure, so the organisation treats the risks that threaten its most urgent services.

Practice: Practice: Risk assessment of disruption · 3 questions

Begins with a Dunebridge strategy to move stock to a backup cold store three hours away, which needs at least five hours against a four-hour recovery time. Explains clause 8.3.1, strategies made of solutions and options for before, during and after a disruption, such as a partner cold store twenty minutes away. Covers the identification criteria of clause 8.3.2 and the selection criteria of clause 8.3.3, where cost comes after recovery time and risk appetite. Adds up the minutes for both options, then uses the resource types of clause 8.3.4 as a checklist, with Heathrow's terminals losing power for hours after the substation fire. Explains clause 8.3.5 implementation and maintenance, typical solutions, and an airline caterer in Hong Kong choosing a partner kitchen on cost. Ends with two findings, three mistakes and a hotel group in Chicago.

What you will be able to do

• Test a selected strategy against the recovery time by adding up each step with the people involved
• Apply the clause 8.3.4 resource types as a checklist for a selected solution
• Check that selected solutions are implemented and maintained so they can be activated tonight

Why it matters

Finds strategies that cannot meet their recovery times or exist only as unsigned drafts, so money goes to solutions that will work on the night.

Practice: Practice: Strategies and solutions · 3 questions

Starts with a Dunebridge crisis management team of five with no alternates, two of whom are away together in August when cold-chain risk peaks. Explains clause 8.4.1, plans based on selected solutions, the five qualities of procedures, and why plans built around impacts cover a cyber attack and a cloud outage alike. Covers clauses 8.4.2.1 and 8.4.2.2 with Dunebridge's crisis, site and IT recovery teams and their relationships. Walks through the eight team competences in clause 8.4.2.3, with life safety as the first priority and Dunebridge's thresholds for a formal response. Explains clause 8.4.2.4 on personnel, alternates and documented procedures, four checks for alternates including leave calendars, and a water utility in Sydney with a three-level structure. Ends with auditor questions, evidence, two findings, three mistakes and a car-parts maker in Tokyo.

What you will be able to do

• Assess whether team roles, responsibilities and relationships are clearly stated and understood
• Verify that pre-defined thresholds exist and that supervisors apply them consistently
• Test alternates for every role on authority, competence and availability against the leave calendar

Why it matters

Finds the gaps that stall the first hour of a real disruption, such as missing alternates or thresholds, so everyone knows who decides and acts.

Practice: Practice: Plans, procedures and the response structure · 3 questions

Opens with a Dunebridge warning procedure that relies on company e-mail and a contact list on the shared drive, both lost in the most likely outage, while drivers have no company e-mail. Walks through the six procedures of clause 8.4.3.1 and Dunebridge's first hour, from crisis team alert to a holding statement. Covers item a) with employees' emergency contacts, item b) with inbound calls and official weather warnings, and item c) with offline, independent channels. Explains responders, media response and the decision log, then recalls the Marks and Spencer attack to show why procedures must hold for weeks. Covers clause 8.4.3.2 alerts and coordination, and the rule that these procedures are exercised, with a call tree test reaching 106 of 120 drivers. Uses a retailer in New York with three independent channels, two findings, the difference from clause 7.4 and a bank in Singapore with no decision log.

What you will be able to do

• Test whether the means of communication still work when the main systems and network are down
• Check that inbound communications and official risk advisories are received, recorded and answered
• Verify that warning and communication procedures were exercised, including call trees and media drills

Why it matters

Catches alert procedures that fail with the systems they depend on, so staff, drivers, clients and responders hear the right message in a disruption.

