Evalian holds ISO 9001, ISO 27001 and ISO 22301 certification. We know the standard inside out because we operate within it every day. Based on our wealth of experience, we will ensure that you are fully prepared and rehearsed for your certification audits.
You will not be rotated through various people. You will be assigned a consultant for the duration of your engagement, with a single point of escalation. Your consultant will help you stay on track to meet your target dates and provide week-on-week reporting against progress with clear targets.
Some organisations need a gap analysis and nothing more. Others need support to build and run their entire Business Continuity Management System or with their internal auditing. We scope the engagement around your situation rather than sell you a fixed "cookie-cutter" package.
Certification isn't a finish line, it's a milestone. We help you maintain and improve your BCMS as your organisation grows and changes. Our focus is on controls, policies and processes that support the way your business actually works, without layering on unnecessary paperwork.
UNDERSTANDING THE STANDARD
ISO 22301 is the international standard for Business Continuity Management Systems (BCMS). It provides a structured framework for identifying threats to an organisation’s operations, assessing their potential impact, and putting in place the plans, processes and capabilities to respond and recover.
ISO 22301:2019, has a sharp focus on risk, clear language around leadership responsibilities, and clos alignment with other ISO standards, making it easier to implement alongside ISO 27001 or ISO 9001.
An accredited certification body awards certification following an independent audit. It demonstrates to clients, insurers, regulators and supply chain partners that your organisation has tested plans in place.
CERTIFICATION BENEFITS
A well-implemented BCMS is not a compliance exercise. It is an operational asset that earns its keep before the disruption arrives.
For organisations in regulated sectors, the ISO 22301 standard provides documented evidence of operational resilience planning that satisfies FCA, ICO and sector-specific requirements far more convincingly than a policy document alone.
For many organisations, ISO 22301 starts as a compliance requirement. In practice, it delivers far more than certification. A well-designed Business Continuity Management System (BCMS) helps reduce operational risk, improve resilience, and give stakeholders confidence that critical services can continue during disruption.
Working with experienced ISO 22301 consultants helps you achieve these outcomes faster, while avoiding common implementation challenges that can delay certification or create unnecessary administrative burden.
We scope every engagement individually. Below is the full menu of what we can provide, whether you need all of it or just part.
 | Gap analysis and readiness assessment We assess your current compliance against ISO 22301 requirements and produce a bespoke report with a prioritised action plan. |
| BCMS design and scoping We define the scope of your Business Continuity Management System, interested parties, context of the organisation, and strategic objectives. |
 | Business impact analysis and risk assessment End-to-end business continuity approach that includes scoping, business impact analysis, risk identification, assessment and treatment, business continuity planning and testing. |
 | All policies, procedures and mandatory documents Our specialised consultants draft all policies, processes, procedures, and templates required to achieve the successful implementation of fully documented BCMS within the agreed scope. |
 | Employee awareness and training sessions Certification requires staff to understand their roles within the BCMS. We deliver awareness sessions and can tailor training to specific departments or functions. |
 | Certification body selection and liaison We help you select a UKAS-accredited certification body suited to your sector and size, and manage the relationship through to your initial audit. |
 | Internal auditing against ISO 22301 Regular internal auditing is a mandatory requirement of the standard. We conduct independent audits on a one-off or scheduled basis and report findings to management. |
 | Pre-certification assessment If you've implemented your BCMS internally, we provide an independent review before the certification audit, giving you confidence before the assessor arrives. |
 | Management review support ISO 22301 requires formal management reviews at planned intervals. We facilitate and document these reviews and ensure outputs meet the requirements of the standard. |
 | Certification audit support We support you through Stage 1 and Stage 2 certification audits, attending where appropriate, answering assessor questions, and addressing any nonconformities raised. |
 | Surveillance & recertification audit preparation We help you prepare for the annual surveillance audits and three-yearly recertification required to maintain your ISO 22301 certificate. |
