ISO 22301 for service companies

In a service business the product is delivery on a given day. If the helpdesk is offline, the payroll run is late or consultants cannot reach the client's systems, the customer notices the same day. This is why supplier questionnaires contain questions such as how long you can be down and what happens to the customer's data.

Tenders want evidence, not a statement. A certificate with a number that the purchasing department can look up answers the question in one step. Without it, you fill in a separate continuity questionnaire for every customer, and every customer weighs your answers differently.

Service companies that work for banks, insurers or hospitals receive the question more often, because their customer has to show continuity along its own supply chain. You are one link in that chain, and the customer wants to know it holds.

• ISO 22301 in detail

The standard does not ask you to prevent every incident. It asks you to know which activities matter most and to have a tested answer for each kind of interruption. For service companies these are the typical cases.

Loss of the IT platform

A managed service provider loses its ticketing system and remote-access tool. Customers cannot raise incidents and technicians cannot reach customer systems.

Key person unavailable

The only account lead of a major client is ill for three weeks. The plan names a deputy and records the client's open work, so delivery continues.

Premises unavailable

Water damage closes the office of a fiduciary firm during year-end closing. Staff work from home with access to the accounting data.

Supplier failure

A call centre depends on one telephony provider. The plan defines a second provider or a fallback channel and the time needed to switch.

Mass absence

Half of a staffing agency's team is out at once. The plan defines which services run at reduced level and which are paused.

Data loss

A day of customer records disappears after a faulty update. The recovery point objective decides how often backups must run.

Business impact analysis, continuity strategies and plans belong to clause 8, Operation. Leadership, planning and review follow the usual structure of ISO management systems. The table shows the key requirements with a realistic example for a service firm.

Most service companies already have parts of this in their heads or in scattered files. Putting them in order takes a few focused steps.

1. 01

   List and rank your activities

   Write down what you deliver to customers and what internal work it depends on. Rank by the damage a stoppage causes after one hour, one day and one week.

2. 02

   Set recovery objectives

   Give each critical activity a recovery time and, where data is involved, a recovery point. Check them against your service level agreements.

3. 03

   Write short plans

   One or two pages per critical activity: who acts, in which order, with which tools and contacts. A plan nobody reads in a crisis is useless.

4. 04

   Name the crisis team

   Define who decides, who informs customers and who deals with suppliers. Name a deputy for each role.

5. 05

   Run one exercise and record it

   Pick a realistic scenario, such as a day without your main system. Note the result and the corrections you made afterwards.

The self-assessment for ISO 22301 has 34 yes/no questions. 13 of them are must-meet questions and all must be answered yes. They are the core questions of the assessment, not a list of every requirement of the standard. Of the other 21 questions, at least 14 must be answered yes. SICE, the Swiss Institute of Certification and Education, reviews every assessment. Zertify then issues the certificate under licence from SICE, within 4 hours after you have passed and paid. No on-site audit takes place.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly short online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.

Every certificate carries a number and a QR code on the PDF. Your customer scans the code or enters the number on the public verification page and sees at once that the certificate is genuine. You can add the link to a supplier questionnaire or a tender submission.

• Start the free self-assessment
• See pricing
• ISO 22301 on Zertify

The classic route means an on-site audit by a certification body. Indicatively, it costs several thousand francs for the first cycle and takes weeks to months from enquiry to certificate. It makes sense if a customer's tender explicitly requires an on-site audit. Read the wording of the requirement before you decide.

For most supplier questionnaires and tenders in the service sector, the question is whether you can prove a functioning continuity management that the buyer can check. A certificate based on an online self-assessment, reviewed by SICE, confirmed every year and verifiable by number, meets that need for many buyers. If you hold several standards, a multi-standard discount applies: 20% for two, 30% for three or more, also on the yearly fee.

• Compare the certification routes
• Certification without an on-site audit
• Certification cost explained