ISO 22301 Certification in Nigeria: Cost, Process & Implementation

ISO 22301 certification suits Nigerian organizations that need a structured, independently assessed approach to keeping priority services running through disruption. A sudden power cut, cyber incident, or supply-chain delay can affect customers before your team has time to react.

A business continuity management system (BCMS) is a structured set of policies, roles, processes, and resources that helps an organization maintain or recover prioritized activities during disruption. ISO 22301 certification in Nigeria can show customers and partners that you have established and maintain continuity arrangements.

That assessment does not guarantee that disruption will never happen or that every service will recover without delay. It shows that your organization manages continuity through a defined system, rather than relying only on individual knowledge or a single emergency plan.

The framework can be scaled to your activities and operating context, so its scope need not cover every service in the same way. A useful starting point is to identify which services your customers and operations cannot afford to lose for long.

ISO 22301 and the Organizations It Fits

ISO 22301:2019 gives organizations a management-system framework for preparing for, responding to, and recovering from disruptive incidents. Published in October 2019, the standard sets requirements for establishing, implementing, maintaining, and continually improving a BCMS.

ISO 22301 can suit organizations of different sizes and sectors when continuity matters to their customers, staff, or obligations. A small firm may need to protect a few key services, while a larger organization may need to coordinate many sites and suppliers.

Business continuity management is ongoing work, not a one-time disaster plan. A continuity management system sets governance, assigns responsibilities, and calls for regular review as your activities and risks change.

A management system also links plans to everyday decisions. Leaders set direction, teams carry out assigned processes, and reviews help you see whether arrangements still fit your organization.

The standard follows the Plan-Do-Check-Act approach. You plan the system, put it into use, check its performance, and act on gaps to improve it.

That cycle supports continual improvement, but an ISO 22301 certificate does not promise uninterrupted operations. Your response still depends on the event, available resources, and how well people carry out their roles.

Organizations can define a BCMS scope around the services and operations that need continuity. The right scope depends on the activities your organization needs to keep available, not on its headcount alone.

Business Continuity Benefits for Nigerian Organizations

A BCMS adds business value when it helps your team protect the services that customers and operations depend on most. Its value comes from practical choices about what to recover first and how your team will respond.

Protecting priority services and revenue

Clear priorities help staff focus on the work that matters most during a disruption. Recovery arrangements can reduce avoidable downtime by setting out who acts, what resources they need, and which service comes first.

That direction can help protect service delivery when power outages affect equipment, a cyber incident interrupts access, or a supplier cannot deliver. A plan cannot remove every loss, but it can limit confusion and speed up informed action.

Continuity planning is relevant in many fields where delays affect people or essential work. Examples include:

• Financial services that handle payments and account access
• IT and telecommunications providers that support digital services
• Manufacturers that rely on equipment, materials, and staff
• Healthcare organizations that support patient care
• Logistics firms and government services with public duties

Supply-chain disruption, connectivity failures, and logistics interruptions can also affect several activities at once. Your BCMS can help teams understand which services rely on the same people, systems, or suppliers.

Strengthening customer and partner confidence

Customers and partners may want evidence that your business has considered how it will respond to disruption. A current continuity system can support confidence in your ability to manage risk and communicate during an incident.

Certification may also help when a tender or business partner asks about continuity controls. It does not promise a contract, a financial saving, or immunity from incidents.

Certification demonstrates that your organization manages a system against ISO 22301 requirements. It cannot guarantee that every disruption will be prevented or that recovery will always meet expectations.

Tie each expected benefit to a critical service your organization can name and measure.

ISO 22301 Certification in Nigeria: Core Requirements

Meeting ISO 22301 requirements means building a functioning management system around continuity, not simply writing an emergency plan. The standard’s Clauses 4 through 10 cover context, leadership, planning, support, operation, performance evaluation, and improvement.

Your organization first defines the issues that shape continuity needs and sets a BCMS scope that fits its activities. Leaders then approve direction, assign roles, and provide the resources needed to carry out the work.

