Governance
Governance gives resilience its mandate, its accountability and its route to the board, which is the foundation described in 4.2 and the leadership attribute in 5.4.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names governance as a supporting discipline; the standard does not prescribe a board structure. For clause 5.8, the contribution is the system of decision rights and accountability: who owns resilience, who can commit resources, who accepts residual risk, and how the board receives assurance. Without it, the other disciplines coordinate informally and the programme depends on individual goodwill. The resilience question is whether the board can see the profile of weakness and whether anyone is accountable for the weakest attribute.
Why it matters
Governance is where the standard's principles become enforceable. A shared purpose needs a decision forum that uses it. A coordinated approach needs a mandate. Evaluation needs thresholds that someone owns. The discipline is not a committee chart. It is the answer to the question: when the resilience assessment says the organization is weak in an attribute that matters, who has to respond, by when, and with what consequence? If the answer is no one, the governance is decorative.
What good looks like
Document the resilience accountability map: the board committee, the executive owner, the programme lead and the attribute owners. Record the decision rights and the escalation route. Put the resilience report on a standing board agenda with a fixed format. Record the board's decisions and follow them up. Review the map when the leadership or the strategy changes.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask who is accountable for resilience at board level and what the board decided last time. A terms-of-reference document without a decision record is not governance in practice.
- Accountability map Board committee, executive owner, programme lead and attribute owners, with decision rights
- Board agenda and minutes The standing resilience item, the report received and the decisions taken
- Risk acceptance Who accepted which residual risk, with the date and the basis
- Succession and deputies The named deputies for the key resilience roles
Where it commonly fails
- Resilience is delegated to a working group with no board sponsor.
- The board receives a report but never records a decision or a risk acceptance.
- Key roles have no deputies, so accountability disappears during leave or turnover.
What to do before the second edition
Put one resilience decision on the next board agenda, with the options and the risk of each. The quality of the discussion will show you whether the governance is real.