 | Exercise & testing facilitation We design and run tabletop exercises and scenario-based tests of your business continuity plans, ensuring your documented procedures hold up in practice and not just on paper. |
 | Remote BCMS management If you don't have the internal resource to manage your BCMS after certification, we can take on that role. Your lead consultant operates as an extended member of your team. |
 | Ongoing document and policy maintenance Organisations change. We keep your BCMS documentation aligned with how your business actually operates, updating policies, procedures and records as your scope evolves. |
 | Incident management support If an incident occurs between audits, your consultant is available to support the response, help activate the business continuity plan, and document the event in line with standard requirements. |
 | Regular progress reporting Every client on a managed service receives written progress reports from their lead consultant. You always know where you stand — and so does your board. |
 | Integrated management system support If you hold ISO 27001 or ISO 9001 alongside ISO 22301, we can align the three management systems, sharing audit schedules, management reviews and documentation wherever the standards permit. |
 | No hidden costs Traditional day-rate consulting or additional support hours options. We work with a transparent pricing model, no costly surprises. |
Achieving ISO 22301 certification doesn’t need to be complicated. Our ISO 22301 consulting process provides a structured route from initial assessment through to certification and long-term business continuity improvement. Our consultants guide you through every stage of the process, providing practical support that aligns with your organisation’s objectives, existing processes, and available resources.
We begin with an initial consultation to understand your organisation, business continuity objectives, regulatory requirements, and existing resilience arrangements. This allows us to identify your priorities and recommend the most effective route to ISO 22301 certification.
Our ISO 22301 consultants assess your current business continuity practices against the requirements of the standard. We identify areas of compliance, highlight gaps, and provide a clear roadmap for achieving certification.
Next, we establish the scope of your Business Continuity Management System (BCMS), identify key stakeholders, and develop a practical implementation plan. This stage ensures the project remains focused, achievable, and aligned with your business objectives.
We work alongside your team to develop the policies, procedures, risk assessments, Business Impact Analysis (BIA), business continuity plans, and supporting documentation required by ISO 22301. Our approach focuses on creating a BCMS that works in practice, not just for audit purposes.
Before certification, we conduct an independent internal audit and readiness assessment to evaluate the effectiveness of your BCMS. Any findings are addressed before the external audit, helping to reduce risk and improve confidence.
We provide support throughout the certification audit process, helping your team prepare for auditor questions and evidence requests. Following certification, we can continue to support annual reviews, internal audits, management reviews, and continual improvement activities to ensure your BCMS remains effective as your organisation evolves.
Either is a perfectly good reason to get in touch. A thirty-minute call with one of our consultants will give you a clear picture of where you stand, what you need, and what it would take to get there.
Our expert consultants can demystify the requirements and help you become and remain certified. We’ll roll up our sleeves and get stuck in as an extended member of your team.
If you need help implementing ISO 22301 from experienced consultants, then we’re the perfect fit for you.
No obligation. Just a straightforward conversation.
CLIENTS WE'VE SUPPORTED WITH ISO CONSULTANCY
“Our Evalian consultant was always approachable, patient, and willing to answer all of our questions, which made what could have been a complex process much more manageable. His knowledge and professionalism really stood out. I would highly recommend Evalian to any organisation looking to achieve ISO certification.”
– Collective Society
“Evalian provided excellent support throughout our ISO 27001 and ISO 9001 implementations. Consistently professional, offering valuable insight and guidance before, during, and after the certification process.”
– Brabners
“Thanks to Evalian and Tom’s support, we obtained certification on schedule. I would highly recommend them to any organisation pursuing ISO Standards.”
– Knight Group
“Our Evalian consultant was very knowledgeable and took the time to explain things clearly and practically. The meetings and support provided were tailored depending on what support was needed. Excellent communication throughout the process.”
– Sue Solutions
Consultants available
remotely and on-site
across the UK
Named lead consultant
assigned to your project
from day one
Things people ask before they get in touch.
