ISO 22301 Recertification Audit: The Complete 2026 Guide

An ISO 22301 recertification audit is the full-system audit your certification body runs in the third year of the cycle to renew your business continuity management system (BCMS) certificate before it expires. It is not a bigger surveillance visit. The auditor looks back over three years of continuity performance, decides whether the BCMS still fits the business you are today, and then recommends a new three-year certificate or does not.

This guide sets out what the rules require, how the renewal differs from the two surveillance audits before it, how audit time is set, the deadlines that decide whether the certificate lapses, and what BCMS auditors test at renewal. Clause references come from ISO/IEC 17021-1:2015, the accreditation standard every accredited certification body works to, and from ISO 22301:2019 itself.

What an ISO 22301 recertification audit is

Every accredited ISO 22301 certificate runs on the three-year program in ISO/IEC 17021-1 clause 9.1.3.2: a two-stage initial audit, surveillance audits in years one and two, and a recertification audit in year three, before the certificate expires. A positive recertification decision starts a new three-year cycle.

Clause 9.6.3.1.1 says the recertification audit is planned and conducted to evaluate “the continued fulfilment of all of the requirements” of the management system standard. That word “all” is the difference. Surveillance samples; recertification covers the whole BCMS against the whole certified scope. The certification body also performs a review of system performance over the cycle, including all previous surveillance audit reports (clause 9.6.3.1.2).

Certification bodies that audit a BCMS also apply ISO/IEC TS 17021-6:2014, which sets competence requirements for BCMS auditors, covering topics such as business impact analysis, continuity strategies, incident response and exercising. It adds competence rules on top of 17021-1; it does not change the audit cycle.

If you have not been certified yet, start with our guide to how ISO 22301 certification works. This post assumes you hold a certificate and want to keep it.

ISO 22301 recertification audit vs surveillance audit

Our ISO 22301 surveillance audit guide covers the annual visits. The renewal differs in scope, time window and consequence.

Aspect	Surveillance audit (years 1 and 2)	Recertification audit (year 3)
Coverage	Sampled areas, not necessarily the full system (17021-1 clause 9.6.2.2)	All ISO 22301 requirements across the whole certified scope (9.6.3.1.1)
Time window	Mainly the last 12 months	Performance over the whole three-year cycle
Inputs	Previous findings, changes, internal audit, management review	All previous surveillance reports, plus everything above (9.6.3.1.2)
Stage 1	Not applicable	Only when there have been significant changes (9.6.3.1.3)
Typical audit time	About one-third of the initial audit time	About two-thirds of a fresh initial audit, recalculated today
Open major nonconformity	Deadline set by the certification body’s procedure	Must be corrected and verified before the certificate expires (9.6.3.2.2)
Outcome	Certificate maintained, or suspended in serious cases	A new three-year certificate, or no renewal

The practical difference: a surveillance audit asks whether your continuity arrangements still work. The recertification audit asks whether they have worked for three years, and whether they still match the organization’s current products, sites, suppliers and risks.

What the auditor must assess at renewal

ISO/IEC 17021-1 clause 9.6.3.2.1 sets three questions that every recertification audit has to answer:

• Effectiveness across the scope. Is the BCMS effective in its entirety, taking account of internal and external changes, and is the scope of certification still relevant and applicable?
• Commitment. Has top management shown commitment to maintaining the effectiveness and improvement of the BCMS?
• Results. Is the system contributing to your business continuity policy and objectives?

For a BCMS, those three questions become specific evidence requests. Expect the auditor to pick a prioritized activity, trace it from the business impact analysis (ISO 22301 clause 8.2.2) to its recovery time objective, through the strategy and solution chosen under clause 8.3, into the plan under clause 8.4, and then to the exercise under clause 8.5 that proved the plan works. Any break in that chain is where a finding lands.

How long an ISO 22301 recertification audit takes

IAF MD 5, the mandatory document on audit time, is written for quality, environmental and occupational health and safety systems. Its section 0.5 says elements of it, such as audit time duration, may be used for other ISO/IEC 17021-1 schemes. There is no published BCMS audit-day table in MD 5, so each certification body sets ISO 22301 audit time through its own documented method, and most borrow the MD 5 principles.

The principle that matters at renewal is in IAF MD 5 section 6: recertification time is normally about two-thirds of the time an initial audit (stage 1 plus stage 2) would take if it were carried out at the time of recertification. It is not two-thirds of the days you were originally quoted. If you have added sites, staff or critical services since initial certification, the base number grows before the two-thirds is applied. The same section says a recertification audit is unlikely to be less than one audit day.

Initial audit recalculated today (stage 1 + stage 2)	Recertification at about two-thirds	Illustrative profile
3 audit days	2 days	Single site, small team in scope
6 audit days	4 days	Single site, a few hundred people, several critical services
9 audit days	6 days	Multi-site or complex supply chain
12 audit days	8 days	Large multi-site scope with outsourced recovery sites

Treat the table as arithmetic on the two-thirds principle, not a published entitlement. Typical ranges vary by certification body. What you can ask for is the documented basis of the calculation: if the quote went up, the reason should be in the updated client information, not in a price list.

