ISO 22301 for Food Manufacturers: Closing the Business Continuity Audit Gap

Written by Dr Shalen Sehgal | Crises Control  

ISO 22301 is the international standard for business continuity management systems, setting out exactly what an organisation has to do to keep critical operations running when something goes wrong and to prove it did so when an auditor asks. It is built around six requirements: leadership commitment, risk and impact analysis, documented response plans, defined roles, regular testing, and a continuous audit trail. 

For food manufacturers, ISO 22301 has a sharper edge. It is the standard that retailer technical agreements, retailer audits, and, increasingly, insurers expect to see in place. Failure to maintain it does not just risk certification; it risks contracts. The average UK food recall already costs an estimated 6 million pounds before reputational damage is counted (Food Manufacture / GS1 UK 2023), and the audit gap is where most of that cost gets locked in. 

What is ISO 22301 for food manufacturers? 

ISO 22301 for food manufacturers is the business continuity management standard applied to food production, covering contamination, recall, supply chain failure, and safety events. It requires documented plans, named roles, multi-channel notification, regular testing, and a continuous audit trail that aligns with HACCP and BRCGS workflows. 

It is Tuesday morning at a chilled prepared-foods plant in the Midlands. The BSI auditor sits down with the technical director and asks a single question: show me the evidence. Not the plan, the evidence. Every alert sent during the listeria swab incident in March, every acknowledgement received, every decision logged with a timestamp, every task completed, every retailer notification timed against the window. 

The plan exists. It is on the shared drive. The technical director scrolls through emails, group chat exports, and a partially completed post-incident review form. Three hours later, the auditor closes the meeting with a major non-conformance. The certification is deferred. The largest retailer’s customer technical team is informed within 48 hours under contract terms. The site is given six months to close the gap. 

ISO 22301 audits in food manufacturing fail for one reason more than any other. No defensible audit trail when something actually goes wrong. 

Why ISO 22301 is harder for food manufacturers than other sectors 

Most published guidance on ISO 22301 is written for office-based organisations. Banking. Insurance. Professional services. The standard reads cleanly when applied to those environments. Food manufacturing breaks the assumptions on the first page. 

Production runs across three shifts, seven days a week, with seasonal contractors, agency staff, and third-party hauliers who are not on the regular HR system. The people most likely to first detect a continuity-relevant event, whether a contamination swab, a utility failure, or a supplier delivery problem, are not the people sitting at desks watching their email. The chain of custody on every batch is regulated independently of business continuity. Every minute of confusion adds to the recall window. The cost is not just downtime; it is product on shelves that has to come back. 

There is also the matter of who needs to know, and how fast. A continuity event in food manufacturing triggers obligations to the Food Standards Agency, retailer technical teams, environmental health officers, the head office, the brand team, and often the public, all on different timelines defined by hazard category. None of those obligations can be evidenced from a shared drive after the fact. 

UK food businesses issued 1,386 product recalls and withdrawals between 2019 and 2023, with allergen and pathogen contamination as the two leading causes (Food Standards Agency 2024).

The 6 evidence categories ISO 22301 requires from food manufacturers 

ISO 22301 certification rests on six categories of evidence. Each one has to be defensible under audit, and each one is where most food manufacturing sites have a gap.

1. Leadership commitment and policy

Documented evidence that senior leadership has signed off on the business continuity policy, allocated resources, and integrated it into the management system. This is the easiest category to evidence on paper and the one most often disconnected from operational reality. Auditors increasingly cross-check leadership sign-off against actual exercise participation. A signature on a policy that the signatory has never tested is a finding.

2. Risk assessment and business impact analysis

A documented risk assessment that identifies disruption scenarios specific to the site, with a business impact analysis defining the maximum tolerable period of disruption for each critical function. For food manufacturing, this has to align with the existing HACCP plan and the BRCGS standards. Generic BIAs that ignore site-specific food-safety triggers are the most common reason this category fails.

3. Documented response plans with named roles

Plans for each disruption scenario, with named roles, deputies, and escalation paths. Not generic role names, named individuals with documented backups. Plans that name a single technical director with no deputy fail this category as soon as the auditor asks what happens when that person is unreachable. Single points of contact are the most common failure mode in food manufacturing continuity events.

4. Multi-channel notification with confirmation

Evidence that the organisation can reach all relevant personnel across multiple channels, with two-way confirmation. SMS, voice, email, push, and app, with timestamped acknowledgement. Email-only setups fail this category by default. Phone-tree setups fail because they cannot evidence acknowledgement timing. 

A signature on a policy is not a commitment. A signature against a logged exercise is. Auditors have learned the difference.

5. Regular testing under realistic conditions

Documented exercises that test the plan under conditions resembling a real incident. Tabletop sessions where everyone is in the same room with coffee do not count. Auditors increasingly want to see live exercises with multi-shift participation, contractor inclusion, and timed responses. The exercise log has to show what worked, what failed, and what was changed as a result.

6. Continuous audit trail captured automatically

This is where most food manufacturing sites fail. Every alert, every acknowledgement, every escalation, every decision, every task, and every retailer notification is captured automatically against a timestamp. That trail is what the BSI auditor, the FSA, the retailer technical team, and ISO 22301 itself require. Without it, the response cannot be evidenced. With it, the site can demonstrate every regulatory and contractual obligation in a report rather than a forensic exercise.