ISO 22301 consulting provides expert guidance throughout the certification journey, helping you understand the requirements of the standard, identify gaps, develop the necessary documentation, and implement an effective Business Continuity Management System (BCMS). Working with experienced consultants can accelerate implementation, reduce internal resource demands, and improve your readiness for certification audits.
A Business Impact Analysis (BIA) is a structured process used to identify your organisation’s critical products, services, activities, and dependencies. It assesses the operational, financial, legal, and reputational impact of disruption and helps determine recovery priorities. The BIA forms a key part of ISO 22301 and provides the foundation for effective business continuity planning.
Recovery Time Objective (RTO) is the maximum acceptable time it should take to restore a business process, system, or service following a disruption.
Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time. For example, an RPO of four hours means the organisation can tolerate losing up to four hours of data in the event of an incident.
Together, RTOs and RPOs help organisations define recovery requirements and continuity priorities.
Our approach combines practical business continuity expertise with hands-on implementation support. Unlike many consultants, we hold ISO 22301 certification ourselves and understand the realities of maintaining a compliant and effective BCMS. We provide tailored support, transparent pricing, named consultants, and ongoing guidance beyond certification to help organisations build genuine resilience rather than simply achieve compliance.
It varies significantly depending on the size and complexity of your organisation, how much existing documentation you have, and how quickly your internal stakeholders can commit time to the process. For a focused SME starting from scratch, a realistic timeframe is four to eight months from kick-off to certification audit. Larger organisations with more complex operations or multiple sites typically take longer. We will give you a realistic estimate after an initial conversation about your circumstances, not a number designed to win the work.
Not necessarily. Our gap analysis will assess what you already have against the requirements of ISO 22301:2019 and identify what is usable, what needs updating, and what is missing. Clients who come to us with existing business continuity documentation often find that significant portions can be carried forward, though it is not unusual for a gap analysis to uncover areas that looked complete on paper but would not survive the scrutiny of a certification audit.
The gap analysis is the right starting point regardless.
ISO 27001 covers information security. ISO 22301 covers business continuity more broadly — including your ability to maintain critical operations during disruptions that have nothing to do with information security, such as supply chain failures, loss of key staff, or a crisis at a critical supplier.
Many organisations hold both standards.
Because they share a common High Level Structure, maintaining the two together is considerably less burdensome than maintaining either in isolation, and a combined audit approach with the right certification body can reduce your overall compliance overhead.
We support integrated implementations and can advise on whether pursuing both makes sense for your organisation.
The certification body needs to be accredited by UKAS (United Kingdom Accreditation Service) for the certificate to carry international recognition.
Beyond accreditation, the practical considerations include sector experience, the assessor assigned to your account, cost, and how the certification body approaches the relationship after certification, particularly for surveillance and recertification audits.
We have experience across multiple certification bodies and can advise on the options suited to your sector and the nature of your organisation. We also make the initial approach on your behalf and manage the relationship through to your audit.
Read our guide to choosing an ISO certification body here.
We bill by the day or with additional hours. But the total cost of an implementation project depends on the size and complexity of your organisation, your starting point, and the level of hands-on involvement you need from us.
We do not publish fixed package prices because we do not sell fixed packages; we scope the work to what you actually need. The first step is a free consultation call where we get a clear picture of your organisation and give you an honest estimate of what is involved and what it is likely to cost.
Yes. Certification is not a one-time event; ISO 22301 requires annual surveillance audits and a full recertification audit every three years.
It also requires ongoing internal auditing, management reviews, and active maintenance of the BCMS as your organisation changes.
We offer ongoing managed service arrangements where your named consultant takes care of this on your behalf, as well as lighter-touch options for organisations that want to manage the system internally with periodic consultant support.
We’ll recommend the model that fits the size of your team and the complexity of your management system.
ISO 22301 helps your organisation prepare for disruption, protect critical services, and give clients, regulators, and stakeholders confidence in your resilience. With expert ISO 22301 consulting, you can build a practical BCMS, reduce implementation pressure, and move towards certification with greater clarity and confidence.