Financial control
Financial control supplies the liquidity, the spending authority and the cost visibility that let the organization act in a disruption, and it tests whether the resilience plan is affordable.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names financial control as a supporting discipline; the standard does not define it. For clause 5.8, the contribution is the money and the authority to use it. A response can fail because no one can release funds quickly, because the cost of recovery exceeds the available liquidity, or because the resilience investment was cut in the last budget round. The discipline also provides the cost data that makes a resource decision in 5.7 real rather than aspirational.
Why it matters
Financial resilience is not the same as having a large balance. It is the ability to absorb the cost of a disruption and to keep paying staff, suppliers and creditors while revenue is interrupted. That requires a view of fixed costs, credit lines, insurance and the timing of receipts. It also requires delegated spending authority for the crisis team. A plan that requires a board resolution in the first hour is not a plan.
What good looks like
Model the cash and cost impact of the priority disruption scenarios over the recovery period. Record the liquidity available, the credit lines and the insurance cover, with the claim conditions. Set a delegated spending limit for the crisis team and test it. Review the model when the cost base or the funding changes. Include the cost of the resilience measures themselves and the consequence of not funding them.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the organization pays for a response in the first week and who can authorize it. A plan that depends on an emergency board meeting has an untested assumption.
- Disruption cost model The cash and cost impact of the priority scenarios over the recovery period
- Liquidity and cover Available cash, credit lines, insurance cover and the claim conditions
- Delegated authority The crisis spending limit, the holder and the test record
- Funding decision The resilience measures funded, deferred or declined, with the reason
Where it commonly fails
- The continuity plan has no cost or cash impact.
- No one can release significant funds without a board resolution.
- Insurance is assumed to cover a loss without checking the conditions.
What to do before the second edition
Ask finance to cost the top three scenarios for the first thirty days. Compare that with available liquidity. The difference is the financial resilience gap.
Read across
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
- 6.2.2 Determining gaps