ISO 22316

Engage stakeholders and build trust through transparent communication, consultation, and commitment to shared outcomes.

• Stakeholder engagement plan
• Trust or reputation survey results
• Records of stakeholder consultations on resilience

• Engagement reactive not planned
• Trust not measured
• Communications one way only

Establish a clearly articulated vision, purpose, and values that align the organization and provide direction during disruption.

• Published vision and purpose statement
• Values handbook or intranet page
• Employee survey results on clarity of purpose

• Vision not referenced in resilience policy
• No measurement of staff understanding
• Disconnect between stated values and resilience decisions

Maintain awareness of the operating environment and influence factors that affect resilience outcomes.

• Horizon scan reports (quarterly)
• Regulatory and threat watch logs
• Trade body or policy engagement records

• No horizon scanning function
• Context inputs not feeding risk register
• Influence activity not documented

Leaders provide direction, allocate resources, and empower decision making across the organization to support resilience.

• Resilience steering committee charter
• Delegation of authority matrix
• Crisis decision logs with named decision makers

• Decision authority unclear in crisis
• Steering committee meets less than quarterly
• No leadership development for resilience

Foster a culture where staff at all levels recognize their role in resilience and behave consistently with shared values.

• Culture survey results
• Behavioural competency framework
• Recognition or reward program tied to resilience behaviours

• Culture measured but not acted on
• No link between performance reviews and resilience behaviour
• Recognition limited to incident response heroics

Ensure information and lessons are captured, shared, and accessible across functions to support informed decisions.

• Knowledge base or wiki
• Lessons learned register
• Cross functional information sharing protocols

• Lessons captured but not actioned
• Knowledge siloed in teams
• No retention policy for incident knowledge

Identify and provide the resources, including people, finance, technology, and infrastructure, needed for resilience.

• Resilience capability inventory
• Annual resilience budget
• Resource gap analysis with mitigation plans

• Resilience budget not ring fenced
• Critical skills concentrated in few individuals
• No succession plan for resilience leads

Integrate risk, security, business continuity, crisis, safety, and related disciplines to deliver coherent resilience outcomes.

• Integrated management system map
• Joint risk and BCM committee minutes
• Multi discipline exercise reports

• Disciplines operate in silos
• No common taxonomy across teams
• Exercises test only one discipline at a time

Apply continual improvement processes to learn from events, exercises, audits, and reviews and to mature resilience capability.

• Resilience maturity assessment results
• Improvement action register with owners
• Audit and exercise follow up tracker

• Maturity assessed once and not repeated
• Improvement actions overdue
• No closure verification on lessons

Anticipate, respond to, and manage internal and external change to sustain resilience over time.

• Change impact assessment templates
• Scenario planning outputs
• Adaptation roadmaps tied to strategic plan

• Change management focused on IT only
• Scenarios not refreshed annually
• No link between change pipeline and resilience risk

Evaluate the effectiveness of resilience attributes through measurement, review, and assurance activities.

• Resilience KPI dashboard
• Internal audit reports
• Annual management review minutes

• KPIs measure activity not outcomes
• Management review skipped or delegated
• No independent assurance on resilience

Integrate resilience evaluation outputs into strategic planning, investment decisions, and risk appetite reviews.

• Strategic plan referencing resilience evaluation
• Investment business cases citing resilience evidence
• Risk appetite statement reviewed against resilience posture

• Resilience evaluation not seen by board
• Strategy refresh ignores resilience inputs
• Risk appetite static for multiple years

Define the internal and external context, stakeholders, and scope within which organizational resilience is developed and applied.

• Context document (PESTLE/SWOT)
• Resilience scope statement signed by exec sponsor
• Stakeholder map with influence and interest ratings

• Resilience treated as BCM only
• No external context refresh cadence
• Stakeholder map missing regulators or supply partners

Business continuity policy. Control from ISO 22316 framework, domain: ISO 22316: BCM Program Management.

