ISO 22313 Business Continuity Guidance Application Training Course

Course overview

Business continuity teams are often asked to produce plans that look complete but cannot be activated under pressure. Recovery priorities may be unclear, business impact analysis (BIA) data may be outdated, and incident response, crisis communications and IT recovery arrangements may not align. ISO 22313 provides practical guidance for applying a business continuity management system (BCMS), helping organisations translate continuity policy into tested capabilities that protect people, critical services, regulatory obligations and operational resilience.

This course shows participants how to apply ISO 22313:2020 guidance alongside the requirements of ISO 22301:2019. Participants learn to define BCMS scope, map interested parties, conduct BIA interviews, set maximum acceptable outage and recovery objectives, assess disruption risks, select continuity strategies, write actionable response and recovery plans, and establish an exercising and continual-improvement programme. Particular attention is given to evidence, ownership, escalation criteria and management reporting needed to make continuity arrangements defensible and usable.

Instruction combines facilitated analysis of a realistic disruption scenario with structured workshops, peer review and practical templates. Participants work through the design of a BCMS for a case organisation, using BIA worksheets, risk registers, strategy option matrices, plan structures and exercise evaluation records. They leave with an ISO 22313 application pack: a documented BCMS implementation roadmap, a draft BIA and recovery-priorities register, and an action plan for improving their own organisation's continuity arrangements.

The course is suited to professionals who already work with operational risk, emergency preparedness, health and safety, information security, resilience or management systems and now need to lead or strengthen an evidence-based business continuity programme.

Course objectives

By the end of this course, participants will be able to:

• Interpret ISO 22313:2020 guidance and relate it to ISO 22301:2019 BCMS requirements
• Define BCMS scope, organisational context, interested parties and continuity governance arrangements
• Conduct a business impact analysis using impact categories, MTPD, RTO and RPO criteria
• Build a disruption risk register that links threat scenarios to critical activities and dependencies
• Evaluate continuity strategy options using resource, cost, recovery capability and residual-risk criteria
• Draft incident response, crisis communication and business recovery plan components with clear activation triggers
• Design a business continuity exercise programme with objectives, injects, observers and evaluation records
• Produce an ISO 22313-aligned BCMS implementation roadmap with ownership, milestones and evidence requirements

Benefits of attending

Target competencies

Who should attend

• Business Continuity Managers — who must establish, improve or coordinate an ISO-aligned BCMS
• HSE Managers — who need continuity arrangements integrated with emergency preparedness and organisational resilience
• Risk Managers — who assess operational disruption exposure and require defensible recovery priorities
• Resilience and Emergency Planning Officers — who develop response structures, exercises and recovery procedures
• Information Security and IT Service Continuity Managers — who must align technology recovery objectives with business needs
• Internal Auditors and Management System Leads — who assess BCMS design, implementation evidence and improvement actions

Requirements and prerequisites

Participants should understand their organisation's core services, operational processes and basic risk-management terminology, including likelihood, consequence, controls and risk treatment. Prior exposure to business continuity, emergency response, incident management, ISO management systems or internal auditing is helpful because the course works at an intermediate to advanced level. Participants should be able to read process maps and use spreadsheet templates for BIA and risk-register exercises. No prior certification in ISO 22301 or ISO 22313 is required, and no specialist continuity-planning software or coding knowledge is needed.

Training methodology

The instructor uses ISO 22313 clauses and guidance notes as working material, then demonstrates how each element becomes an operational BCMS artefact. Participants analyse a disruption case involving facility loss, supplier failure and technology outage; conduct BIA and risk workshops; compare recovery strategies; and draft plan sections using supplied templates. Small-group reviews test whether priorities, dependencies, triggers and communications are workable. On the final day, each participant converts the case learning into a phased application plan for their own organisation.

Course outline

Day 1: ISO 22313 foundations and BCMS context

• Purpose, structure and application of ISO 22313:2020 guidance
• Relationship between ISO 22313 guidance and ISO 22301:2019 requirements
• Business continuity principles, lifecycle and management-system approach
• Organisational context, interested parties and continuity obligations
• BCMS scope boundaries across services, sites, subsidiaries and outsourced activities
• Leadership, policy, accountability and business continuity governance
• Documented information, evidence control and BCMS performance reporting

Workshop: Participants define the BCMS context, scope statement, interested parties and governance roles for the case organisation.

Day 2: Business impact analysis and disruption risk assessment

• Critical activity identification and service delivery mapping
• BIA interview planning, stakeholder selection and evidence gathering
• Impact categories for people, safety, legal, financial, reputational and environmental consequences
• Maximum tolerable period of disruption and maximum acceptable outage determination
• Recovery time objective and recovery point objective setting
• Internal and external dependency analysis for people, facilities, suppliers and technology
• Disruption scenario assessment and continuity risk-register construction

Workshop: Participants complete a BIA worksheet and disruption risk register for two critical services, including justified recovery objectives.

Day 3: Continuity strategies and resource requirements

• Using BIA outputs to establish recovery requirements
• Strategy selection criteria for resilience, cost, speed and residual risk
• Work-area recovery options including remote work, alternate sites and manual workarounds
• Technology continuity options including backup, replication, failover and restoration sequencing
• Supply-chain continuity and alternative supplier arrangements
• People resilience, succession, cross-training and welfare considerations
• Resource capability assessment and continuity strategy business cases

Workshop: Participants develop and score a continuity strategy options matrix, then recommend a funded recovery approach to the case leadership team.

Day 4: Response, recovery and exercise design

• Incident escalation thresholds and business continuity plan activation criteria
• Crisis management, incident response and business recovery role structures
• Command, control and decision-log arrangements
• Crisis communication protocols for staff, customers, regulators and suppliers
• Business recovery plan content, task sequencing and handover criteria
• Exercise types: walkthroughs, table-top exercises, simulations and live tests
• Exercise objectives, scenario injects, observer guides and after-action reporting

Workshop: Participants draft an activation-and-recovery plan section and run a table-top exercise using timed scenario injects.

Day 5: Performance evaluation and organisational application

• BCMS monitoring measures, indicators and management-review inputs
• Internal audit evidence for ISO 22301-aligned continuity arrangements
• Nonconformity, corrective action and continual-improvement methods
• Maintaining BIA data through organisational and change-management triggers
• Plan maintenance schedules, ownership reviews and document-control practices
• BCMS implementation sequencing, milestones and resource planning
• Management presentation of continuity gaps, priorities and investment decisions

Workshop: Participants produce an ISO 22313 application roadmap containing priority actions, accountable owners, milestones, evidence and management-reporting measures.

Tools & standards covered

ISO 22313:2020, ISO 22301:2019, Microsoft Excel, Microsoft Visio

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions