Communications management
Communications management turns a decision into something staff, customers and authorities can act on, which supports the shared purpose in 5.2 and the reporting duty in 6.4.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names communications management as a supporting discipline. The standard does not prescribe channels, messages or a crisis communications plan. Within 5.8 the discipline connects the organization to its interested parties: it makes the purpose and the decisions understandable, keeps the flow two-way, and ensures that the people who need to act hear in time. The resilience question is not whether the organization has a press office. It is whether the right people receive a usable message when the normal channels are degraded.
Why it matters
Communication fails in a disruption for practical reasons: the intranet is down, the contact list is on the affected system, the spokesperson is unreachable, or the message is written for the regulator and not for the customer. The discipline earns its place when it has a degraded-mode plan and has tested it. It also supports the culture attribute: people who are told what is happening and why are more able to make good local decisions. Silence is a decision with consequences.
What good looks like
List the audiences that matter in a disruption: staff, customers, critical suppliers, regulators and the public where relevant. For each, record the message owner, the channel, the fallback channel and the approval route. Prepare holding statements for the scenarios the organization is most likely to face. Test the fallback channel once a year. Capture questions coming back and route them to the decision team.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the organization reaches staff and customers when its main systems are unavailable. A communications plan that depends on the intranet is not a degraded-mode plan.
- Audience and channel map Each audience, the owner, the primary and fallback channel
- Holding statements Prepared statements for the priority scenarios, with the approval route
- Degraded-mode test The last test of the fallback channel and what failed
- Feedback log The questions received and how they changed the response
Where it commonly fails
- The only channel is the intranet or email that the incident may have taken down.
- Messages are written for the regulator and not translated for customers or staff.
- No one owns the two-way flow, so questions do not reach the decision team.
What to do before the second edition
Test the fallback channel with a real message to a small group. Time how long it takes and what breaks. Fix the first break before writing more statements.