ISO 22301 for manufacturing: proof that you keep delivering

When your plant stops, your customer's line stops a few days later. Purchasing departments know this, so supplier questionnaires now contain a section on business continuity. A certificate answers it with a document instead of a page of prose.

Tenders from larger industrial groups ask for the same proof, above all when you supply a part with no quick alternative. Just-in-time deliveries leave the buyer without stock to bridge a gap, and the buyer wants to see that you have thought about it.

In a customer audit, the certificate saves a long round of document requests. The auditor scans the QR code on the PDF or enters the certificate number on the public verification page and sees that the certificate is valid.

• ISO standards for small and medium businesses

The standard does not prescribe a list of risks. You identify the ones that can interrupt your critical activities and decide how to deal with them. In a manufacturing company they usually look like this.

Machine breakdown

A CNC machine or press with no second unit stops an entire product line. The plan names spare parts held on site, a service contract with a defined response time and a subcontractor who can take over the job.

Single-source supplier

One supplier delivers the castings or the electronic components. The plan provides a qualified second source or a safety stock for parts with long lead times.

ERP or IT outage

Without the ERP system there are no production orders and no picking lists. The plan sets how fast the system must be back and how much data may be lost, and keeps printed order lists for the day in between.

Fire or water damage

A damaged hall or warehouse removes capacity at once. The plan describes which products move to a partner plant or a second site, and in what order.

Power failure

Furnaces, compressors and test benches cannot simply be restarted. The plan lists which machines need backup supply and which are shut down in a controlled way.

Absence of key staff

Illness or a pandemic can take out the only setter who knows a machine. The plan covers cross-training, deputies and documented set-up instructions.

Business impact analysis, strategies, plans and exercises sit in clause 8 (Operation). Clause 9 (Performance evaluation) adds internal audits and management review. The table translates the key requirements into a manufacturer's daily work.

A company with 30 to 200 employees does not need a project office. It needs a clear order of work and one person who owns it. The sequence below works for most plants.

1. 01

   List products and the processes behind them

   Start from the order book, not from the organisation chart. Which products ship to which customers, and which machines, people and systems does each one need?

2. 02

   Rank by impact

   Ask what a stop of one day, one week and one month costs in contract penalties and lost customers. The ranking gives you the critical activities.

3. 03

   Set RTO and RPO per activity

   Agree the targets with management and with IT. A target nobody has signed off cannot be tested.

4. 04

   Check dependencies

   Follow each critical activity back to suppliers, machines, IT systems and staff. Single points of failure show up here.

5. 05

   Write plans and name the crisis team

   One page per critical activity is enough: trigger, first steps, responsible person, deputy. Keep a printed copy at the gatehouse.

6. 06

   Exercise and record the result

   A half-day table-top exercise with the real team is sufficient to start. Write down what did not work and fix it before the next run.

The certificate is issued by Zertify under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. There is no on-site audit: you complete an online self-assessment of 34 yes/no questions for ISO 22301.

13 of the questions are must-meet questions and all of them must be answered yes. They are the core questions of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 need a yes. Once you have passed and paid, the certificate arrives within 4 hours.

It costs CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed each year by that short re-audit. Every certificate can be checked by number and QR code on the public verification page.

• ISO 22301 at a glance
• Pricing
• Start the free self-assessment

Some customers write into a tender or a supplier questionnaire which kind of certificate they expect. Read the wording before you decide. If it only asks for a valid ISO 22301 certificate that can be verified, the Zertify certificate fits.

The classic route with an on-site audit by a certification body means booking audit dates, hosting auditors in your plant and waiting for their calendar. The process runs over weeks or months. Some manufacturers need it for a particular customer, others do not.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs