ISO 22316: ISO 22316 – Tutorial (about 60 minutes)

ISO 22316 is the international guidance standard on organizational resilience: the ability of an organization to absorb shocks and adapt as its environment changes, so that it keeps delivering its objectives and can survive and prosper. Boards, executives, risk, continuity, security, quality and operations leaders in companies and public bodies of every size use it to talk about resilience in one shared language and to judge where their organization is strong or fragile. After this tutorial you will be able to explain its principles and nine attributes, use them to evaluate a real organization, and connect the guidance to the management systems you already run.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 22316:2017, Security and resilience — Organizational resilience — Principles and attributes, the first edition, published in March 2017 by ISO technical committee ISO/TC 292 (Security and resilience). After a systematic review ISO set its status to "to be revised" (stage 90.92) in February 2023. A second edition, ISO/FDIS 22316 with the new title Security and resilience — Organizational resilience — Guidelines, has passed its public draft (DIS) stage and was registered for formal approval as a final draft (stage 50.00) on 2026-07-06; it had not been published when this tutorial was checked. Until the new edition is published, ISO 22316:2017 is the edition in force, and it is the edition this tutorial teaches. Lesson 7 summarises what has been reported publicly about the direction of the revision. Verified 2026-10-29 on the ISO catalogue entries for ISO 22316:2017 and ISO/FDIS 22316, on a national standards-body project listing and on the Resilience First announcement of the draft.

Who this is for: managers and specialists in risk, business continuity, information security, quality, health and safety, operations, supply chain and HR; site reliability and platform engineers who are asked to "make the organization more resilient", not only the systems; internal auditors and consultants who need a structured way to look at resilience; and executives who sponsor resilience programmes. It is also a good starting point for anyone who works with ISO 22301 and wants to see the wider picture.

Prerequisites: none. A general idea of how an organization is governed (board, top management, departments, suppliers, customers) helps. Every resilience and management term is explained the first time it appears. Experience with ISO management-system standards such as ISO 9001, ISO/IEC 27001 or ISO 22301 makes some ideas feel familiar but is not needed.

By the end of this tutorial:

You will be able to explain what organizational resilience means in ISO 22316, why the standard exists and how it differs from business continuity management.
You will be able to define the key vocabulary, including absorb, adapt, context, principle, attribute and management discipline.
You will be able to describe the structure of ISO 22316:2017: its scope, its principles, its nine attributes and its guidance on evaluation.
You will be able to apply the attributes to a real organization, collect evidence for each one and turn the findings into a prioritised improvement plan.
You will be able to explain why ISO 22316 is not a certification standard and describe credible ways to assess and report resilience instead.
You will be able to relate ISO 22316 to ISO 22301, ISO 31000, BS 65000 and other neighbouring standards, and explain where each one fits.

Lesson 1 – Origins, purpose and scope

Why a resilience standard was needed

For decades organizations protected themselves through separate specialist functions. A risk team kept a risk register, a business continuity team wrote recovery plans, an IT team ran backups and disaster recovery, a security team handled physical and cyber threats, a health and safety team looked after people, and a finance team managed liquidity and insurance. Each discipline did useful work, but each looked at the organization through its own lens. When a large and unexpected event arrived, such as a pandemic, a regional flood, the failure of a major supplier or a sudden change in regulation, the gaps between those lenses were where organizations failed. Plans assumed that the other departments would cope, information did not flow, decisions waited for someone with authority, and nobody owned the question "can we, as a whole, keep doing what we exist to do?"

At the same time, many of the threats that hurt organizations most are not sudden disasters at all. A slow loss of skilled staff, a customer base that is moving to a new technology, a business model that depends on cheap energy, or a culture in which bad news is hidden can all damage an organization more than a fire. Traditional continuity planning is excellent for disruptions that can be described in advance as scenarios. It is weaker for gradual change and for surprises nobody predicted.

Organizational resilience is the idea that ties these concerns together. It asks whether the organization as a whole can absorb a shock, keep its essential purpose, adapt to new conditions and come out of the experience able to thrive. In the United Kingdom, the British Standards Institution published BS 65000, a guidance document on organizational resilience, in 2014. Internationally, the ISO committee responsible for security and resilience, ISO/TC 292, developed ISO 22316 to give a common, global description of what a resilient organization looks like. It was published in 2017.

