ISO 22301:2019 is the international standard for a Business Continuity Management System (BCMS), and certification against it means an independent auditor has verified that an organisation has a systematic, documented, and tested approach to keeping critical operations running during a disruption, not simply a plan someone wrote and never revisited. It covers risk assessment, recovery objectives, tested response procedures, and ongoing management review. For a business choosing an outsourcing partner, ISO 22301 certification is one of the few objective, third-party-verified signals that continuity claims are real rather than marketing language.
What Does ISO 22301 Actually Certify?
ISO 22301 does not certify that an organisation has never had a disruption, and it does not certify a single static document. It certifies a management system: an ongoing, structured process for identifying risks to critical operations, defining how the organisation will respond, setting measurable recovery targets, and testing and reviewing that response on a regular cycle.
To achieve and maintain certification, an organisation typically has to demonstrate:
- A documented business impact analysis identifying which functions are critical and how quickly they need to be restored
- Defined continuity strategies for each critical function, such as alternate sites or remote-work capability
- Evidence that the plan has actually been tested or exercised, not just written
- A management review process that keeps the plan current as the business changes
- Independent audit by an accredited certification body, both at initial certification and at ongoing surveillance audits
This is a meaningfully higher bar than a company simply stating "we have a business continuity plan" on its website, because the certification requires evidence, and that evidence is checked by an external party with no commercial interest in the outcome.
Why This Should Matter to a Business Choosing an Outsourcing Partner
When a business outsources its customer service, technical support, or back-office functions to a contact centre, it is effectively extending its own operations through that vendor. If the vendor goes down, the client's customers experience the outage as if it were the client's own failure, regardless of whose logo is on the building. This makes the vendor's continuity posture a direct extension of the client's own risk profile.
An ISO 22301-certified vendor has been independently verified to have thought through failure scenarios in advance, rather than reacting to them as they happen. That distinction becomes very real the first time something actually goes wrong.
The Difference Between "We Have a Plan" and "We Are Certified"
Almost any vendor, if asked, will say they have a business continuity plan. Far fewer can produce an actual certificate from an accredited body, and fewer still can describe a specific, tested mechanism for maintaining service during a disruption. The gap between those two answers is usually the gap between marketing language and operational reality.
A Practical Example: What Certified Continuity Looks Like in Practice
Connect Centre Group, a Singapore-based outsourced contact centre operating since 2004, holds ISO 22301:2019 certification alongside ISO 9001:2015 and ISO/IEC 27001:2022, and its awards page includes the actual certificate. Beyond the certificate itself, the company's continuity model has two specific, named mechanisms: a work-from-home capability, built on fully cloud-based infrastructure and tested for real during Singapore's COVID-19 Circuit Breaker period, and a physical alternate branch site at 3015A Ubi Road 1 that can be fully operational within four hours if the primary facility at 203 Henderson Road is disrupted.
This is the kind of specificity that should exist behind any ISO 22301 certification: not just an audited document, but a named, tested response with a stated recovery time. For more detail on how that two-tier model works and why it matters specifically for contact centres, see our related article on what a call centre business continuity plan actually involves.
How to Verify a Vendor's ISO 22301 Claims Are Real
Certification claims are easy to state and, unfortunately, occasionally overstated. Before taking a vendor's word for it, it is worth applying a short verification checklist.
Ask to See the Actual Certificate
A genuinely certified organisation should be able to produce the certificate itself, including the certification body's name, the scope of certification, and the current validity dates. Certification bodies are accredited entities, and their certificates are traceable. A vendor that is vague about which body certified them, or cannot produce the document, warrants further questions.
Ask About the Last Test Date
Certification requires periodic testing and review, not a one-time audit. Ask when the continuity plan was last tested or exercised, and what the outcome was. A vendor with a real, maintained BCMS will have a concrete answer. One with a lapsed or purely paper-based plan will struggle to give specifics.
