ISO 22316 implementation for an organisation that absorbs the shock and adapts.

What it is

What is ISO 22316 and what is it used for?

ISO 22316 is the international guidance document on organisational resilience, developed by ISO technical committee TC 292, Security and resilience. It describes the principles behind a resilient organisation, the attributes that show resilience is present, and how to evaluate the factors that contribute to it. It applies to any size or type of organisation in any sector, and leaves each to tailor the approach.

Where ISO 22301 examines whether you can keep delivering during a disruption, ISO 22316 requires a wider question: whether the organisation as a whole can sense change, absorb it and adapt, and still achieve what it exists to achieve. Boards use it as a lens over risk, continuity, security, quality and crisis management, to see whether those disciplines work together.

Current edition. ISO 22316:2017, first edition, published in March 2017. ISO has confirmed that it is to be revised: a second edition, ISO/FDIS 22316, was registered for formal approval on 6 July 2026 and is listed as its replacement, with the title changing from principles and attributes to guidelines. No publication date has been announced.

Who it is for

Who needs ISO 22316?

Nobody is required to adopt ISO 22316. Organisations turn to it when asked how the business as a whole would cope with a shock nobody planned for. Four starting points are common:

• A major customer asks about resilience, not just continuity. An evaluation against ISO 22316 answers questions on leadership, dependencies and adaptability with evidence.
• A tender asks how you manage disruption across the organisation. An international framework, with your certified systems shown inside it, beats a list of separate policies.
• Your regulator or board wants a view of resilience as a whole. ISO 22316 gives directors a shared vocabulary and an evaluation they can review each year.
• Group companies run different systems in different countries. The attributes give a parent one frame for comparing subsidiaries without imposing identical procedures.

Principles and attributes

What are the main ISO 22316 principles and attributes?

As guidance, ISO 22316 makes recommendations, not requirements. After scope and terms, the 2017 edition sets out principles, then attributes of a resilient organisation, then the evaluation of factors that contribute to resilience, with an informative annex. The map below is at title level; your programme works from the edition itself.

• Principles: resilience grows from a shared purpose, current knowledge of context, good governance, diverse skills, coordination across disciplines and effective risk management, applied as a coordinated approach.
• Shared vision and clarity of purpose: people know what the organisation is for and act on it.
• Understanding and influencing context: a current picture of the environment, shaped where possible.
• Effective and empowered leadership: leaders at every level can decide when conditions change.
• A culture supportive of organisational resilience: behaviours that favour learning and adaptation.
• Shared information and knowledge: knowledge reaches the people who need it.
• Availability of resources: people, facilities, finance and information when change demands them.
• Development and coordination of management disciplines: functions such as risk, continuity and security working together.
• Supporting continual improvement: lessons turned into change.
• Ability to anticipate and manage change: looking ahead and adapting early.
• Evaluating the factors that contribute to resilience: organisational requirements for the evaluation, monitoring and assessment, and reporting.
• Annex A, relevant management disciplines: an informative list of the functions whose coordination supports resilience.

Putting it into practice

How do you implement ISO 22316?

There is no certification route for ISO 22316, so the aim is alignment you can demonstrate: an accurate assessment against the guidance, improvements that connect your existing disciplines, and a repeatable evaluation the board owns. Many clients pair it with a certifiable standard, most often ISO 22301, so the resilience programme also produces a certificate that customers recognise.

1. 01
   Agree what resilience must protect.Confirm the objectives, services, sites and group entities in scope, and who on the board sponsors the work.
2. 02
   Gap analysis: compare current practice with the principles and attributes.Interviews, document review and workshops show which attributes are strong, which are weak and where disciplines fail to connect.
3. 03
   Close the priority gaps and coordinate the disciplines.Agree owners for cross-functional risks, align risk, continuity, security and crisis arrangements, and fill resource and information gaps.
4. 04
   Evaluate, monitor and report.Set up the evaluation the guidance describes, with indicators, a monitoring rhythm and a report the board reviews and acts on.
5. 05
   Decide on certification to a related standard, and sustain.Where a certificate is needed, extend the work to ISO 22301 or another certifiable standard; either way, repeat the evaluation at planned intervals.

Check the route before you sign. Nobody can issue a genuine ISO 22316 certificate, so treat any offer of one as a warning sign. If you need a certificate, it will be to a certifiable standard such as ISO 22301, issued by a certification body accredited for that standard by an accreditation body within the Global ACI arrangement. Ask for the body's name and accreditation, and verify both with the accreditation body directly.

Cost

How much does ISO 22316 implementation cost?

Cost follows scope: one business reviewing how its systems fit together needs far less than a multi-country group also preparing for ISO 22301. Every Sterling proposal shows each component under one all-inclusive proposal.

Timeline

How long does ISO 22316 implementation take?

The pace depends on how many disciplines already run well, how quickly senior people can meet and how much change the gap analysis calls for. As an estimate, a focused alignment typically takes three to six months; ISO 22301 certification or several countries extend it.

Share any customer or tender deadline at the start, and we will say what can be shown by then.

Your engagement

What your ISO 22316 engagement includes

Your engagement runs on Sterling OS™. Choose Design™, where we guide and your team does the work, or Drive™, where we manage the programme; they are alternatives, not stages. Automate™ is Effivity, holding the evidence, and Sustain™ follows the programme and any related certification with repeat evaluations.

• Scope, gap analysis and alignment plan

  Owners and dates agreed first.

• Coordination of management disciplines

  Risk, continuity, security and crisis arrangements connected, on Sterling's templates where needed.

• Effivity ISO & GRC software

  Evaluation evidence in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Resilience evaluation and board report

  Indicators and a first report the board can repeat.

• Route to a related certificate

  Readiness for ISO 22301 or another certifiable standard, if needed.

Sterling does not certify, and ISO 22316 has no certificate; any certification to a related standard is decided by an independent, accredited certification body.

Often combined with

Standards organisations pair with ISO 22316

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.