Planning includes identifying risks and opportunities, setting continuity objectives, and deciding how to meet them. Support covers the resources, skills, awareness, and communication that help people perform their roles.

Operational controls put continuity arrangements into practice. They connect the organization’s plans and response arrangements with the activities, people, and resources needed during disruption.

Performance evaluation gives you a way to check whether the system works as intended. Internal audits and management reviews can reveal gaps, while corrective action addresses problems and supports improvement.

Documented plans matter, but documents alone do not meet the requirements. You also need evidence that staff use the arrangements, leaders review results, and the organization responds to findings.

Clause 8.5 specifically requires organizations to test and evaluate their business continuity plans. The aim is to learn whether arrangements can work and where changes are needed.

A written plan might name a backup site, for example, but the system should show who can use it and what happens if access fails. Such details help connect documented information to day-to-day practice.

Strong leadership is part of the system, not a task that can be handed off entirely. Make top management’s responsibility visible in approved policy, assigned roles, and review decisions.

Defining BCMS Scope, Impact, and Risk

Start scope and planning by identifying the activities whose interruption would cause the greatest operational or customer impact. A clear scope sets the boundaries for the continuity management work and helps teams focus their effort.

Scope decisions should reflect what your organization does, where it works, and what it depends on. A service may rely on staff at one site, systems hosted elsewhere, or a supplier outside your direct control.

Mapping critical activities with a business impact analysis

A business impact analysis (BIA) identifies activities and evaluates the effects of disruption over time. It helps you decide which work needs attention first and how long customers or operations can manage without it.

The disruption impact analysis should consider effects on customers, internal work, and legal or contractual obligations. Its findings can also show which staff, facilities, systems, information, and suppliers support each activity.

For example, a payment service may depend on a communications link and staff who can approve transactions. If either dependency fails, the impact may grow as customers wait and obligations come due.

Impact and risk answer different questions. The BIA asks what happens when an activity stops and how those effects change over time.

Assessing threats and selecting recovery strategies

Risk assessment identifies threats and evaluates their likelihood and impact. It asks what could cause disruption, while the BIA measures the consequences of interrupted work.

Use the risk management results to shape recovery strategies for power, technology, people, facilities, and suppliers. A backup power source may help one site, while an alternate contact route may help staff coordinate if the main network fails.

Continuity planning links critical activities to recovery strategies and response arrangements. It should fit the dependencies you have identified, rather than assume every service needs the same recovery method.

A supplier failure could require an alternate provider, a different delivery route, or a temporary change in service. The right response depends on the activity and the time available to recover it.

Check that the scope covers the people, locations, systems, and dependencies needed to deliver each priority activity.

Documents Your BCMS Needs

Prepare documents that show how your BCMS works in practice, from its approved scope to evidence of testing and review. Your records should support decisions and show that the system reflects real work.

Good records are useful during daily operations, internal checks, and external assessment. Generic templates can help you start, but they should not replace details about your own services and responsibilities.

Governance and planning records

Keep a defined scope and a continuity policy approved by top management. The policy sets the organization’s direction and shows leadership commitment to continuity.

Record the business impact analysis, risk assessment, and legal or contractual requirements that apply to your activities. These records help explain why the BCMS covers certain services and what obligations shape your plans.

One grouped set of records can make governance easier to track:

• BCMS scope and approved continuity policy
• Business impact analysis and risk assessment
• Applicable legal and contractual requirements
• Continuity strategies and operational plans
• Audit, exercise, review, and competence records

The list is a set of document categories, not a fixed template for every organization. Your format and level of detail should fit your activities and the way your team works.

Operational and assurance evidence

Operational evidence can include continuity plans, incident procedures, and records of exercises. Together, they help show how people should respond and what the organization learned from testing.

Keep supplier continuity records for critical services, along with internal audit results and management review decisions. These records show how you check dependencies and respond when the system needs attention.

Competence evidence can show that staff have the knowledge and skills required for assigned roles. It may include training records or other proof that people understand what they need to do.

Records should reflect actual activities rather than copy a generic plan that staff cannot use. If teams rely on a local contact or system, the record should name the right arrangement.