Practice: Practice: Warning and communication · 3 questions

Begins with the Dunebridge cold-chain plan, whose step times add up to seven hours against a four-hour recovery time objective. Explains clause 8.4.4.1 and the four things the plans collectively contain under clause 8.4.4.2: actions within predetermined time frames, activation thresholds, delivery at agreed capacity, and managing immediate consequences for people, stock and the environment. Shows a usable threshold, such as the cold store above eight degrees for twenty minutes. Uses the eight parts of clause 8.4.4.3 as a checklist, with interdependencies, resources backed by contracts and a stand-down process, and the rule that each plan is usable and available where needed. Recalls the July 2024 CrowdStrike update, then covers clause 8.4.5 recovery from temporary measures and an insurer in London. Gives a four-step sampling method, two findings, three mistakes and a bank in Hong Kong whose plan cannot be stood down.

What you will be able to do

• Add up the steps in a continuity plan and compare the total with the recovery time objective
• Check each plan against the eight parts of clause 8.4.4.3, including the stand-down process
• Assess whether documented recovery processes return the business safely from temporary measures

Why it matters

Finds plans whose steps cannot meet the recovery time or cannot be opened on shift, so medicines, services and orders resume within the promised time.

Practice: Practice: Plans and recovery · 3 questions

Starts with Dunebridge's objective of complete success in every exercise, met by four meeting-room walkthroughs that never moved stock or switched systems. Explains the programme of exercising and testing, its purpose of validating strategies and solutions over time, and the seven things clause 8.5 requires. Describes walkthroughs, tabletop exercises, simulations and full-scale exercises, noting ISO 22398 as guidance. Builds a map of solutions to exercises, showing the hired cold store never tested, and sets four checks for formalised post-exercise reports and measurable aims. Recalls the Heathrow substation fire, affecting more than 1,000 flights, to ask whether loss of an external supply was exercised. Covers planned intervals and significant change, deputies taking part, a hospital group in Sydney that retests missed aims, two findings, why exercises that find gaps are good evidence, and a university in Boston.

What you will be able to do

• Map each continuity solution to the exercise that tested it and investigate the gaps
• Check post-exercise reports for measurable aims, actual times, honest gaps and owned actions
• Assess whether exercises followed significant changes and involved deputies as well as leaders

Why it matters

Shows whether exercises truly test the strategies or only confirm easy success, so weaknesses surface in a drill rather than in a real disruption.

Practice: Practice: The exercise programme · 3 questions

Opens with Dunebridge's telecom carrier, critical to every prioritised activity, whose continuity arrangements nobody has checked although the plan assumes a two-hour repair. Explains the five duties of clause 8.6 and when evaluations are due: planned intervals, after an incident or activation, and on significant change. Separates suitability, adequacy and effectiveness, lists the sources from reviews to post-incident reports, and shows a yearly review with one question per document. Recalls the Jaguar Land Rover attack, with around 5,000 UK organisations affected, to show supply chains run both ways. Covers four ways to evaluate a supplier and what Dunebridge found, including a four-hour carrier repair commitment. Explains legal and policy compliance, timeliness judged against risk, four checks for post-incident reports, and a bank in Frankfurt. Ends with two findings, the link to management review, three mistakes and a film studio in Los Angeles.

What you will be able to do

• Assess whether the analysis, strategies and plans were evaluated after activations and significant changes
• Check that the continuity capabilities of relevant suppliers were evaluated and the results used
• Judge whether documents were updated in a timely manner by comparing two dates against the risk

Why it matters

Exposes untested supplier assumptions and lessons never written into plans, so the continuity chain stays current and the plans can deliver.

Practice: Practice: Evaluating capabilities · 3 questions

Starts with a twenty-minute Dunebridge management review whose minutes say only BCMS fine, despite a missed recovery time in the March activation. Explains the four determinations of clause 9.1, with Dunebridge's measures such as exercise aims met, actions closed on time and contact list accuracy, and why methods and evaluation often break down. Links measures to clause 6.2 objectives and uses an insurer in Toronto tracking failover times and trained deputies. Shows how audit results reach management review, then covers clause 9.3.1 and the eleven inputs of clause 9.3.2, with the continuity inputs g) to j) checked closely. Explains outputs under clause 9.3.3.1, Dunebridge's four decisions after the audit, and clause 9.3.3.2. Gives a four-step method of who, inputs, outputs and done, tips for interviewing top management, two findings, three mistakes and a retailer in Tokyo.