What the standard is for

ISO 22316 has a modest and practical purpose. It does not tell you how to build a particular plan or system. Instead it gives a framework of principles and attributes that help an organization to understand what contributes to its resilience, to discuss that topic consistently from the boardroom to the front line, and to evaluate and improve its own resilience over time. Think of it as a map of the territory rather than a set of directions. It answers questions such as: What does a resilient organization tend to have in common? What should top management pay attention to? How can we tell whether we are getting better?

The standard's own message is that resilience is not achieved by one department or one project. It results from many activities that are coordinated across the whole organization, and it is shaped by leadership and culture as much as by procedures. For that reason the guidance gives the central role in enabling resilience to top management, the people who direct and control the organization at the highest level, because only they can align the various disciplines behind a shared purpose.

Scope

The scope of ISO 22316:2017 is deliberately broad. It gives guidance for enhancing organizational resilience in any organization, of any size or type, private, public or not-for-profit. It is not specific to an industry or sector, and it can be applied throughout the life of an organization, from a start-up to a mature multinational. It also makes clear that it does not promote one uniform approach: each organization chooses its own objectives and initiatives to suit its needs, its context and its appetite for risk.

Two features of the scope are important for beginners. First, ISO 22316 is a guidance standard. It uses "should" to express recommendations rather than "shall" to express requirements. That makes it very different from ISO 22301 or ISO/IEC 27001, which contain auditable requirements. Second, it is short, about ten pages in the ISO catalogue, so it is a document that busy executives can actually read; it points to related standards in its bibliography.

Where it sits in the ISO resilience family

ISO/TC 292 publishes a family of documents on security and resilience. Inside that family ISO 22316 plays the role of an umbrella. Business continuity (ISO 22301 and its guidance ISO 22313), emergency management (ISO 22320 and related documents), supply chain security and other topics each address a part of the picture. ISO 22316 describes the whole picture and explains that those parts must work together. The shared vocabulary for the family is kept in ISO 22300.

Figure 1 – How ISO 22316 connects principles, attributes, leadership and coordinated disciplines to the capacity to absorb and adapt.

Lesson 2 – Key concepts and vocabulary

ISO 22316 defines very few terms of its own; its central term is organizational resilience, and much of the related vocabulary of the security and resilience family is collected in ISO 22300 or comes from ordinary management language. The terms below are explained in plain words. They are not the official definitions, which you should read in the standards themselves.

Organizational resilience – the ability of an organization to absorb and adapt in a changing environment. ISO 22316 links this ability to two outcomes: delivering the organization's objectives and being able to survive and prosper.
Absorb – to withstand a shock or stress without losing the organization's essential functions, for example by using spare capacity, alternative suppliers, cash reserves or well-practised response plans.
Adapt – to change the way the organization works, what it offers or how it is organised so that it fits new conditions. Adaptation can be a quick improvisation during a crisis or a long-term transformation.
Changing environment – the full range of change the organization faces, from sudden disruptive events (a cyber attack, a storm) to slow, incremental shifts (demographics, technology, climate, customer expectations).
Context – the internal and external conditions that affect the organization: its strategy, structure, people, culture and capabilities on the inside; markets, competitors, regulators, society, the natural environment and technology on the outside. The term is used in the same way in ISO 31000 and ISO management-system standards.
Interested parties – people and organizations that can affect, be affected by, or believe themselves affected by the organization's decisions: customers, staff, owners, suppliers, regulators, communities. ISO standards often call them stakeholders as well.
Principle – in ISO 22316, a fundamental belief about how resilient organizations behave. Principles guide judgement; they are not tasks to tick off.
Attribute – a characteristic or capability that contributes to resilience. ISO 22316:2017 describes nine. Attributes can be observed and evaluated, which makes them the practical core of the standard.
Management discipline – an established field of management practice with its own methods, such as risk management, business continuity, emergency management, information security, physical security, financial management, supply chain management, human resources, health and safety, quality, environmental management and IT service management.
Top management – the person or group who directs and controls the organization at the highest level, for example a board and executive team. ISO 22316 places the main responsibility for enabling resilience with them.
Risk – in the ISO sense, the effect of uncertainty on objectives. Risk can be negative (a threat) or positive (an opportunity). Resilient organizations look for both.
Disruption – an incident or change that interrupts the normal delivery of products and services. Disruption is a strong test of resilience but not the only one.
Continual improvement – recurring activity to enhance performance. In ISO 22316 it applies to resilience itself: learning from events, near misses and evaluations and acting on what is learned.
Guidance standard – a standard that recommends rather than requires. You implement it to the extent that it makes sense, and you cannot be certified against it in the way you can be certified against a requirements standard.