Keep each record controlled and current when a critical activity, dependency, or responsibility changes.

Implementation From Gap Review to Audit

A gap assessment gives you a practical starting point by comparing current continuity arrangements with ISO 22301 requirements. A clear comparison helps you focus project work on what your organization still needs to put in place.

A practical certification process can follow five stages: gap assessment, documentation, implementation, internal audit and testing, and certification audit. The first four prepare the system for independent external assessment.

Assess the current system and close planning gaps

In the gap assessment, review existing policies, plans, roles, and records against the standard. The review should distinguish work already in place from missing, unclear, or outdated arrangements.

Use the findings to set priorities and assign owners for the work. A team may need to define scope, gather staff input, or make responsibilities clearer before drafting new records.

Documentation is the next stage. Tailor policies, plans, and procedures to actual operations so staff can use them during a disruption.

A plan for a busy service center, for example, should reflect its real staffing, systems, and supplier links. A copied template may miss the details that determine whether recovery can happen.

Build and operate continuity arrangements

Implementation means assigning roles and embedding procedures into normal work. Staff need to know who makes decisions, where to find instructions, and how to raise a problem.

Leaders also need to provide resources and support the teams responsible for continuity. A BCMS becomes more useful when people can apply its arrangements, not just file them away.

Internal audit and testing form the fourth stage. Internal audit checks whether the system follows its requirements, while testing helps reveal whether plans can work in practice.

When reviewers find a gap, record it, decide on corrective action, and track the work to completion. This gives your organization a chance to address issues before the external assessment.

Check readiness before the certification audit

The fifth stage is the certification audit, conducted by an independent certification body. That organization assesses the BCMS; a consultant can support preparation but cannot make the independent certification decision.

Before the audit, make sure responsible staff can explain their roles and locate current records. Readiness depends on the system your organization operates, not on a polished set of documents alone.

External reviewers may need to speak with staff and examine evidence from different parts of the organization. Make sure relevant teams understand how continuity work connects to their daily tasks.

Assign an internal owner who can coordinate documentation, staff input, and evidence throughout the project.

Testing Plans Through Exercises

A continuity plan is only useful if your team has tested whether people can carry it out under pressure. ISO 22301 Clause 8.5 requires testing and evaluation of business continuity plans.

An exercise helps you check whether instructions, roles, and communication routes work as intended. It should leave evidence, practical learning, and corrective actions that improve the arrangements.

ISO 22301 does not set a universal exercise frequency. Set a schedule that reflects risk and your organization’s circumstances, including changes to services, people, suppliers, or systems.

A low-impact activity may need a different testing approach from a service that customers rely on throughout the day. Changes to a critical dependency may also be a reason to test sooner.

Choose an exercise that matches the question your team needs to answer. Options can include:

• A tabletop discussion about roles and decisions
• A communications test for staff or response teams
• A power interruption scenario at a critical site
• A connectivity failure scenario for key systems
• A supplier disruption scenario affecting a priority activity

A tabletop discussion lets staff talk through a scenario without changing live operations. A communications test can show whether contact details and escalation routes work when people are away from their usual desks.

Exercise findings may show that a backup step depends on one person or an old phone number. Record the gap and assign a fix rather than treating the exercise as a pass-or-fail event.

An exercise is a planned practice or simulation, not a real incident. Real events can also reveal weaknesses and should inform plan review, even when teams responded well.

Choose scenarios that reflect credible threats to your critical operations. A supplier disruption, for example, may affect service delivery even when your own site and staff remain available.

Record exercise outcomes and assign owners and due dates for corrective actions.

What the CBN Ring-Fencing Draft Proposes

A June 10, 2026 CBN exposure draft proposes additional continuity and ring-fencing controls for certain closely linked financial entities. The CBN Exposure Draft Guidelines on Ring-Fencing Operations of Closely Linked Entities in the Nigerian Financial System is a proposal, not an adopted requirement.

