ISO 22301 Business Continuity
ISO 22301 consulting: what a consultant does and when you can do without one
A consultant builds your business continuity management system with you, usually over several months and at a day rate. If your company already knows its critical activities and has tested plans, the Zertify self-assessment can lead to the certificate without a consulting project. It consists of 34 yes/no questions, and no on-site audit takes place.
01: Decision
Do you need a consultant for ISO 22301?
The standard does not require one. ISO 22301:2019 sets the requirements for a business continuity management system (BCMS). Who writes the analysis, the plans and the exercise reports is up to you.
A consultant saves time when nobody in the company has run a business impact analysis before. If you already have recovery plans for IT and someone who leads in a crisis, you probably have most of the substance. What is often missing is the evidence that a bank, an insurer or a purchasing department asks for in a supplier questionnaire.
Two questions decide the matter. Do you know which activities must continue after a failure, and how long each one can stand still? And has a continuity plan been tested in your company within the last year? If both answers are yes, a consultant is optional.
02: Scope
What do ISO 22301 consultants actually do?
A typical project follows the logic of the standard from planning to operation to evaluation. The work is mostly interviews, analysis and writing.
- Business impact analysis
- Interviews with department heads, a ranking of activities and the maximum downtime each one can tolerate.
- Recovery objectives
- RTO and RPO per activity, checked against what your IT and your suppliers can really deliver.
- Risk assessment
- Scenarios such as an IT outage, a supplier failure, a fire or a pandemic, with decisions on how to treat each risk.
- Strategies and plans
- Continuity plans and a crisis organisation with roles, contact lists and decision rules.
- Exercises
- Planning and moderating a tabletop exercise, writing the report and listing the improvements.
- Evaluation
- Internal audit and management review as required by clause 9, and the improvement actions from clause 10.
03: Cost
Indicative day rates and project size
Rates and effort differ by provider, region and company size. The figures below are indicative ranges, not offers.
| Item | Indicative range | Depends on |
|---|---|---|
| Day rate, Switzerland | CHF 1'200 to 2'000 | Seniority and specialisation |
| Day rate, Germany, Austria, France | EUR 900 to 1'600 | Region and provider |
| Consulting days | 10 to 30 days | Number of sites and critical activities |
| Consulting budget in total | CHF 12'000 to 60'000 | Days multiplied by day rate |
| Elapsed time | 3 to 9 months | How much your own team can contribute |
These figures cover the consultant only. The classic route with an on-site audit by a certification body adds audit fees on top, which also vary by provider.
04: Zertify
How the Zertify self-assessment replaces a consulting project
Zertify issues the ISO 22301 certificate under licence from SICE. The basis is an online self-assessment, and no auditor visits your premises. SICE reviews every assessment before the certificate is issued.
The route has four steps.
Answer 34 yes/no questions
13 of them are must-meet questions and all must be answered yes. They are the core questions of the assessment, not every requirement of the standard.
Reach 14 yes answers among the other 21
Together with the 13 must-meet questions, this passes the assessment.
Pay without opening an account
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years.
Receive the certificate
It arrives within 4 hours after passing and payment. The PDF carries a QR code, and anyone can verify the certificate by its number on the public verification page.
Billing runs as an automatic yearly subscription. You can cancel at any time in the customer account, to the end of the current year. If you cancel, the certificate ends with the paid year. Two standards together get 20% off, three or more get 30%, and the discount also applies to the yearly fee. For customers in Switzerland and Liechtenstein the prices include 8.1% Swiss VAT.
05: Preparation
What to have ready before you answer the questions
The self-assessment checks whether your BCMS exists. It does not build one for you. Gather the following, and most questions can be answered in a single sitting.
- Critical activities
- A ranked list with a recovery time objective and a recovery point objective for each.
- Risk assessment
- The disruption scenarios you considered and what you decided to do about them.
- Continuity plans
- Written steps for IT outages, supply shortages, fires and pandemics, with named people.
- Crisis organisation
- Who decides, who informs customers and how the team is reached when systems are down.
- Exercise record
- The date, the scenario, what went wrong and what you changed afterwards.
06: Limits
When a consultant still makes sense
If you answer no to several must-meet questions, those gaps have to be closed before the certificate can be issued. You can use the questions as a checklist and work through them yourself. Or you can hire a consultant for a few days on one task, such as the impact analysis workshop or the first exercise, instead of a full project.
Some tenders and customers name the route explicitly, for example an on-site audit by a certification body. Check the wording in the tender or the supplier requirements before you decide. The route guide compares both options.
07: FAQ
Questions about ISO 22301 consulting
No. The standard defines requirements for the management system, not who prepares it. A company with its own know-how can build the BCMS internally and use the Zertify self-assessment to get the certificate.
Indicatively, day rates in Switzerland lie between CHF 1'200 and 2'000, and a small business needs 10 to 30 consulting days. That puts the total at roughly CHF 12'000 to 60'000. Quotes vary widely, so ask for the scope in days.
Yes, if your continuity management is already in place. You answer 34 yes/no questions online, and the 13 must-meet questions must all be answered yes. The certificate follows within 4 hours after passing and payment.
Then no certificate is issued. The assessment is free and needs no registration, so you can see which questions are not yet met. You can close those gaps yourself or with a consultant for a few days.
Mostly IT and cloud service providers, suppliers to banks and insurers, logistics companies and manufacturers in supply chains. Healthcare, energy supply and outsourcing providers are also asked. The request usually arrives as a line in a supplier questionnaire or a tender.
08: Guide
Related pages
Check where your business continuity stands
Answer the 34 questions and see whether your company already meets ISO 22301 without a consulting project.
Free and without registration.