What you will be able to do

• Assess whether continuity measures have valid methods, owners and evaluated results
• Check that management review covered the continuity inputs on the BIA, clause 8.6 and disruptions
• Trace one management review decision from the minutes to the result it produced

Why it matters

Shows whether top management really reviews business continuity and acts on it, so missed recovery times lead to recorded decisions and resources.

Practice: Practice: Measurement and review · 3 questions

Begins with a Dunebridge driver contact list found out of date in three audits running, each closed as list updated while the cause was never touched. Explains clause 10.1.1 improvement and the six steps of clause 10.1.2: react, find the cause, check where else it could happen, act, review effectiveness and keep actions proportionate. Uses asking why several times to trace the cause to a gap in HR's joiner and leaver process, and shows the check that found two wrong supplier numbers too. Uses the next call tree test, 118 of 120 drivers reached, as evidence the action worked. Covers clause 10.1.3 records, four sources of nonconformities, the link to audit follow-up in clause 9.2.2, and nonconformities versus opportunities for improvement. Explains clause 10.2 with a hospital in Chicago, four ways to sample actions, two findings and a bank in Paris.

What you will be able to do

• Distinguish a correction from a corrective action that removes the cause of a nonconformity
• Check that cause analysis asked where else a similar nonconformity could occur
• Verify the effectiveness of corrective action with evidence gathered after the action was taken

Why it matters

Stops the same gap returning audit after audit, so corrective actions remove real causes and the BCMS improves in a way the trend data can show.

Practice: Practice: Corrective action and improvement · 3 questions

Opens with last year's one-line Dunebridge audit plan that worked through the manual in order and never reached the cold-chain plan before the March power cut. Places planning in Figure 1 of ISO 19011:2026, the audit programme cycle and single-audit stages, then restates clause 9.2.2. Shows how importance and previous results set priorities, with an example programme grid auditing the cold chain quarterly and payroll in November, and how the programme changes after a new cold store and the March activation. Covers auditor selection, impartiality and technical experts, then objectives, scope and criteria for a cold-chain audit, with clauses named by number and title, and a hospital in Singapore. Builds the plan for the day, riskiest area first, on site or remote, and a checklist from four sources and four types. Compares weak and strong checklist lines, sets a planning exercise and lists four planning mistakes.

What you will be able to do

• Build a risk-based audit programme that weighs importance and previous audit results
• Define objectives, scope and criteria for one audit, naming each clause by number and title
• Write checklist questions that ask for a sample and lead straight to objective evidence

Why it matters

Puts audit time where a disruption would hurt most, so the riskiest continuity arrangements are examined first instead of running out of time at five.

Practice: Practice: Planning the audit programme, plan, checklist · 3 questions

Begins with a Dunebridge auditor who skipped the opening meeting and had a junior clerk send an emergency text to every driver, alarming clinics about a disruption that never happened. Explains the three purposes of the opening meeting in clause 6.4.3 of ISO 19011 and the eight points to confirm, including sampling, confidentiality and cold store safety. Walks through a ten-minute opening for the cold-chain audit with an auditor, a technical expert and a guide, and compares a weak and strong opening. Covers on-site advice from Annex A, keeping hands off generators and alert systems, permission for photos, personal data and the role of guides. Sets out remote methods from Table A.1 and four rules, with a remote supplier file review from London. Ends with seventeen qualities of a good auditor, five traits of a bad one, two interviews compared and two quick situations.

What you will be able to do

• Run an opening meeting that confirms the plan, introduces the team and checks access
• Apply on-site rules, including never operating equipment such as generators or alert systems
• Choose between on-site and remote audit methods to fit the evidence being gathered

Why it matters

Keeps an internal audit from disrupting the operations it examines, and builds the trust that makes people share what really happened.