The deadlines that decide whether your certificate lapses

Most failed renewals are timing failures, not system failures. The rules in ISO/IEC 17021-1 are short and strict:

Situation	What happens (ISO/IEC 17021-1)
Audit done and all major nonconformities closed before expiry	New certificate; its expiry date can be based on the previous expiry date, so you keep your anniversary (9.6.3.2.3)
Audit done but a major nonconformity still open at expiry	Recertification is not recommended and the validity of the certificate is not extended (9.6.3.2.2, 9.6.3.2.4)
Certificate expired; outstanding activities completed within 6 months	The certification body can restore certification; the effective date is on or after the recertification decision (9.6.3.2.5)
More than 6 months after expiry	At least a stage 2 audit is required (9.6.3.2.5)

The restore route has a gap. Between expiry and restoration you hold no valid certificate. If a customer contract, an outsourcing agreement or a public tender requires a current ISO 22301 certificate, that gap is the commercial risk, even when the audit itself goes well.

Work back from the expiry date on your certificate. A typical plan looks like this:

Months before expiry	Action
6	Confirm audit dates and audit days; decide whether to stay with your certification body or switch
5	Review scope, products and services, sites and key suppliers; tell the certification body about significant changes
4	Run a full internal audit of clauses 4 to 10
3	Hold a management review that covers the whole cycle, not just the last year
2 to 3	Recertification audit
1 to 2	Close nonconformities, submit evidence, allow time for the certification decision

Two to three months between the audit and expiry is the margin that lets you close a major nonconformity without losing the certificate. Shrink it and you are betting the audit finds nothing serious.

When the ISO 22301 recertification audit needs a stage 1

Clause 9.6.3.1.3 of ISO/IEC 17021-1 says a recertification may need a stage 1 audit where there have been significant changes to the management system, the organization, or the context in which the system operates, for example changes to legislation. For a BCMS, the usual triggers are an acquisition or divestment, a move to a new cloud or data center provider, new outsourced operations such as a call center, or new countries in scope.

Regulation counts as context too. Financial-sector firms in the EU now work under the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025 and carries its own ICT business continuity requirements. If your clause 4.1 context and clause 4.2 legal requirements still describe the position at initial certification, expect the auditor to ask why.

Is there a new edition to transition to?

Not yet, so your ISO 22301 recertification audit will be against the same edition. The current edition is ISO 22301:2019, amended in February 2024 by Amendment 1, which added a requirement to determine whether climate change is a relevant issue (clause 4.1) and a note that interested parties can have climate-related requirements (clause 4.2). If your current cycle began before that amendment, the recertification audit may be the first full-system audit to check it, so make sure your context analysis records a decision either way.

ISO/TC 292 is revising the standard. The committee draft ballot (ISO/CD 22301) closed in May 2026, which is an early stage. No new edition has been published, so for most renewals in 2026 and 2027 there is no edition transition to plan around. Check the status again before your next cycle.

Where ISO 22301 recertification audits find nonconformities

Findings at an ISO 22301 recertification audit cluster in five places, all specific to continuity:

• A business impact analysis that stopped moving. Clause 8.2.2 requires the BIA to be maintained. A BIA dated three years ago, unchanged through a product launch or platform migration, is the most common finding at any BCMS audit. Our business impact analysis guide shows what a maintained one looks like.
• Exercises that never covered the whole program. Clause 8.5 requires a program of exercises that validates, over time, your strategies and solutions. Over a full cycle, an auditor expects coverage of the plans that matter most, not the same tabletop run three times.
• Evaluation without updates. Clause 8.6 requires you to evaluate your BIA, risk assessment, strategies, plans and procedures and update them when needed. The auditor wants to see real incidents and exercises leading to changed plans.
• Recovery solutions that no longer meet the BIA. If the BIA now demands a four-hour recovery and the solution under clause 8.3 still takes two days, that gap is a nonconformity.
• Internal audits that never covered the full scope. Clause 9.2 requires an internal audit program. Over three years, every clause and every in-scope site should have been covered. Our ISO 22301 internal audit checklist works clause by clause.

How to prepare for your ISO 22301 recertification audit

1. Collect the cycle’s evidence. All three management review records, all internal audit reports, every exercise report, and every post-incident review since the last certification decision.
2. Close the loop on previous findings. Every nonconformity from the initial and surveillance audits should show root cause, corrective action and your own check that it worked (clause 10.1).
3. Re-baseline the BIA and risk assessment. Update them for current products, services, suppliers and sites before the audit, not during it.
4. Check scope and public claims. Your certificate scope, website and tender documents should describe the same boundary.
5. Tell the certification body about changes early. Significant changes can add a stage 1 and change the audit days, so they belong in the planning conversation at month six.

If your document set has drifted over the cycle, the ISO 22301 Toolkit provides 88 editable templates for the BCMS documents and records a renewal audit samples.

FAQ

How often is an ISO 22301 recertification audit required?

Every three years. ISO/IEC 17021-1 sets a three-year certification cycle, and the recertification audit must be completed, with any major nonconformities closed, before the certificate’s expiry date.

Can we change certification body before an ISO 22301 recertification audit?

Yes. Many organizations switch at the end of a cycle. The new certification body follows the accreditation rules on transfer of certification and reviews your previous audit reports and open findings, so start that conversation at least six months before expiry.

What happens if we miss the expiry date?

The certificate lapses on its expiry date. If the outstanding recertification activities are completed within six months, the certification body can restore certification, but you hold no valid certificate in the gap. After six months, at least a stage 2 audit is required.

Is the ISO 22301 recertification audit cheaper than the initial audit?

Usually. Audit time is normally about two-thirds of what an initial audit would take today, and there is no stage 1 unless there have been significant changes. Growth in sites or scope since initial certification can offset that saving.