• resilience policy
• BIA report
• continuity strategy document

• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

BCM program scope and objectives. Control from ISO 22316 framework, domain: ISO 22316: BCM Program Management.

• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy
• BIA report

• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement

Resource allocation for BCM. Control from ISO 22316 framework, domain: ISO 22316: BCM Program Management.

• continuity strategy document
• exercise schedule
• plan maintenance log

• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

BCM roles and responsibilities. Control from ISO 22316 framework, domain: ISO 22316: BCM Program Management.

• leadership commitment statement
• resilience policy
• BIA report
• continuity strategy document

• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes

Management commitment to BCM. Control from ISO 22316 framework, domain: ISO 22316: BCM Program Management.

• continuity strategy document
• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy

• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping

Exercise program development. Control from ISO 22316 framework, domain: ISO 22316: BCM Testing & Exercising.

• plan maintenance log
• leadership commitment statement
• resilience policy

• missing leadership engagement
• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement

Tabletop and simulation exercises. Control from ISO 22316 framework, domain: ISO 22316: BCM Testing & Exercising.

• BIA report
• continuity strategy document
• exercise schedule
• plan maintenance log

• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping

Full-scale testing procedures. Control from ISO 22316 framework, domain: ISO 22316: BCM Testing & Exercising.

• plan maintenance log
• leadership commitment statement
• resilience policy
• BIA report
• continuity strategy document

• missing leadership engagement
• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes

Post-exercise review and improvement. Control from ISO 22316 framework, domain: ISO 22316: BCM Testing & Exercising.

• leadership commitment statement
• resilience policy
• BIA report

• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

Plan maintenance and update. Control from ISO 22316 framework, domain: ISO 22316: BCM Testing & Exercising.

• plan maintenance log
• leadership commitment statement
• resilience policy

• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping

Continuity strategy development. Control from ISO 22316 framework, domain: ISO 22316: Business Continuity Strategy.

• BIA report
• continuity strategy document
• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy

• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping
• insufficient exercise scope

Recovery strategy for critical activities. Control from ISO 22316 framework, domain: ISO 22316: Business Continuity Strategy.

• exercise schedule
• plan maintenance log
• leadership commitment statement

• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes

Alternate site and resource planning. Control from ISO 22316 framework, domain: ISO 22316: Business Continuity Strategy.

• plan maintenance log
• leadership commitment statement
• resilience policy
• BIA report
• continuity strategy document

• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

Supply chain continuity. Control from ISO 22316 framework, domain: ISO 22316: Business Continuity Strategy.

• BIA report
• continuity strategy document
• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy

• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

Communication strategy during disruption. Control from ISO 22316 framework, domain: ISO 22316: Business Continuity Strategy.

• exercise schedule
• plan maintenance log
• leadership commitment statement

• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping

Business impact analysis methodology. Control from ISO 22316 framework, domain: ISO 22316: Business Impact Analysis.

• continuity strategy document
• exercise schedule
• plan maintenance log
• leadership commitment statement

• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

Critical activity identification. Control from ISO 22316 framework, domain: ISO 22316: Business Impact Analysis.

• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy
• BIA report

• weak interdependency mapping
• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes

Recovery time and point objectives. Control from ISO 22316 framework, domain: ISO 22316: Business Impact Analysis.

• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy
• BIA report

• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping

Resource requirements assessment. Control from ISO 22316 framework, domain: ISO 22316: Business Impact Analysis.

• exercise schedule
• plan maintenance log
• leadership commitment statement
• resilience policy

• insufficient exercise scope
• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement

Interdependency mapping. Control from ISO 22316 framework, domain: ISO 22316: Business Impact Analysis.

• resilience policy
• BIA report
• continuity strategy document

• gaps in continual improvement
• unclear resilience attributes
• missing leadership engagement
• weak interdependency mapping
• insufficient exercise scope