The draft addresses business continuity for critical operations and arrangements between regulated entities and shared-service providers. Its proposals should not be treated as current operating rules simply because they appear in the exposure draft.

Which regulated entities may fall within scope

The draft would apply to CBN-licensed institutions and could extend through inter-regulatory cooperation to affiliated entities supervised by other financial-sector regulators. That possible extension depends on cooperation between regulators.

The proposal would require regulated entities to test business continuity plans for critical operations at least twice annually. This twice-yearly schedule is a draft provision, not a rule already in force.

Its proposed scope focuses on closely linked entities in the Nigerian financial system. An organization’s status and relationships would shape whether the draft could apply to it.

What shared-services arrangements must address

The draft would require shared-services arrangements to use service-level agreements covering continuity measures and the parties’ response duties. It also proposes exit rights, substitution arrangements, and prior written CBN approval.

The four proposed safeguards for these arrangements are:

• Business continuity measures in the service-level agreement
• Exit rights for the regulated entity
• Substitution arrangements for shared services
• Prior written CBN approval

These provisions remain proposals in the exposure draft. A service-level agreement can describe how a shared service would continue or change, but the proposed requirements do not become binding just by appearing in the draft.

Regulated organizations should confirm the status and applicability of any proposal with the relevant regulator before treating it as an operating obligation.

Certification Audits and Renewal

External certification is assessed in two stages, beginning with a review of readiness and followed by a closer evaluation of implementation. The certification body conducts this independent assessment.

The audit checks whether the BCMS meets ISO 22301 requirements and operates in practice. Your team should be ready to explain how its processes work and show relevant records.

What happens during the two audit stages

Stage 1 reviews readiness and documented information. The certification body considers the BCMS scope, system documents, and preparation for the next stage.

Stage 2 assesses whether the system is implemented and effective. Auditors may review records, speak with staff, and examine how the organization carries out its arrangements.

The two stages serve different purposes. Stage 1 looks at whether the system is ready for assessment, while Stage 2 looks at its use and results.

If an audit identifies a finding, your organization may need to take corrective action. The certification body handles the independent assessment and its decision under its own process.

Maintaining certification through the audit cycle

An ISO 22301 certificate is valid for three years. Annual surveillance audits take place in years one and two, and recertification takes place before the three-year term ends.

Surveillance gives the certification body a way to check that your BCMS continues to operate. Keep the system active between visits, rather than treating the first audit as the end of the work.

Changes to services, suppliers, staff roles, or sites may affect continuity arrangements during the certificate term. Updated records help show that the organization has kept the system aligned with its operations.

Continual operation matters because the organization’s needs can change after certification. Staff should use the current plans and bring gaps to the people responsible for continuity.

Keep continuity plans, exercise results, and corrective actions current throughout the certificate term.

Choosing a Certification Body

Verify the certification body’s current accreditation and the scope that covers ISO 22301 before comparing its audit proposal. A certification body audits and certifies your system, while an accreditation body assesses certification bodies.

Accreditation can provide evidence that a certification body has been assessed for a defined scope. It does not replace your own check that the scope and audit approach fit your organization.

Verify current accreditation and recognition

The International Accreditation Forum (IAF) was no longer operational as of January 1, 2026. IAF directs users to Global Accreditation Cooperation Incorporated for current information.

The IAF Multilateral Recognition Arrangement (MLA) was intended to give confidence that equivalent certification bodies, accredited by signatory accreditation bodies, worked to the same standard across economies. This describes the arrangement’s intended assurance, not a claim that IAF is currently operational.

Check that the certification body’s accreditation scope covers ISO 22301 and the relevant activities. A general accreditation claim may not show that the specific standard falls within its approved scope.

Compare scope, audit approach, and communication

Ask about the body’s experience with your industry and the kinds of operations included in your scope. Relevant experience can help auditors understand the setting without changing the requirements they assess.

Compare audit expectations, including how the body plans the assessment and handles follow-up. Clear communication helps your team know what information and access the audit will need.

Read the contract for the audit scope, fees, responsibilities, and any conditions that affect the service. Make sure the offer names the certification body that will conduct the independent assessment.

