PECB ISO 22301 Lead Auditor Training: Audit a BCMS

This five-day course prepares you to audit a business continuity management system against ISO 22301, from audit preparation through reporting and follow-up. The methods follow ISO/IEC 17021-1 requirements, and the course ends with the Lead Auditor exam.

The essentials

Objectives

Program

  1. Day 1 – The BCMS and ISO 22301
    • Certification process
    • Business continuity concepts
    • Overview of the requirements
  2. Day 2 – Audit principles and initiation
    • Evidence-based and risk-based auditing
    • Initiating the audit
    • Stage 1 audit
  3. Day 3 – On-site audit activities
    • Preparing stage 2
    • Communication during the audit
    • Collecting information and test plans
    • Auditing ISO 22301 requirements
  4. Day 4 – Closing the audit
    • Findings and conclusions
    • Quality review and report
    • Evaluating action plans
    • Internal audit programme
  5. Day 5 – Certification exam
    • Three-hour PECB exam

Prerequisites

Target audience

The exam

The three-hour exam takes place on day five, online with remote proctoring via the PECB Exams app or on paper through a partner. It has 80 multiple-choice questions across seven domains, with conducting the audit alone worth 20. It is open book and you need 70% to pass. Depending on the experience you declare, you then hold Provisional Auditor, Auditor, Lead Auditor (five years including two in continuity, 300 audit hours) or Senior Lead Auditor. Certification is valid for three years, with CPD hours and an annual maintenance fee.

Preparation tips

Frequently asked questions (FAQ)

Do I need to be an auditor already?

No, but PECB expects solid knowledge of audit principles. Some internal audit experience, even in another management system such as ISO 9001 or ISO/IEC 27001, helps a lot.

What title do I get without audit experience?

Provisional Auditor. Lead Auditor requires five years' professional experience, two of them in business continuity, plus 300 hours of audit activity. You can upgrade once you meet those conditions.

Does the course cover internal audits?

Yes. Day four covers managing an internal audit programme, which is useful even if you never work for a certification body. Many participants apply it directly to their organization's own audit cycle.

Is the exam hard?

Scenario questions are demanding, but the open-book format helps if you know the standard's structure well. The case studies worked through during the week mirror the kind of reasoning the exam expects.

Can I take the course online or in Casablanca?

Both. We run it as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English depending on the group. For on-site sessions we can adapt examples and case studies to your sector and schedule the exam with you.

Related trainings

Securevalley training — online and in-person sessions. Contact us for pricing and registration terms.

Related trainings