ISO 22301 renewal: how to keep your certificate valid

The certificate runs for 3 years from the date of issue. Within that period it is confirmed once a year. There is no auditor visit and no travel: the re-audit is done online in your customer account.

The certificate PDF carries a number and a QR code. A purchasing department or a bank's supplier management can scan the code and land on the public verification page. The yearly confirmation is what keeps that page worth showing.

Validity period

3 years from issue, as long as the yearly subscription is active.

Yearly re-audit

A short online check once a year. It is part of the yearly fee and does not carry a separate charge.

Verification

Anyone with the certificate number or the QR code can check the certificate publicly.

• ISO 22301 certificate at Zertify

A re-audit is only short if your continuity management has kept pace with the business. A new data centre, a changed supplier or a reorganised team can make last year's plan wrong without anyone noticing. Go through these points a few weeks before the due date.

1. 01

   Business impact analysis

   Check that the list of critical activities and their priorities still matches what you actually sell and deliver.

2. 02

   RTO and RPO

   Confirm that the recovery time and recovery point objectives are still realistic for your IT systems and for the customers who depend on them.

3. 03

   Risks of disruption

   Update the risk assessment for outages, supply shortages, fire and pandemic. Record new risks and the treatment you chose (clause 6, Planning).

4. 04

   Plans and crisis organisation

   Check names, deputies, phone numbers and escalation paths. Outdated contact lists are the most common weakness in a real incident.

5. 05

   Exercises

   Make sure at least one exercise took place and that you kept the result: date, participants, what failed (clause 8, Operation).

6. 06

   Incidents and improvements

   Write down what real disruptions taught you and which changes followed (clauses 9 and 10, Performance evaluation and Improvement).

The yearly confirmation is part of the certificate's validity. If it is missing, the certificate is not confirmed for that year. Do not wait to see what follows: complete the re-audit as soon as you notice the date has passed.

The practical risk is on the customer side. A supplier questionnaire or a tender often asks for a current certificate, and a buyer who scans the QR code expects to find one. An unconfirmed certificate is a weak answer to that request.

Cancelling is a separate matter. You can cancel in the customer account at any time to the end of the current year. The certificate then ends with the year you have paid.

• General questions about Zertify

On the classic route, a certification body audits your management system on site. After the first audit it returns for surveillance audits during the three-year cycle and for a recertification audit at the end. Each visit needs a date in the diaries of your own staff and of the auditor.

The Zertify re-audit follows the same yearly rhythm but is carried out online, and no auditor visits your premises.

• Compare the certification routes
• Certification without an on-site audit

Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before issue. You start with an online self-assessment of 34 yes/no questions. All 13 must-meet questions need a yes, and at least 14 of the other 21 must be yes. After passing and payment, the certificate arrives within 4 hours.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The yearly fee is an automatic subscription. If you certify for two standards, you get 20% off, and for three or more 30%, also on the yearly fee. For customers in Switzerland and Liechtenstein, prices include 8.1% VAT. You do not need an account to buy.

• Start the free self-assessment
• See pricing
• About ISO 22301