ISO 22301 asks for an exercise program, not an annual exercise

"ISO 22301 requires an annual exercise" gets repeated often enough to sound like a quotation. No published account of the standard that we found says it. The standard sets no exercise frequency at all.

What it does ask for is in Clause 8.5, and the clause's own title is the clue. In the 2012 edition it was Exercising and testing.¹ The 2019 edition retitled it Exercise programme,² and certification-body guidance on the transition reads the change as a new emphasis on a planned program.³ If a source still calls Clause 8.5 "Exercising and testing", it's describing a superseded edition.

In substance (our summary, not ISO's wording), Clause 8.5 asks an organisation certified to the standard, or claiming conformity, for **a planned, recurring program of exercises that shows, over time, that its business continuity arrangements work.**⁴ ⁵ The exercises are tied to its business continuity objectives. Each is built around a scenario, with a purpose set in advance. They develop the people who would respond, and they're written up so the findings feed improvement.⁴ ⁵ The organisation plans the intervals. The standard sets no number.⁴ ⁵

The unit is the program, not the exercise. No single exercise has to show that everything works. One certification body's guidance says so explicitly: not everything has to be exercised every time, and coverage builds up across the program.⁴

That changes what a good program looks like. An annual event can be held on time, every time, and still leave most of the arrangements untouched for years. A program has to show, across its cycle, that the arrangements that matter hold up, and that what each exercise finds gets acted on.

The same goes for the "documented exercise schedule" that often travels with the annual claim. It isn't in any account of Clause 8.5 we found either. The one document certification-body guidance ties to the clause is the post-exercise report.⁶ A schedule may well be good practice. It's your practice, not the standard's.

If your program does run annually, that number came from somewhere else: your own organisation's choice, a customer's contract, or another framework's rule. Those are all legitimate sources of a number. None of them is ISO 22301.

Who the standard binds and the four ways to claim conformity, why exercising (8.5) and evaluating (8.6) are separate clauses, what a certification audit looks at, and where the standard is deliberately open are all in one place: What ISO 22301 actually asks of your exercise program.

---

Standards references current as of September 2026. ISO 22301 content in this piece is our summary, not a quotation of the standard. This piece is scheduled for re-verification by March 2027.

¹ ISO 22301:2012, official preview, contents page only, for the 2012 clause title.

² ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements: ISO's official preview, as distributed free by an ISO national member body. Clause numbers and titles are taken from its contents page.

³ An accredited certification body's 2012-to-2019 transition guide (2021). Secondary source.

⁴ The same certification body's ISO 22301:2019 implementation guide (2024). Secondary source, used to corroborate our summary of Clause 8.5.

⁵ A certification firm's explainer on ISO 22301 requirements (updated April 2026). Secondary source, used to corroborate our summary of Clause 8.5.

⁶ The certification body in notes 3 and 4: its ISO 22301 checklist (2021), including its clause-by-clause list of the documented information it expects for certification. Secondary source.