ISO 22301 Business Continuity
ISO 22301 without audit: certificate by online self-assessment
You answer 34 yes/no questions online instead of hosting an auditor on your premises. SICE reviews the assessment, and Zertify issues the certificate under licence from SICE. It suits businesses whose customers ask for proof of business continuity management and who do not want to wait months for it.
01: Method
How a self-assessment replaces the on-site visit
In the classic route an auditor comes to your site, reads your documents and interviews your staff. With Zertify you do the same review from your own desk. You answer the questions with your business impact analysis and your continuity plans open next to you.
The assessment follows a fixed sequence.
Answer 34 questions
Each question is yes or no. They cover the business impact analysis, recovery objectives, risk treatment, continuity strategies, plans and exercises.
Meet the 13 must-meet questions
All 13 must be answered yes. They are the core questions of the assessment, not a list of every requirement in ISO 22301:2019.
Reach 14 yes answers among the other 21
Once the core questions are met, at least 14 of the remaining 21 must be yes.
SICE reviews your assessment
SICE checks every assessment before a certificate is issued. Nothing is released automatically.
Zertify issues the certificate
The PDF carries a certificate number and a QR code that lead to a public verification page.
You can run the self-assessment without registering. If you fail a question, you see where the gap is and can close it before trying again.
02: Scope
What the ISO 22301 certificate confirms
The certificate confirms that, on the basis of your answers and SICE's review, your company meets the requirements of the assessment for business continuity management. It does not state that an auditor has inspected your server room, your warehouse or your backup logs.
The questions follow the structure of the standard and ask about things you either have or do not have:
- Business impact analysis
- You have identified your critical activities and ranked them by priority.
- RTO and RPO
- For those activities you have set how long a stoppage may last and how much data you can afford to lose.
- Disruption risks
- You have assessed risks such as an IT outage, a supplier failure, a fire or a pandemic, and decided how to treat them.
- Plans and crisis organisation
- Continuity plans are documented, and it is clear who decides and who acts when something fails.
- Exercises and improvement
- Plans are exercised on a regular basis, and the results lead to changes.
The certificate is valid for 3 years. Every year a short online re-audit confirms that the answers still hold. A customer's purchasing department can check the certificate on the verification page by number or QR code, without calling you.
03: Fit
Which companies get the most from a certificate without an on-site audit
The certificate works best where ISO 22301 is a line in a supplier questionnaire or a tender. IT and cloud service providers meet it often. So do suppliers to banks and insurers, outsourcing and business process providers, logistics and transport firms, and manufacturers inside a supply chain. Healthcare and energy suppliers are asked for it as well.
These businesses usually have a continuity concept already, in a folder or in the head of the IT manager. What they lack is a certificate to attach to the quote. For a company with 20 or 200 employees, hosting auditors for several days is a real burden, and the self-assessment removes it.
One check before you start: read the wording of the questionnaire or tender. If it names a specific kind of audit, ask the customer whether a certificate based on an online self-assessment is accepted.
04: Zertify
Where Zertify fits in
Zertify is an online platform. You complete the assessment, pay, and receive the certificate within 4 hours after passing and payment. The certificate is issued by Zertify under licence from SICE. The requirements behind the questions are described on the ISO 22301 standard page.
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the year you have paid for.
If you certify against several standards, the discount is 20% for two standards and 30% for three or more, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
05: Comparison
ISO 22301 without audit compared with the classic route
The classic route means an on-site audit by a certification body. The figures for it below are indicative ranges. Actual quotes depend on headcount, number of sites and the body you choose.
| Aspect | Zertify (online self-assessment) | Classic route (on-site audit) |
|---|---|---|
| How compliance is checked | Self-assessment with 34 questions, reviewed by SICE | Auditor visits your site and interviews staff |
| Time to certificate | Within 4 hours after passing and payment | Indicative: several weeks to a few months, including scheduling |
| Cost in year one | CHF 749 | Indicative: CHF 5'000 to 15'000 for a small business |
| Following years | CHF 499 per year including the online re-audit | Indicative: yearly surveillance audits, each billed separately |
| Your staff's time | Time to answer the questions and gather documents | Preparation plus days of auditor presence and interviews |
| Proof for customers | Public verification by certificate number and QR code | Certificate PDF, verification depends on the body |
The saving comes from dropping travel, audit days and scheduling. The work of knowing your critical activities and writing your plans does not go away in either route.
06: Limits
When the classic route is the better choice
Some customers write an on-site audit into their contract. If yours does, the online route will not satisfy that clause, whatever its other merits. Ask before you buy.
The classic route can also suit you if you want an outside person to test your plans on the ground. An auditor will notice that the fire exit list is out of date or that nobody has opened the backup instructions in two years. A self-assessment relies on your honest answers and cannot do that.
The guide on certification routes sets the two side by side, so you can decide with your customer's requirement in hand.
07: FAQ
Questions about ISO 22301 without audit
With Zertify there is none. You complete an online self-assessment, SICE reviews it, and every year a short online re-audit confirms your answers. If you want an on-site visit, the classic route with a certification body is the alternative.
Yes, in substance. The questions ask whether you have a business impact analysis, recovery objectives, documented plans and exercises. If something is missing, the assessment shows you where, and you can complete it and answer again.
All 13 must-meet questions need a yes, plus at least 14 yes answers among the other 21. If you fall short, you see which topics are open. You can fix them and retake the assessment.
Many suppliers' questionnaires ask for an ISO 22301 certificate without specifying how it was obtained. Others name a specific audit type. Check the wording, and point to the verification page, where anyone can look up the certificate by number or QR code.
CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years and the subscription renews each year until you cancel in your customer account. With two standards you get 20% off, with three or more 30%.
08: Guide
Related pages
Check where your business continuity stands
Answer the 34 questions and see within minutes whether your company meets the requirements.
Free and without registration.