ISO 22301: why the recurring cost outweighs the first one

We do not publish price ranges, and certification-body fees are not ours to state. What follows is the shape of the recurring commitment and who each part is paid to, which is the part budgets actually get wrong.

Three different payees, one budget line

Recurring cost is usually presented as a single number. It is three, and they behave differently.

Why continuity is heavier than most

For many management systems, maintenance between audits is largely documentary. Continuity is not, because the standard requires an exercising and testing programme, internal audit and management review, and a business impact analysis that remains current as the organisation changes.³

Two of those cannot be satisfied by a document review.

• Exercising. The evidence is the exercise itself, and a credible programme is more than one tabletop a year. It extends to scenario tests, supplier and failover checks, and the management time to run them and act on the findings. An exercise designed so it cannot fail will not turn up anything, and that absence of findings should itself be treated as a warning sign.
• Impact analysis currency. The analysis is only as good as the organisation it describes. New sites, restructures, changed suppliers and departed staff all invalidate parts of it, and none of those events announces itself to the continuity programme.

This is the line organisations underestimate most, and it is the reason a continuity certificate decays faster than a quality one when the programme goes quiet. Keeping that cadence running is the core of business continuity consultancy under ISO 22301 and NCEMA 7000.

What raises the bar in the UAE

Regulated firms carry obligations that make demonstrated capability the test rather than documented capability. DIFC and ADGM rules require continuity arrangements to be kept up to date and regularly tested; the Central Bank requires banks to review and test their plans at least annually, with results reported to the Board.⁴

NCEMA 7000 is a UAE national standard. Its application depends on the organisation’s mandate, supervising authority and contractual obligations rather than the emirate in which an office is registered. It applies to UAE federal and government entities, and may extend through government or contractual requirements to suppliers, contractors and partners.

The practical consequence is that a buyer or supervisor is likely to ask when you last tested the plan, not when you were certified. A programme that stops after the certificate cannot answer that question well.

What decay actually costs

A system that has not been exercised, whose impact analysis is two years old, and whose plans name people who have left does not coast quietly to its next audit. It arrives with findings, and closing findings under time pressure costs more than maintenance would have: in fees, in internal disruption, and occasionally in the certificate itself.

The pattern we see is consistent: organisations that budget the recurring programme from the start run it at a steady cadence and spend less. Those that treat certification as a finish line pay twice, once to certify and again to rebuild what was allowed to lapse. That is an observation from our engagements rather than a measured claim.

Budgeting the full cycle

• Budget across the whole cycle, not the first year: surveillance, recertification, exercising, impact-analysis refresh, internal audit and management review, and awareness for new starters.
• Decide early what is run in-house and what is outsourced, and price both ways before committing.
• Ask every bidder to separate their fees from certification-body fees and from your own internal effort.
• Size the programme to the risks that matter, not to what will impress an auditor. A system sized for the audit tends to cost more to run and deliver less in practice.