Resilience as a capacity, not a state

A common misunderstanding is that an organization either "is resilient" or "is not". ISO 22316 treats resilience as a capacity that can be stronger or weaker, and that changes as the organization and its environment change. A company that was very resilient five years ago may be fragile today if its markets have shifted, its experienced staff have left or its systems have become tightly coupled. That is why the standard emphasises evaluation and improvement rather than one-off achievement.

Absorb and adapt together

The two verbs in the definition pull in slightly different directions. Absorption is about robustness: buffers, redundancy, protection and rehearsed response. Adaptation is about flexibility: learning, innovation, the freedom to change processes and products. An organization that only absorbs may survive one crisis but fail to notice that the world has moved on. An organization that only adapts may chase every new idea and lack the stable base needed to weather a shock. ISO 22316 asks for a balance, and the right balance depends on the organization's purpose and environment. A nuclear operator and a software start-up will set it very differently.

Resilience and business continuity are not the same

Business continuity is the capability to continue delivering products and services within acceptable time frames at a predefined capacity during a disruption. It is a vital contributor to resilience, but it is narrower. It mostly addresses disruptive events that can be analysed in advance, and it is delivered through a defined management system. Organizational resilience also covers strategic adaptation, culture, leadership, financial strength, reputation and the ability to seize opportunities created by change. A company can have excellent continuity plans and still fail because its product became obsolete. ISO 22316 explicitly sees business continuity as one of several disciplines that must be coordinated.

Lesson 3 – Structure of the standard

ISO 22316:2017 is a short document. It does not follow the Harmonized Structure (clauses 4 to 10) used by ISO management-system standards, because it is not a management-system standard. Its main parts are listed below, paraphrased.

Introduction – explains why resilience matters, that it comes from the coordinated contribution of many disciplines, and that the guidance is intended to support a shared understanding across the organization.
Clause 1, Scope – guidance for any organization, any sector, any stage of life, with no uniform approach.
Clause 2, Normative references – the standard heading that every ISO document carries for other documents needed to apply it.
Clause 3, Terms and definitions – very short; the key definition is organizational resilience.
Clause 4, Principles – the beliefs on which enhanced resilience is based.
Clause 5, Attributes of a resilient organization – a general subclause followed by nine attributes (5.2 to 5.10), each with recommendations on what an organization should do.
Clause 6, Evaluating the factors that contribute to resilience – guidance on measuring and reviewing the attributes and using the results to improve.
Bibliography – related documents for further reading.

Figure 2 – The structure of ISO 22316:2017, from scope and terms to principles, attributes and evaluation.

Clause 4 – the seven principles (paraphrased)

The principles describe how resilient organizations tend to think and behave. In your own words, they say that resilience is enhanced when:

behaviour across the organization is aligned with a shared vision and purpose;
the organization keeps an up-to-date understanding of its context;
it is able to absorb, adapt and respond effectively to change;
it has good governance and management;
it draws on a diversity of skills, leadership, knowledge and experience;
it coordinates across management disciplines and uses contributions from technical and scientific areas of expertise;
it manages risk effectively.

Notice that none of these principles is a procedure. They describe qualities of thinking and organisation. The diversity principle, for example, recognises that groups made up of people with similar backgrounds tend to share the same blind spots; varied experience makes it more likely that someone will spot a weak signal or propose a workable alternative.

Clause 5 – the nine attributes

The general part of clause 5 explains that each organization's resilience comes from its own combination of strategic and operational factors, and that top management should enable the attributes by committing to them, providing resources, setting up a governance structure that coordinates resilience activities, investing in supporting systems, evaluating progress and communicating clearly. The nine attributes, with their subclause numbers, are:

Figure 3 – The nine attributes of ISO 22316:2017, grouped here (not in the standard) into direction, people and capability.

The grouping in Figure 3 is a teaching aid, not part of the standard. The standard lists the attributes in order without groups. A short paraphrase of each follows.

