ISO 22301 for logistics: prove that your deliveries continue when something fails

A logistics provider carries more than parcels. It carries the delivery promise of its customer. If your warehouse management system is down for two days, the shelves of a retailer or the production line of a manufacturer run empty, and the customer's customer notices before you have written your first apology.

This is why supplier questionnaires from purchasing departments contain a section on business continuity. They ask whether you have a business impact analysis, whether recovery times are defined and whether the plans have ever been exercised. Some tenders name ISO 22301 outright. Others accept any proof of a working continuity system, and a certificate with a public verification page answers both versions of the question.

For a freight forwarder or contract logistics company, a certificate also shortens customer audits. Instead of walking an auditor through your plans one folder at a time, you hand over a certificate number and a QR code.

• ISO 22301 at a glance

The standard does not prescribe a list of threats. You identify the disruptions that would stop your critical activities and decide how to respond. In logistics, the same scenarios come up again and again.

Warehouse management system outage

Picking, packing and dispatch stop because the system or its database is unavailable. Recovery time and data loss limits decide whether you fall back on paper lists or a standby system.

Loss of a site

A fire, flood or long power cut makes a warehouse or cross-dock unusable. The plan names an alternative site or a partner who can take over the volume.

Carrier or subcontractor failure

A key haulier goes insolvent or cannot deliver capacity in peak season. You need qualified alternatives before the failure, not after.

Interface and data failure

The EDI link to a customer or the tracking feed breaks. Orders and status messages stop, even though trucks are still moving.

Cyber attack on dispatch and tracking

Ransomware locks the transport management system. The plan covers backups, manual dispatch and the order in which systems come back.

Staff shortage

A pandemic or a regional strike removes drivers and warehouse staff at once. Cross-training and priority customers are decided in advance.

The requirements follow the usual high level structure, with the operational core in clause 8. The table translates the key requirements into situations a logistics manager recognises.

• Overview of all standards

Most logistics companies already have fragments: an IT recovery document, a fire plan, a list of emergency numbers. The work lies in connecting them to the services you sell. A workable sequence looks like this.

1. 01

   List the services you sell

   Pallet storage, groupage, express, customs clearance, returns. Write down which customers depend on each one.

2. 02

   Rank them by the damage of a stop

   Ask how many hours each service can be down before a contract penalty or a lost customer follows. This is your business impact analysis.

3. 03

   Set RTO and RPO per service

   Agree the figures with IT and operations. If IT says four hours is impossible, you have found a gap to close.

4. 04

   Write short plans per site

   One or two pages each: who decides, who calls the customers, which manual procedure replaces which system.

5. 05

   Exercise one scenario and record it

   Pick a system outage, run it with the people who would handle it, and note what did not work. The record is your evidence for the audit.

You answer 34 yes/no questions online. Thirteen of them are must-meet questions and all must be answered yes. Among the other 21, at least 14 must be yes. These are the core questions of the assessment, not a copy of every requirement of the standard. SICE reviews every assessment, and the certificate is then issued by Zertify under licence from SICE. It reaches you within 4 hours of passing and payment.

The certificate costs CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. It is valid for 3 years and confirmed each year by a short online re-audit. The subscription renews automatically and can be cancelled in your customer account to the end of the current year. You do not need an account to buy. Prices for Switzerland and Liechtenstein include 8.1% VAT.

Each certificate carries a number and a QR code. Your customer's purchasing department scans the code or enters the number on the public verification page and sees that the certificate is genuine. If you also hold or plan another standard, such as ISO 27001, multi-standard discounts of 20% for two and 30% for three or more apply, also on the yearly fee.

• Start the free self-assessment
• See pricing
• ISO 22301 page

The classic route with an on-site audit by a certification body means an auditor visits your locations. For a company with several depots, that takes scheduling and staff time on top of the audit itself. The Zertify route has no site visit. The evidence is your self-assessment, reviewed by SICE, and the yearly online re-audit.

Before choosing, read the tender text or the customer's supplier requirements. If they ask for proof of business continuity management, a publicly verifiable certificate usually serves. If they prescribe a particular route, ask the customer which one they mean.

• Compare the certification routes
• Certification without an on-site audit