ISO 22301 Business Continuity
ISO 22301 for financial services
Banks and insurers want proof that their suppliers keep running when systems, providers or premises fail. ISO 22301 gives you that proof in a form a purchasing department recognises. With Zertify you answer 34 questions online and receive the certificate within 4 hours after passing and payment.
01: Demand
Why clients and partners ask financial firms for ISO 22301
A bank or insurer that outsources a function remains responsible for it. When the supplier stops, the client's own service stops too. That is why the supplier questionnaire asks early: do you have a business continuity management system, and can you show it?
The question reaches well beyond large institutions. Fiduciaries, independent asset managers, payment and fintech providers, software vendors for banks and back-office service providers meet it in tenders and in the yearly due diligence run by the client's purchasing department. A certificate with a number and a QR code answers it in one line instead of a twenty-page reply.
ISO 22301:2019 fits because it asks what a client actually cares about. Which activities are critical? How long may they be down? How much data may be lost? Have the plans ever been tested?
02: Risks
Which processes and risks in financial services does ISO 22301 address?
Financial services depend on a few activities that cannot stop for long. The standard makes you name them and plan for their failure. Typical examples:
- Payment processing
- Payment runs, card authorisation and account transfers rely on a few systems and an external network. If an interface fails before a cut-off, payments are late and customers notice at once.
- Trading and settlement
- Orders, confirmations and settlement instructions have fixed windows. A failure at the wrong moment means a missed deadline, not just slower work.
- Client onboarding and identification
- Onboarding uses identity checks, document tools and often an external provider. The plan states what happens when that provider is unavailable.
- Core banking or portfolio system
- An outage of the central system, a failed update or an incident at the cloud provider. RTO and RPO define how fast the system returns and how much booking data may be lost.
- Client advice and service desk
- Advisers need client files, telephony and secure messaging. If the office is closed by fire, flood or illness, working from home must function in practice and not only on paper.
- Claims handling in insurance
- Claims intake, assessment and payout depend on case systems and external experts. A backlog after an outage quickly turns into client complaints.
03: Requirements
How a financial firm meets the key requirements of ISO 22301
The core requirements translate into concrete documents and routines. The table gives one example for each. The figures are illustrations, not targets the standard prescribes.
| Requirement | Example in a financial firm |
|---|---|
| Business impact analysis | Activities such as payment release, client reporting and onboarding are ranked by the damage an outage causes. |
| RTO and RPO | Payment release back within 2 hours, booking data lost for no more than 15 minutes. |
| Risk assessment | Register entries for loss of the data centre, a cloud provider outage, absence of a key person and failure of a market data supplier. |
| Continuity strategies | Second site or cloud region, standby workplaces, a manual fallback for urgent payments, an agreement with an alternative provider. |
| Plans and crisis organisation | One plan per critical activity with steps, contacts and decision rights. A crisis team with named deputies and a phone tree that works without the email system. |
| Exercises and improvement | A yearly restore test of the core system, a tabletop exercise on a provider failure, findings recorded with owners and dates. |
In the structure of the standard, analysis and plans belong to clause 8 (Operation). Exercises are evaluated under clause 9 (Performance evaluation), and the resulting actions under clause 10 (Improvement).
04: Example
Example: an independent asset manager sets its recovery targets
Take a firm with 25 employees. Its portfolio system is hosted by a provider, and a custodian bank is its main counterparty. The five steps below are an illustration, not a template.
List the activities
Order entry, trade confirmation, client reporting, fee invoicing and payroll.
Rate the impact of an outage
Order entry and confirmation hurt on the same day. Fee invoicing can wait several days.
Set the targets
Order entry: RTO 2 hours, RPO 15 minutes. Client reporting: RTO 2 days.
Check the supplier against the targets
Compare the hosting contract and backup routine with step 3. If they do not match, change the contract or define a fallback, for example placing orders by phone with the custodian.
Test the fallback
Cut access in an exercise, place test orders through the fallback and note how long it took.
The result is a short set of documents. A gap found in step 4 is cheaper to close now than during a real outage.
05: With Zertify
How to get ISO 22301 certification with Zertify
You complete an online self-assessment with 34 yes/no questions. Thirteen are must-meet questions and all of them need a yes. They are the core questions of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 need a yes. No auditor visits your office.
SICE reviews every assessment before the certificate is issued. Zertify issues it under licence from SICE. It comes as a PDF with a QR code, and anyone can check the certificate number and QR code on the public verification page.
The price is CHF 749 (€749) in the first year, then CHF 499 (€499) per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year.
06: Procurement
What to tell your client or purchasing department
Describe the certificate as it is: based on an online self-assessment, reviewed by SICE, confirmed each year by a short online re-audit, with no on-site audit. Some tenders ask explicitly for the classic route with an on-site audit by a certification body. Read the tender wording before you decide.
Where a questionnaire asks for a valid certificate and a way to check it, the verification page covers both. Send the certificate number with your answer and the purchasing department can look it up itself.
07: FAQ
Questions about ISO 22301 for financial services
No rule applies to every contract. Each client sets its own requirements in the supplier questionnaire or the tender. Ask which evidence is accepted before you invest time in preparation.
Firms that deliver a service on which another institution depends. Examples are payment and fintech providers, software vendors for banks, back-office and claims service providers, and asset managers with outsourced systems.
No. A disaster recovery plan covers IT systems. ISO 22301 also covers people, premises and suppliers. IT recovery is one strategy inside a wider business continuity system.
That depends on what you already have. If your critical activities, recovery targets and plans are documented and tested, you can answer the questions directly. If not, build those documents first, as in the asset manager example above.
08: Guide
Related pages
Check where your firm stands on ISO 22301
Answer the 34 questions and see whether your business continuity management meets the assessment.
Free and without registration.