5.2 Shared vision and clarity of purpose – the organization has stated why it exists and what it is trying to achieve, top management communicates it, and people at all levels understand how their work contributes. In a crisis, a clear purpose tells people what to protect first.
5.3 Understanding and influencing context – the organization scans its internal and external environment, understands interested parties and their needs, identifies emerging threats and opportunities, and, where it can, shapes its environment (for example by working with suppliers, regulators or industry groups) rather than only reacting to it.
5.4 Effective and empowered leadership – leaders at all levels are trusted, act with integrity, can lead through uncertainty and disruption, and are developed for that role. Authority to act is delegated so that decisions are not blocked when senior people are unavailable.
5.5 A culture supportive of organizational resilience – shared values, beliefs and behaviours encourage people to report problems, raise concerns, learn from mistakes, cooperate across boundaries, innovate and take sensible ownership. The culture is understood, promoted by leaders and monitored for change.
5.6 Shared information and knowledge – information and knowledge are treated as critical resources. Lessons are captured from successes and failures, knowledge is not locked in one person's head, and information is accessible, understandable and good enough to support decisions.
5.7 Availability of resources – people, finance, facilities, technology, information and supplies are adequate and can be redeployed when needed. The organization reviews whether its resources remain suitable and correctly allocated as conditions change.
5.8 Development and coordination of management disciplines – the disciplines that contribute to resilience are each competent and, crucially, coordinated so that their activities support one another and leave no gaps.
5.9 Supporting continual improvement – the organization evaluates its performance, learns from events, exercises, audits and near misses, and acts on the results.
5.10 Ability to anticipate and manage change – the organization looks ahead, considers how its environment may change, and builds the flexibility to change strategy, structure, products or processes in time, including when change is sudden.

Clause 6 – evaluating the factors

Clause 6 turns the attributes into something an organization can measure and manage. It recommends that top management set the objectives of evaluation, the criteria and methods of measurement, and the thresholds that define acceptable performance; decide how monitoring fits into existing processes; and decide how results are analysed and reported. It encourages the use of information that already exists, such as management reports, internal audits, incident reviews and project reports, and it recommends both an initial assessment and periodic reviews when the organization or its context changes. Lesson 5 looks at how this works in practice.

Attributes in practice: what evidence looks like

Attribute	What you would expect to see	Warning signs
Shared vision and purpose	Staff can explain the organization's core purpose and its most important services	Each department has different priorities and no one can say what to protect first
Understanding and influencing context	Regular horizon scanning, stakeholder mapping, scenario discussions at board level	Strategy is set once every few years and never revisited
Empowered leadership	Delegated authority, deputies trained, leaders practise decisions in exercises	Every decision waits for one executive
Supportive culture	Near misses are reported and discussed without blame	Bad news is hidden until it becomes a crisis
Shared information and knowledge	Lessons-learned process, documented know-how, accessible dashboards	Critical knowledge held by one long-serving engineer
Availability of resources	Reserves, cross-trained staff, alternative suppliers, tested backups	Everything is optimised for efficiency with no slack
Coordinated disciplines	A resilience forum where risk, continuity, security, IT, HR and finance plan together	Each function has its own register and plans that contradict each other
Continual improvement	Actions from reviews tracked to closure	The same problems appear in every incident report
Anticipating and managing change	Change programmes include resilience reviews; strategy options are prepared	Major changes are made without considering how they shift risk

Lesson 4 – How it works in practice

Because ISO 22316 is guidance, there is no single prescribed implementation method. Organizations that use it well tend to follow a pattern that you can adapt. The pattern below is a practical synthesis, not a sequence of steps taken from the standard.

Step 1 – Secure top management sponsorship

Resilience crosses every department, so it needs an owner at the top. Typically a board member or the chief executive sponsors the work, and a senior manager (sometimes called a chief resilience officer or head of resilience) coordinates it. The sponsor's first job is to agree what resilience means for this organization: which purposes and services are essential, what level of disruption or change it must be able to withstand, and how resilience fits into strategy. Without that conversation the programme tends to become another continuity project.

Step 2 – Set up coordination across disciplines

Next, the organization creates a governance structure that brings the contributing disciplines together. A common form is a resilience steering group with representatives from risk, business continuity, crisis management, information security, physical security, IT operations, supply chain, finance, HR, health and safety, communications and the main business units. The group's purpose is coordination: aligning priorities, sharing information, avoiding duplicated effort and finding gaps between areas of responsibility. It does not replace the disciplines; it makes them work as a system.