Practice: Practice: Conducting the audit part 1 · 3 questions

Starts with a Dunebridge exercise report marked success that leads to a plan whose steps total seven hours against a four-hour recovery time objective, and explains investigating to the depth necessary. Walks through Figure 2 of ISO 19011:2026, from sources of information to audit conclusions, and the four Annex A checks: complete, correct, consistent and current. Uses a bank in Hong Kong whose green failover dashboard hid tests that never ran a transaction. Explains judgement-based and statistical sampling and the risk that samples are not representative. Covers open and closed questions, leading questions and appreciative inquiry, tell me and show me, the four roles to interview, and note taking without personal data. Follows cold-chain deliveries from the business impact analysis through risk assessment, strategies, plans, exercises and corrective action, adds guidance on context, leadership, risk and compliance, and defines a defensible sample. Ends with two quick situations.

What you will be able to do

• Verify information as complete, correct, consistent and current before accepting it as evidence
• Choose and record a fair sample sized to risk, and state its limits in the report
• Follow one prioritised activity from the BIA through plans and exercises to corrective action

Why it matters

Turns what auditees say into verified evidence and reveals gaps that clause-by-clause ticking misses, such as a seven-hour plan behind a four-hour RTO.

Practice: Practice: Conducting the audit part 2 · 3 questions

Begins with sharing findings as you go and reviewing each nonconformity with the auditee, and explains the 2026 change: acknowledgement that the evidence is accurate and the nonconformity understood, not acceptance, with diverging opinions recorded. Covers generating findings, quantitative and qualitative grading, and Sterling's major and minor grading, noting these are not terms of ISO 22301 or ISO 19011, with four graded Dunebridge examples. Explains opportunities for improvement and good practice with a water utility in Sydney, and four nonconformities that will not stand. Sets out the four parts of a nonconformity from Annex A, two worked examples on the seven-hour cold-chain plan and the e-mail alert procedure, and weak and strong statements compared. Covers the closing meeting in clause 6.4.10, the report contents in clause 6.5.1, reporting under clause 9.2.2, reviewing responses, four ways follow-up fails and a bank in Toronto blaming a clerk.

What you will be able to do

• Write a nonconformity in four parts: criteria, evidence, statement and grade
• Grade findings as major or minor using defined criteria, not the seniority of the auditee
• Review a corrective action response and close it only on evidence that the action works

Why it matters

Produces findings management cannot argue with and acts on, and follow-up that closes gaps for real instead of on a promise or an edited plan.

Practice: Practice: Findings, report and follow-up · 3 questions

Sets out an effective internal audit in six steps: start from the standard, understand the context and previous results, check documents against real work, test objectives, competence and awareness, review plans, exercises and corrective action, and close properly. Then runs a practice audit of how ready Dunebridge's fleet team is for a disruption, by an HR adviser independent of the area, against clauses 7.2, 7.3, 8.4.3.1 and 8.5. She follows one high risk, drivers not reached, interviews eight drivers and samples training records and call tree tests. She writes two minor nonconformities in four parts, records an opportunity for improvement on a two-page plan card and a good practice of mentored new drivers, and verifies the actions after sixty days. Covers where internal audits go wrong, the course takeaways, a quick check on ISO 19011, grading and MTPD, naming clauses, the thirty-question exam and the first audit.

What you will be able to do

• Apply a six-step method to plan, conduct and close a BCMS internal audit of one area
• Follow one high risk end to end and record conformities as well as nonconformities
• Plan a first internal audit in an area that is not your own, with findings followed up

Why it matters

Leaves learners ready to run a real internal audit to ISO 22301:2019, with a tested method, and prepared for the final exam and Certificate of Competence.

Practice: Practice: A practice audit and the exam · 3 questions