Confirm who makes the certification decision and what arrangements apply if an audit finding needs follow-up.

What Drives Certification Cost in Nigeria?

Your project cost is shaped by how much continuity work your organization needs and how complex its operations are. A defined scope helps show what work is involved before you compare proposals.

There is no single fee that fits every organization. The cost depends on the scope of work, your current arrangements, and the resources needed to prepare and assess the BCMS.

Scope and complexity shape the work

The number of locations can affect how much planning and coordination the project needs. Multiple sites may have different staff, systems, facilities, and local suppliers to consider.

Critical activities and dependencies also shape the work. A business with several customer-facing services and complex supply links may need more analysis than one with a narrow operating scope.

Existing continuity arrangements affect readiness. If policies, plans, and staff roles already work well, the project may focus on gaps rather than building those arrangements from the start.

Exercise requirements and your internal capacity matter too. Teams with time and skills to provide information or manage tasks may need less outside support for those activities.

Separate consulting work from audit fees

Consulting fees cover support such as reviewing your current system, helping develop arrangements, or preparing staff for assessment. You can define which tasks a consultant will perform in a proposal.

Certification body audit fees are separate from consulting fees. The certification body independently assesses the system, while a consultant may help your organization prepare.

Request a scope-specific proposal that states assumptions, deliverables, responsibilities, and exclusions. Ask whether the offer covers all locations and activities included in your intended scope.

A clear proposal makes it easier to compare the work each provider has priced. Compare proposals by scope, deliverables, responsibilities, and exclusions rather than by a headline figure alone.

Preparing Staff, Suppliers, and Clients

People and external dependencies determine whether a written continuity arrangement can be carried out during a real disruption. Your staff need clear roles, and your plans need to account for suppliers and customers.

Role assignments help employees know who makes decisions and who communicates updates. Escalation routes show where to raise an issue when the usual contact cannot respond.

Alternate contacts can help teams reach the right people if a main phone or email route fails. Staff communication arrangements should explain how people will receive instructions during an incident.

Supplier and vendor relationships can affect business continuity management. Check which providers support critical services and whether your team has a way to contact them during a disruption.

For example, if a supplier cannot deliver a component, a manufacturer may be unable to complete a priority order. Your team needs to know who assesses the impact and who contacts affected clients.

Certification does not ensure that a supplier will perform or remain available. Your organization still needs to understand its dependencies and prepare a response that fits them.

Use these readiness checks to see whether key responsibilities are clear:

• Named role owners for continuity tasks
• Staff communication routes for disruption
• Critical supplier contacts and alternate routes
• Customer notification responsibilities

These checks can reveal gaps before a team needs to act under pressure. For instance, a listed supplier contact may have left the company or changed roles.

Check that each critical supplier has a named internal owner and a workable contact route.

Mecer Consulting Support for Your BCMS

If you are considering ISO 22301 certification or preparing for accreditation, Mecer Consulting can discuss the support your organization needs. The conversation can help you explain your current arrangements and the challenges you want to address.

Mecer Consulting supports organizations considering certification or preparing for accreditation. You can discuss the requirements that apply to your organization and how its activities shape the BCMS scope.

Useful details include the services you need to protect, the sites involved, and the people responsible for continuity. Your team can also describe existing plans, supplier links, and any work already completed.

The aim is to understand the support that fits your needs, not to promise a certificate or a specific result. Certification remains an independent decision made by a certification body after assessment.

You can contact Mecer Consulting by email at cc@mecer.consulting or by phone at +234 905 505 1921. Share your organization’s scope, critical activities, and current preparation needs when you make contact.

Conclusion

A resilient organization is built by making continuity part of day-to-day management, not by treating certification as a document-only exercise. Certification depends on a BCMS that operates, gets tested, and stays current as your organization changes.

Your next step is to identify the critical service that matters most and its main dependencies. Identify your highest-priority service and contact Mecer Consulting at ceo@mecer.consulting or +234 905 505 1921 to discuss your requirements.

FAQ