Stage 1 is a documentation and design review. The auditor does not visit the organisation’s sites, does not interview process owners at length, and does not test plan activation. The auditor reviews the documented BCMS — the scope statement, the policy, the BIA, the strategy, the BCPs, the exercise programme, the internal audit report, and the management review minutes — and assesses whether the BCMS is adequately designed to proceed to Stage 2 implementation testing. The output of Stage 1 is a report documenting the auditor’s findings: observations, minor nonconformities, or major nonconformities that require closure before Stage 2.
Stage 1 is therefore fundamentally different from Stage 2 in method and focus. Stage 1 is about design adequacy; Stage 2 is about operational implementation. A BCMS can pass Stage 1 and then encounter major findings at Stage 2 if the documented design does not translate into operational capability. Conversely, a BCMS that fails Stage 1 cannot proceed to Stage 2 until the design defects are resolved. Understanding what the Stage 1 auditor is looking for, and ensuring that the documented BCMS is complete and coherent before Stage 1, is the critical success factor for certification programmes.
Stage 1 Objectives and Process
The Stage 1 audit typically spans 3–5 days (depending on BCMS scope and complexity) and is conducted largely off-site or in a single site visit focused on document review and clarification interviews with the BCM team. The auditor arrives with the organisation’s submitted documented information and conducts a systematic review of each requirement in ISO 22301 Clauses 4–10. The auditor will ask clarification questions about the logic, completeness, and links between documents, but will not conduct extended interviews with process owners or conduct site inspections.
The Stage 1 audit concludes with an opening meeting (where the auditor outlines the scope and methodology) and a closing meeting (where the auditor summarises findings and discusses remediation timelines). The auditor then produces a Stage 1 Report documenting the findings. Major nonconformities typically require a separate verification visit before Stage 2 can be scheduled; minor nonconformities and observations can be addressed through documentation updates without verification.
Stage 1 findings are structured into three categories. A major nonconformity indicates a fundamental defect in BCMS design — for example, no BIA produced, no management review conducted, or no exercise programme documented. A minor nonconformity indicates a gap in the documentation or analytical support that requires correction but is not a fundamental design defect — for example, BIA outputs incomplete, BCP lacking activation criteria, or exercise record incomplete. An observation indicates a potential improvement area but not a requirement defect — for example, a contact directory slightly out of date, or a policy not recently reviewed.
What the Stage 1 Auditor Reviews
The Stage 1 auditor systematically reviews each clause of ISO 22301 and the documented information that supports the BCMS design. The review focuses on: presence of required documents; completeness of document content against standard requirements; logical linkage between documents (does the BIA output drive the strategy, and does the strategy drive the BCP targets?); and consistency across the document set (do all BCPs define the same activation criteria structure, or does each vary?).
Table 1 sets out the key review areas, what the auditor assesses in each area, and the most common Stage 1 findings in that area. These findings are representative of recurring patterns: scope statements that are too narrow, BIA methodologies that do not produce MAO evidence, BCPs that lack activation criteria, and management review minutes that record attendance without recording decisions. These gaps are entirely preventable through a readiness assessment before Stage 1.
The most consequential Stage 1 review area is the BIA and its outputs. The auditor will assess whether the BIA methodology is documented, whether the methodology is appropriate for producing RTO/MAO/RPO/MBCO evidence, and whether the BIA has been executed and approved by management. A BIA that exists but does not produce clear MAO and RTO evidence with analytical support is a common major nonconformity. The remediation is to re-execute the BIA with a methodology that explicitly determines MAO before RTO, but this rework delays Stage 2 significantly.
| Review Area | What the Auditor Assesses | Common Stage 1 Finding |
|---|---|---|
| BCMS Scope | Appropriateness of scope; whether scope reflects actual critical activities; whether excluded activities are justified | Scope too narrow — excludes key business units or activities; scope statement vague |
| Context and stakeholders | Completeness of context analysis; stakeholder needs identified; regulatory requirements mapped | Regulatory requirements not listed as interested party inputs; context analysis generic |
| BC Policy | Content (commitments, objectives reference, communication); approval level; communication evidence | Policy not signed by top management; policy not communicated to staff; policy not reviewed in >12 months |
| BIA methodology | Documented BIA approach; methodology produces MAO, RTO, RPO, MBCO; BIA is management-approved | BIA methodology document absent; BIA produces RTO but not MAO; BIA not approved |
| BIA outputs | Evidence BIA was conducted; outputs are documented and credible | BIA is a template with placeholder values; RTO targets have no analytical basis |
| BC strategy | Strategy decisions documented and linked to BIA outputs | No strategy document; strategy exists but was made before BIA completed |
| BCP structure | BCPs contain required elements (activation criteria, roles, procedures, communication) | Activation criteria missing or vague; contact lists absent; procedures at policy level not operational level |
| Exercise programme | Exercise plan documented; at least one exercise planned or completed | No exercise plan; planned exercise not yet conducted (may be acceptable if Stage 2 is scheduled after exercise) |
| Internal audit | Internal audit completed or scheduled; auditor competence | Internal audit not completed; auditor is also the BCM manager (independence issue) |
| Management review | At least one management review conducted with documented outputs | Management review not held; minutes do not record decisions |
Stage 1 Findings: Observations vs Nonconformities
Understanding the classification of findings before Stage 1 helps organisations prioritise remediation effort. A major nonconformity is a certification stopper — Stage 2 cannot proceed until the major nonconformity is resolved and verified. A minor nonconformity must be addressed before Stage 2 but does not necessarily require a separate verification visit; the organisation can update documentation and submit the evidence to the auditor, who will assess closure without an audit visit. An observation is a suggestion for improvement but does not block progression.