Step 3 – Understand context and purpose

The group then builds a shared view of the organization's purpose and context. Useful inputs include the strategy, the list of key products and services, results of business impact analysis if the organization runs a continuity programme, the enterprise risk register, horizon-scanning reports, stakeholder analysis, and major change programmes. The question is not only "what could go wrong?" but also "what is changing around us, and what would we need to change in response?"

Step 4 – Baseline the attributes

The organization evaluates where it stands on each of the nine attributes. It agrees, with top management, the criteria and a simple rating scale, and gathers evidence from documents, interviews, surveys, incident reports and exercises. Many organizations combine a self-assessment workshop with a staff survey on culture and leadership, because those attributes are hard to judge from documents alone. The output is a resilience profile that shows strengths and weaknesses, supported by evidence rather than opinion.

Step 5 – Prioritise and plan improvements

Not every weakness matters equally. The organization prioritises improvements that protect its essential purpose, that address the most likely or most damaging changes, and that strengthen several attributes at once. For example, a cross-functional exercise programme can improve leadership, coordination, information sharing and continual improvement together. Improvements are assigned to owners in the relevant disciplines, with resources and deadlines, and folded into existing plans and budgets wherever possible so that resilience becomes part of normal management rather than a side project.

Step 6 – Monitor, evaluate and report

Following clause 6, the organization monitors a small set of indicators for each attribute, reviews them regularly, and reports results to top management. It repeats a fuller evaluation periodically and whenever something significant changes: a merger, a new market, a major incident, a big technology change or a shift in regulation. Each review feeds the next cycle of improvement.

Figure 4 – A practical evaluation and improvement cycle based on the guidance in clause 6.

Roles

Board and top management – own resilience, set purpose and risk appetite, provide resources, set evaluation criteria and thresholds, and act on results.
Resilience coordinator or steering group – coordinates the disciplines, runs evaluations, maintains the improvement plan and reports progress.
Discipline leads – deliver their part (risk, continuity, security, IT, HR, finance and so on) in a way that fits the shared picture.
Line managers and staff – live the culture, report weak signals and near misses, take part in exercises and suggest improvements.
Internal audit – gives independent assurance on whether evaluation is honest and whether improvements are delivered.

Typical artefacts

Because the standard does not require documents, artefacts vary. Common ones are a short resilience policy or statement of intent from the board, terms of reference for the steering group, a resilience profile or scorecard against the nine attributes, a list of indicators with thresholds, an improvement plan, exercise reports and lessons-learned records, and an annual resilience report to the board. Keep them light: the value lies in the conversations and decisions they support, not in the paperwork.

Lesson 5 – Assessment, certification and compliance

No certification against ISO 22316

ISO 22316 contains recommendations, not requirements, so there is nothing for a certification body to audit conformity against. Accredited certification schemes exist for requirements standards such as ISO 22301 or ISO 9001, not for guidance standards like ISO 22316. If someone offers you an "ISO 22316 certificate", treat it with caution: at most it can be a statement from a consultancy or training provider that an assessment or course took place, not an accredited certification. Some organizations do publish that they have "aligned with" or "used" ISO 22316, which is an honest description of a guidance standard.

How resilience is assessed instead

Organizations still need to know how resilient they are and to show it to boards, customers, regulators and investors. Common approaches include:

Self-assessment against the nine attributes, using agreed criteria and evidence, often facilitated in workshops with representatives from every discipline.
Maturity models that describe several levels for each attribute (for example from ad hoc to embedded). ISO 22316 does not define maturity levels; any levels are created by the organization or a third party.
Surveys and interviews to judge culture, leadership and information sharing, which are hard to see in documents.
Exercises and stress tests that challenge the organization with severe but plausible scenarios and observe how it absorbs and adapts.
Analysis of real events: how the organization performed in incidents and near misses, and whether lessons were acted on.
Independent review by internal audit or an external adviser to check that the assessment is balanced and that improvement actions are completed.

