RiskUKAugust2017

ISO 22316: Preparing for Brexit
The long-awaited ISO
22316:2017 Security
and Resilience –
Organisational
Resilience – Principles
and Attributes has
arrived. At first read it
doesn’t seem to offer
much – a long title,
but just ten pages of
what might be
construed as rather
dry and heavilyengineered
clauses.
Surely, there must be
value in there if only it
can be unlocked? John
Robinson decided to
apply his own test
that’s perhaps a little
‘off-piste’ as far as
conventional reviews
go, but relevant for
many: Brexit
John Robinson MSc CEng FBCI:
Managing Director of INONI
14
www.risk-uk.com
Brexit isn’t just there to be ‘enjoyed’ by us
British. Rather, it’s an international
phenomenon. Set aside your personal
views and think about it neutrally from the
perspective of your organisation. Whether
you’re based in Manchester, Milan or
Melbourne, whether you represent a charity, a
public body or a plc, there’s a good chance
Brexit may affect what it is you do as a
practising professional and, if ISO 22316 can
help you deal with this, so much the better.
Brexit represents a systemic, multi-faceted,
enduring, changing and complex risk. It carries
the possibility of both losses and opportunities
that may be linked and, circumstantially, felt
differently by each of us at different times. It’s a
moving feast or famine and business resilience
seems to be a necessary stabilising quality if
we’re to complete the ‘exit’ journey acceptably.
The approach adopted here is to work
through the International Standard, interpreting
the guidance it offers with Brexit as the subject.
What follows is modestly informed opinion and
will undoubtedly not apply for all, but reflects a
personal search for value in the widest sense.
By their very nature standards are generic
and require interpretation for the context in
which they’re applied. You simply cannot pick
one up and expect to extract an instant list of
tasks that must be performed in order for
compliance. Instead, you must work at it (or
maybe ask a specialist to do it for you).
ISO 22316 begins by explaining what it
means to be resilient. In short, this amounts to
preserving the delivery of strategic objectives
by anticipating and responding, absorbing
shock and adapting to change. It states that
there’s no absolute measure of resilience or a
definitive goal, but that it’s possible to become
more (or less) resilient. We cannot sensibly
expect to compare between organisations as
we all have different resilience appetites, but
this truism doesn’t prevent us from creating
internal Key Performance Indicators as a basis
for improvement or convergence.
Further, ISO 22316 states that resilience is
brought about by the interaction of certain
organisational attributes and activities and the
application of specific expertise. It points out
that these interactions are then shaped by how
we handle uncertainty, decision-making and
behaviour. This suggests that, once we know
what drives our individual resilience condition,
we should then be able to measure, manage
and improve upon it.
Most of the ISO document’s substance lies in
three main sections. Section 4: Principles is a
distillation, possibly acting as an aide-memoire,
whereas the Attributes section defines more
granular resilience indicators. Evaluation then
provides a form of closed-loop control that
keeps your resilience strategy aligned with
organisational needs. The remainder of this
discourse focuses on applying the Attributes.
Clarity of purpose
In this first of nine Attributes, ISO outlines that
organisations clearly setting out their position
and communicating it effectively are more likely
to be resilient. This reflects the form of
guidance used throughout and that resilience
drivers will vary between organisations.
Attribute structure is also broadly consistent,
wherein each Attribute has a headline directive
statement followed by a list of capabilities that
should be enhanced and demonstrated and a
list of activities that facilitate the capabilities,
requiring prioritisation and resourcing.
In this case, the ‘Clarity of purpose’ Attribute
implies that we need all our resilience-related
goals to be aligned, promoting synergy and
reducing conflict and making the initiative roll
smoothly. It implies that we should design a
strategy that takes us safely through Brexit
without compromising the business, make sure
the strategy is adopted by the Board,
communicate it internally and externally where
appropriate, deliver the strategy while
maximising resilience value for the organisation
and repeat, monitor, adapt and improve.
Note that the final continuous improvement
point applies for all attributes and isn’t
repeated hereafter. It ensures the system is
optimised against organisational goals, in this
case for Brexit. One would expect it to be
applied fairly frequently to deal with the rapid
rate of change.
This Attribute provides overall stability and
directional control. However, it begs the
practical question: “How do we select the right
strategy and what are its constituent parts?”
As previously explained, this is unique for
you. However, there are clues elsewhere and
we’ll come to them in due course.
Understanding context
ISO 22316 suggests that organisations who
understand their context are more likely to be
resilient. Context is a term that doesn’t appear
in the terminology listings, but in simplifying