In recent years, organisations have faced an unprecedented range of challenges. Cyber attacks, supply chain disruption, economic uncertainty, regulatory change, geopolitical instability and workforce shortages have all highlighted a common issue:
Many organisations are not as resilient as they believe.
Traditionally, resilience was often associated with disaster recovery, crisis management or business continuity planning. Whilst these remain important disciplines, modern organisational resilience extends much further.
This is where ISO 22316, the international standard for organisational resilience, provides valuable guidance.
Unlike many standards that focus on specific management systems or compliance requirements, ISO 22316 takes a broader perspective. It examines how organisations develop the capability to anticipate, prepare for, respond to and adapt to change in order to survive and prosper.
In simple terms, resilience is not just about recovering from disruption.
It is about remaining effective despite disruption.
Why Resilience Matters More Than Ever
Today's organisations operate within increasingly complex environments.
Businesses depend on:
→ Technology platforms
→ Cloud service providers
→ Third-party suppliers
→ Remote working arrangements
→ Global supply chains
→ Regulatory frameworks
→ Skilled personnel
The interconnected nature of modern business means that disruption in one area can quickly affect multiple parts of the organisation.
Recent events have demonstrated this repeatedly.
Cyber incidents can halt operations.
Supplier failures can interrupt production.
Infrastructure outages can impact customer services.
Regulatory changes can alter operating models.
The organisations that perform best are not necessarily those that avoid disruption altogether.
They are the organisations that can adapt and recover quickly when disruption occurs.
That is resilience.
ISO 22316 Is Not Just About Business Continuity
One of the most common misunderstandings surrounding ISO 22316 is the assumption that it simply replicates business continuity requirements.
It does not.
Business continuity focuses primarily on maintaining and recovering critical activities during disruption.
ISO 22316 adopts a wider organisational perspective.
The standard recognises that resilience is influenced by many factors, including:
→ Leadership
→ Governance
→ Culture
→ Knowledge management
→ Risk awareness
→ Adaptability
→ Decision-making
→ Stakeholder relationships
→ Resource management
→ Continuous improvement
This broader approach makes resilience a strategic capability rather than simply an operational process.
The Role of Leadership
A key message throughout ISO 22316 is that resilience begins with leadership.
Resilient organisations are typically led by individuals who understand uncertainty and prepare for it.
Leaders establish direction.
They create accountability.
They encourage learning.
They support adaptability.
Most importantly, they foster cultures where resilience becomes embedded within everyday decision-making.
Without leadership commitment, resilience initiatives often become isolated activities that fail to influence organisational behaviour.
Governance and Resilience
There is also a strong connection between governance and resilience.
Good governance helps organisations understand:
→ Strategic risks
→ Stakeholder expectations
→ Organisational dependencies
→ Performance challenges
→ Long-term sustainability
Governance provides oversight.
Resilience provides capability.
Together they help organisations navigate uncertainty more effectively.
This relationship is becoming increasingly important as Boards face greater expectations from regulators, customers and stakeholders regarding organisational preparedness.
Organisational Culture Matters
One of the most valuable aspects of ISO 22316 is its recognition of organisational culture.
Policies and procedures alone do not create resilience.
People do.
Resilient cultures typically demonstrate:
→ Openness
→ Collaboration
→ Learning
→ Innovation
→ Accountability
→ Adaptability
Employees feel able to raise concerns.
Leaders encourage challenge.
Lessons are learned from mistakes.
Knowledge is shared rather than retained by individuals.
These cultural characteristics help organisations respond more effectively when disruption occurs.
Adaptability Is a Competitive Advantage
Historically, organisations often focused on efficiency.
Today, adaptability has become equally important.
An organisation that can adapt quickly to changing circumstances often gains a significant competitive advantage.
ISO 22316 encourages organisations to develop:
→ Situational awareness
→ Strategic flexibility
→ Responsive leadership
→ Effective communication
→ Organisational learning
These capabilities help organisations recognise emerging threats and opportunities earlier than their competitors.
Resilience therefore becomes more than protection.
It becomes a source of long-term value.
Security and Resilience Are Closely Linked
Information security is increasingly central to organisational resilience.
Most organisations rely heavily on digital systems, data and technology-enabled services.
As a result, resilience and security are becoming inseparable.
A significant cyber attack can affect:
→ Operations
→ Customers
→ Suppliers
→ Reputation
→ Regulatory compliance
→ Financial performance
Organisations must therefore understand how security controls contribute to resilience objectives.
Technology recovery, incident response, cyber preparedness and information protection all support resilience outcomes.
ISO 22316 encourages organisations to consider resilience holistically, recognising that security forms an important part of the wider resilience picture.
Measuring Resilience
One challenge organisations often face is understanding their current level of resilience.
Many businesses have never formally assessed:
→ Leadership preparedness
→ Governance effectiveness
→ Dependency management
→ Crisis decision-making
→ Organisational adaptability
→ Recovery capability
Without assessment, resilience gaps can remain hidden until disruption occurs.
This is one reason why resilience maturity reviews are becoming increasingly popular.
They provide valuable insight into organisational strengths, vulnerabilities and improvement opportunities.
Looking Beyond Compliance
Perhaps the most important lesson from ISO 22316 is that resilience should not be viewed as a compliance exercise.
True resilience cannot be achieved through documentation alone.
It requires leadership, culture, awareness, learning and adaptability.
It requires organisations to understand not only how they operate today but how they might operate tomorrow under different conditions.
Most importantly, resilience requires organisations to prepare for uncertainty before uncertainty arrives.
Conclusion
ISO 22316 provides a practical framework for organisations seeking to strengthen resilience across leadership, governance, culture and operations.
The standard recognises that resilience is not simply about responding to disruption.
It is about creating organisations that can survive, adapt and thrive in changing environments.
As uncertainty continues to increase across every sector, resilience is becoming one of the most important organisational capabilities of all.
Those organisations that invest in resilience today will be far better positioned to manage the challenges and opportunities of tomorrow.
Because ultimately, resilience is not measured by how an organisation performs when conditions are easy.
It is measured by how effectively it responds when conditions become difficult.
Marcus Allen
Director | Thamer James Ltd
Management Consultants
Master's Degree in Management Learning and Change – University of Bristol
Diploma in Governance, Risk and Compliance (GRC) – International Compliance Association (ICA)
Member, BSI G/01 Governance Committee
Thamer James Ltd
Governance • Resilience • Business Continuity • Risk Management
#ISO22316 #OrganisationalResilience #OperationalResilience #BusinessContinuity #Governance #Leadership #RiskManagement #BusinessResilience #CrisisManagement #ISO22301 #GRC #CorporateGovernance #Resilience #ContinuityPlanning #ThamerJamesLtd