Ask About the Specific Failover Mechanism
"We have a continuity plan" is not an answer, it is a claim. Ask what actually happens if the primary site is unavailable: is there a named alternate location, how quickly can it be operational, and does the underlying technology (telephony, CRM, call routing) already support that shift today. A vendor who can answer with a specific recovery time, a named location, and a real precedent (such as an actual pandemic-era transition) is demonstrating operational readiness rather than describing an aspiration.
ISO 22301 Alongside Other Certifications
Business continuity certification is most meaningful when it sits alongside related standards that address adjacent risks. Data Protection Trustmark and ISO/IEC 27001:2022 speak to how customer data is protected, which matters just as much during a disruption as during normal operations, since a continuity failover should not become a data security gap. Reviewing a vendor's full certification set, rather than a single certificate in isolation, gives a more complete picture of operational maturity. You can see the range of services and infrastructure this certification framework supports on Connect Centre's solutions page and technology page.
Why Certification Alone Is Not the Whole Picture
ISO 22301 is a strong signal, but it should be read as evidence supporting a claim, not as a replacement for asking about the claim directly. A certificate confirms that a management system exists and has been audited; it does not, by itself, tell a prospective client what the specific recovery mechanism is, how fast it activates, or whether it has actually been used in a real disruption rather than only a scheduled drill.
This is why the strongest form of evidence combines the certificate with a real operational history. A vendor that can point to both an ISO 22301 certificate and a documented instance of the plan being activated under real conditions, such as a genuine pandemic-era transition to remote work, is offering a more complete picture than certification alone would provide. The certificate establishes that the system meets an international standard; the operational history confirms the system actually works when it matters.
What Happens If a Vendor's Certification Lapses?
ISO 22301 certification is not permanent once granted. It depends on maintaining the management system and passing ongoing surveillance audits. A vendor that let its certification lapse, or that cannot state its current certification status clearly, is effectively telling a prospective client that the audited oversight has stopped, even if a plan still exists informally. This is a reasonable, specific question to ask directly rather than assume.
Reading a Certificate Correctly
When a vendor produces an ISO 22301 certificate, it is worth checking a few details rather than treating the document as self-explanatory. The scope of certification matters: it should cover the specific operations being outsourced, not an unrelated part of the business. The certification body should be a recognised, accredited entity. The validity dates should be current, and the vendor should be able to explain, in plain terms, what happened at the most recent surveillance audit. A vendor that welcomes these questions and answers them specifically is demonstrating exactly the kind of transparency the certification is meant to represent.
Frequently Asked Questions
What is the difference between ISO 22301 and having a business continuity plan?
Any organisation can write a business continuity plan internally with no external verification. ISO 22301 certification means an accredited, independent auditor has reviewed the organisation's risk assessment, continuity strategies, testing evidence, and management processes, and confirmed they meet the international standard. It converts an internal claim into an externally verified one.
How often is ISO 22301 certification audited?
Certified organisations undergo periodic surveillance audits, typically annually, in addition to the initial certification audit and full recertification audits at set intervals, to confirm the management system remains active and effective rather than lapsing after the initial certificate is awarded.
Does ISO 22301 certification guarantee a vendor will never have an outage?
No certification can guarantee zero disruption. What ISO 22301 verifies is that the organisation has a systematic, tested approach to minimising the impact of a disruption and recovering quickly, which is a meaningfully different and more realistic promise than "nothing will ever go wrong."
Why would a contact centre specifically need ISO 22301 rather than just general insurance or contingency budgeting?
Insurance and budgets address the financial consequences of a disruption after the fact. ISO 22301 addresses whether operations can actually keep running during the disruption itself, which for a contact centre means the difference between calls going unanswered and calls continuing to be handled without the customer noticing a problem.
What questions should I ask a contact centre vendor before signing a contract?
Ask to see their ISO 22301 certificate directly, ask when their continuity plan was last tested and what happened, ask for the specific alternate site or remote-work mechanism and its stated recovery time, and ask for a real example of when the plan was activated, such as during a past disruption. Specific answers indicate a real system; vague reassurance indicates it may not have been tested.
If you would like to see Connect Centre Group's certifications and continuity model in more detail, or discuss how it applies to your outsourcing requirements, you can contact the team directly.