Setting good criteria and thresholds

Clause 6 places the choice of measurement criteria with top management, and that choice determines whether the evaluation is useful. Good criteria are linked to the organization's purpose, are observable, and combine leading indicators (which show capacity before an event, such as the share of critical roles with a trained deputy) with lagging indicators (which show results after events, such as the time taken to restore a key service or the number of repeat findings). A threshold is the line between acceptable and unacceptable, for example "no critical role without a deputy" or "all high-priority lessons closed within 90 days". Thresholds make reporting meaningful because they tell the board when to act.

Measures also depend on the sector and the culture. A hospital may give great weight to staff availability and supply of medicines; a bank to liquidity and the continuity of payment services; a software company to the speed of technical recovery and the ability to change its product quickly. The standard expects this variety; it does not want all organizations to use the same scorecard.

Regulation and contracts

ISO 22316 itself is not a legal requirement. However, regulators in several sectors, especially financial services and critical infrastructure, now expect firms to demonstrate operational resilience, and large customers increasingly ask suppliers about it. ISO 22316 is useful in those conversations as a recognised framework for explaining how the organization thinks about resilience as a whole, while specific obligations are met through the relevant regulation, contracts and certifiable standards such as ISO 22301 or ISO/IEC 27001.

Common assessment mistakes

Assessments go wrong when they become a checklist of documents ("we have a policy, so leadership is green"), when the people being assessed also mark their own work without challenge, when ratings are averaged so that a dangerous weakness disappears behind several strengths, and when results are reported but never acted on. A good assessment is evidence-based, challenged, honest about uncertainty, and tied to decisions.

Lesson 6 – Worked example

This example follows a fictional organization, Meridian Medical Supplies, through a first year of using ISO 22316. Meridian employs about 1,200 people, runs three regional warehouses and a head office, buys medical consumables from manufacturers in several countries and delivers them to hospitals and clinics. It already has an ISO 9001 quality management system and a business continuity plan for each warehouse, but no overall view of resilience.

The trigger

Two events persuade Meridian's board to act. During a regional flood, one warehouse closed for four days; the continuity plan worked, but stock was moved to the other sites without anyone checking whether their lorries and drivers could cope, so deliveries to some hospitals were late. A few months later a key glove manufacturer lost its production licence, and the procurement team discovered the problem only when orders stopped arriving. Neither event was a disaster, but together they showed that Meridian's disciplines did not talk to each other and that the organization was slow to notice change.

Step 1 – Sponsorship and purpose

The chief executive takes ownership and appoints the operations director as resilience lead. In a board workshop the leadership team writes a short purpose statement: keep hospitals and clinics supplied with essential consumables, safely and reliably, even when conditions change. They agree that the most important services are emergency deliveries to intensive care and operating theatres, and that a resilience programme must protect these first.

Step 2 – Coordination

The resilience lead forms a steering group with the heads of quality, business continuity, procurement, logistics, IT, information security, HR, finance and communications, plus one warehouse manager. The group meets monthly. In its first meeting it discovers that procurement keeps its own supplier risk spreadsheet, IT has a separate disaster recovery plan that assumes the head office is always available, and HR has no list of staff qualified to drive the specialised refrigerated vans. Nobody had been negligent; they had simply never compared notes.

Step 3 – Context

The group reviews Meridian's context. Externally it lists rising flood risk at one site, consolidation among glove manufacturers, a planned change in medical device regulations, a shortage of qualified drivers and growing customer demand for real-time tracking. Internally it notes heavy reliance on two long-serving planners, a warehouse management system that is due for replacement, and a culture in which warehouse staff rarely report near misses.

Step 4 – Baseline against the nine attributes

With the board, the steering group agrees a four-point rating for each attribute (weak, developing, established, strong) and a rule that each rating must cite evidence. It runs interviews, a short staff survey and two workshops, and reviews reports from the flood and the supplier failure. The results are summarised below.