The distinction between major and minor nonconformities is important but can be ambiguous. For example, if an exercise is planned but not yet completed before Stage 1, this is typically an observation (the plan exists, execution will be verified at Stage 2). If no exercise is planned, and no programme for conducting exercises exists, this is typically a major nonconformity (Clause 8.5 explicitly requires an exercise programme). If a BIA methodology document exists but does not produce MAO evidence, this is typically a minor nonconformity (the methodology needs refinement and re-execution); if no BIA has been conducted at all, this is a major nonconformity.
The auditor’s finding classification should be discussed at the closing meeting, and organisations should seek clarification on what constitutes closure evidence. For a major nonconformity, the auditor will likely require a separate verification visit or will schedule Stage 2 only after evidence of closure is submitted and reviewed. For a minor nonconformity, the auditor will specify the evidence required — revised document, approval signature, or updated analysis — and may set a deadline for submission.
Addressing Stage 1 Findings Efficiently
Stage 1 findings are addressed through a remediation plan that identifies the root cause of each finding, the action to address it, the person responsible, and the target completion date. Organisations should prioritise major nonconformities for immediate attention and treat minor nonconformities and observations as secondary priorities. However, even observations should be addressed if possible, because a Stage 2 auditor will note patterns of recurring Stage 1 findings (for example, a contact directory that was out of date at Stage 1 but is still out of date at Stage 2) as evidence that the improvement loop is not functioning.
Table 2 presents typical Stage 1 findings, the evidence required to close each finding, and realistic timelines for remediation. These timelines assume straightforward closure actions — updating a document, conducting an approval meeting, scheduling an exercise. More complex closures — e.g., re-running the BIA because the methodology is insufficient — require proportionally longer timelines and should be flagged immediately.
The remediation period between Stage 1 and Stage 2 typically spans 4–12 weeks, depending on the findings and the organisation’s availability for approval meetings and document revision cycles. Major nonconformities that require significant rework (e.g., BIA methodology overhaul) can extend the remediation period to 16–20 weeks or longer. Organisations should confirm the Stage 2 audit date only after assessing whether the remediation timeline is achievable.
| Finding Type | Typical Closure Evidence | Timeline |
|---|---|---|
| Missing document | Create document; obtain approvals; submit to auditor | 2–4 weeks depending on approval cycle |
| Document exists but lacks required content | Update document; re-obtain approvals; submit | 2–6 weeks |
| BIA methodology insufficient | Revise BIA methodology; re-run affected BIA sections; re-approve | 4–8 weeks — may delay Stage 2 significantly |
| RTO targets without BIA support | Conduct targeted BIA analysis; document MAO basis for RTO | 4–6 weeks |
| Management review not conducted | Schedule and conduct management review; produce minutes with decisions | 2–4 weeks |
| Internal audit not completed | Complete audit; address material findings; produce audit report | 4–6 weeks |
| Exercise not completed | Conduct tabletop exercise; produce exercise record | 2–4 weeks if scenario is ready |
| IMPORTANT | Stage 1 findings related to BIA are the most consequential because they cascade. If the auditor finds that the BIA does not produce credible RTO and MAO evidence, then the BCP targets based on that BIA are also questioned, and the exercise that tested the BCPs is also questioned. A BIA deficiency at Stage 1 can require rework across the BIA, strategy, BCPs, and exercise record before Stage 2 can proceed. BIA quality is the highest-leverage readiness investment. |
| BITLION INSIGHT | The single most reliable predictor of a clean Stage 1 audit in our experience is the quality of the BIA report. Organisations with a BIA that documents: the methodology, the process interviews conducted, the impact analysis by time period, the MAO/RTO/RPO/MBCO determination with rationale, and management sign-off — pass Stage 1 with minor observations at most. Organisations whose BIA is a spreadsheet of RTO targets with no supporting analysis generate Stage 1 findings that delay Stage 2 by months. |