Attribute	Rating	Key evidence
Shared vision and purpose	Developing	Purpose newly agreed; most staff not yet aware of delivery priorities
Understanding and influencing context	Weak	Supplier licence loss noticed only when orders failed; no horizon scanning
Empowered leadership	Developing	Warehouse managers wait for head office approval to divert stock
Supportive culture	Weak	Survey: most staff fear blame for reporting near misses
Shared information and knowledge	Weak	Planning knowledge held by two people; no lessons-learned process
Availability of resources	Developing	Stock buffers good; driver capacity not considered in plans
Coordinated disciplines	Weak	Separate registers and plans with conflicting assumptions
Continual improvement	Established	ISO 9001 corrective-action process works well for quality issues
Anticipating and managing change	Developing	System replacement project has no resilience review

Step 5 – Priorities and actions

The steering group proposes, and the board approves, five actions for the year, chosen because each strengthens several attributes:

Supplier watch. Procurement and quality jointly monitor regulatory notices and supplier financial health for the 40 most important products, and agree second sources for the top 15. This improves context awareness, resource availability and coordination.
Delegated authority. Warehouse managers receive written authority to divert stock and hire extra transport up to a set value during disruptions, and deputies are named and trained. This addresses leadership and resources.
Just culture campaign. Leaders visit each site, share stories of reported near misses that prevented harm, and the reporting form is simplified. The survey will be repeated after a year. This targets culture and information sharing.
Knowledge capture. The two senior planners document their methods and train four colleagues; a simple lessons-learned review follows every significant incident. This targets knowledge and improvement.
Joint exercise. Twice a year the steering group runs a tabletop exercise across all disciplines, such as the loss of a warehouse at the same time as a supplier failure. Findings go into the existing ISO 9001 corrective-action system. This tests coordination, leadership and resources together.

The resilience lead also adds a resilience review gate to the warehouse system replacement project, so that the change programme considers how the new system could fail and how operations would continue.

Step 6 – Indicators and thresholds

The board sets a few indicators with thresholds: every critical role has a trained deputy; second sources exist for at least 15 critical products; near-miss reports increase each quarter during the first year (a rising number is a sign of better reporting, not more danger); every high-priority lesson is closed within 90 days; and emergency deliveries to intensive care meet their promised time even during exercises.

The test

Ten months later a ransomware attack on a transport partner stops one third of Meridian's outsourced deliveries. Because of the earlier work, the warehouse managers use their delegated authority within hours to hire alternative vans, HR already knows which staff can drive them, the communications team uses a prepared message to hospitals, and the information security lead joins the response early because the steering group knows each other. Emergency deliveries continue on time. The lessons-learned review finds that the contract with the transport partner contained no security or continuity commitments, and procurement adds them to all logistics contracts.

What changed

At the annual review, three attributes have moved up one level. Meridian does not claim to be "certified resilient"; instead its annual report explains that it uses ISO 22316 as a framework, summarises its evaluation and lists the next year's priorities. The important result is not the scorecard but the fact that the disciplines now act as one system and that the organization notices change earlier.

Lesson 7 – Relationship to other standards and frameworks

ISO 22316 is designed to sit above and connect other standards. Understanding the neighbours helps you decide which document answers which question.

Standard or framework	Type	Main question it answers	Relationship to ISO 22316
ISO 22301 (business continuity management systems, requirements)	Requirements, certifiable	How do we prepare for, respond to and recover from disruptions in a managed way?	A key contributing discipline; provides the structured continuity capability that helps an organization absorb disruption
ISO 22313 (guidance on ISO 22301)	Guidance	How do we implement a business continuity management system well?	Practical help for one discipline that ISO 22316 asks you to coordinate
ISO 31000 (risk management guidelines)	Guidance	How do we identify, analyse, evaluate and treat risk across the organization?	Supports the principle of effective risk management and the understanding of context
ISO 22300 (security and resilience vocabulary)	Vocabulary	What do the terms in this family mean?	Shared vocabulary of the ISO/TC 292 family to which ISO 22316 belongs
ISO 22320 (emergency management, guidelines for incident management)	Guidance	How do we organise command, coordination and cooperation during an incident?	Another contributing discipline, strongest during acute events
ISO/IEC 27001 (information security management systems)	Requirements, certifiable	How do we manage information security risk systematically?	Protects information and systems, a resource that resilience depends on
BS 65000:2022 (organizational resilience, code of practice, BSI)	National code of practice	What does good organizational resilience practice look like in more detail?	UK document on the same subject; first published in 2014 as guidance and revised in 2022 as a code of practice with more detailed recommendations

Working with management systems

Many organizations already run one or more ISO management systems. ISO 22316 does not ask you to create another one. Instead, it suggests coordinating those systems so that their policies, risk assessments, objectives, audits and management reviews share information. The common Harmonized Structure of ISO management-system standards makes this easier: context (clause 4), leadership (clause 5), planning (clause 6) and improvement (clause 10) appear in all of them, so a combined management review can consider resilience as a whole.

Resilience engineering and operational resilience

You may meet related ideas outside the ISO world. Resilience engineering, from safety science, studies how people and systems adapt to keep complex work safe. Site reliability engineering applies similar thinking to digital services. Financial regulators speak of operational resilience, meaning the ability to keep important business services within tolerance through severe but plausible disruptions. These approaches share ISO 22316's emphasis on adaptation, learning and coordination, and an organization can use ISO 22316 as the umbrella that links them.

The revision in progress

The second edition, at final draft stage in 2026, changes the title from "Principles and attributes" to "Guidelines". According to Resilience First's announcement of the public draft, the draft builds on the Resilience First and Cranfield University model of organisational resilience and introduces a measurement-based approach: defined outcomes supported by indicators, targets and thresholds, explicit stress testing under severe conditions, clearer responsibilities for boards and top management, resilience built into strategy and business models, and coverage of financial, operational, workforce, environmental and social dimensions. These descriptions come from a draft and may change before publication. When the new edition appears, check the ISO catalogue and compare it with what you learn here; the core idea of absorbing and adapting is expected to remain.

Common pitfalls and best practices

Pitfalls

Renaming business continuity as resilience. The continuity team changes its name but keeps the same scope, so strategy, culture, finance and change are never addressed.
Treating the attributes as a checklist. Each attribute is marked "done" when a document exists, although behaviour has not changed.
No top management ownership. Resilience is delegated to a middle manager without authority to coordinate other departments.
Ignoring slow change. All effort goes into sudden incidents while gradual shifts in markets, technology, skills or climate go unnoticed.
Over-optimising for efficiency. Every buffer, spare and second supplier is removed to save money, leaving nothing to absorb a shock.
Claiming certification. Marketing materials state "ISO 22316 certified", which misleads customers about a guidance standard.
Measuring without acting. Scorecards are produced every year but improvement actions are not resourced or tracked.

Best practices

Start from purpose. Agree with top management what the organization must protect and achieve, and let that guide priorities.
Coordinate, don't centralise. Keep the specialist disciplines but give them a shared forum, shared information and shared scenarios.
Use evidence. Base every rating on documents, data, interviews, exercises or real events, and allow challenge.
Invest in people and culture. Develop leaders for uncertainty, delegate authority, and make it safe to report problems.
Balance absorb and adapt. Keep some deliberate slack and redundancy, and also build the capacity to change products, processes and strategy.
Reuse what exists. Feed resilience evaluation from existing audits, incident reviews, risk assessments and management reviews.
Exercise across boundaries. Run scenarios that involve several disciplines at once and track the lessons to closure.
Review on change. Re-evaluate resilience when strategy, structure, markets, technology or key people change, not only on a calendar date.

Summary and key takeaways

ISO 22316:2017 is the current international guidance on organizational resilience, the ability to absorb and adapt in a changing environment; a second edition titled "Guidelines" was at final draft stage when this tutorial was checked.
It is a guidance standard for any organization and sector; it recommends rather than requires, and there is no accredited certification against it.
Seven principles describe how resilient organizations behave: shared purpose, understanding of context, ability to absorb and adapt, good governance, diversity, coordination across disciplines and effective risk management.
Nine attributes in clause 5 give the practical core: purpose, context, leadership, culture, information, resources, coordinated disciplines, continual improvement and anticipating change.
Top management owns resilience and enables it through commitment, governance, resources, investment, evaluation and communication.
Clause 6 recommends evaluating the attributes with criteria and thresholds set by top management, using existing data, and reviewing when things change.
Business continuity, risk management, security and other disciplines are contributors; ISO 22316 is the umbrella that makes them work together.
Resilience is a capacity that rises or falls over time, so evaluation and improvement must be continuous.

Reflection questions

Write one sentence that states your organization's purpose in a way that would tell staff what to protect first during a crisis. Who would need to agree with it?
Which two management disciplines in your organization most need to coordinate better, and what could go wrong in the gap between them today?
Choose one of the nine attributes and list three pieces of evidence you could collect to rate it honestly. Which of them is a leading indicator?
Think of a slow change affecting your sector. How would your organization notice it, and how quickly could it adapt?
Where has your organization removed slack or redundancy to save money, and what threshold would tell the board that it has gone too far?