Quality management
Quality management supplies the process discipline, the measurement habit and the corrective action loop that the continual improvement attribute in 5.9 depends on.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names quality management as a supporting discipline; the standard does not require a quality management system. Within 5.8, the contribution is the control of processes, the definition of what good looks like, the measurement of performance and the correction of failure. Resilience and quality meet in the ability to keep a service consistent when the conditions change. The discipline also supplies the audit and review habits that make the evaluation in clause 6 credible.
Why it matters
Quality work can become a certificate and a set of procedures that no one uses. Its resilience value is in the loop: define the standard, measure against it, find the deviation, correct the cause. That is the same loop the standard asks for in continual improvement. The discipline also brings a useful discipline of its own: a nonconformity is a fact to be investigated, not a personal failure. That supports the culture of learning from failure described in 5.4 and 5.5.
What good looks like
Map the critical processes for each core service and the standard each must meet. Record the measures and the last deviation. Check that corrective actions address the cause and are verified. Use the audit programme to test the resilience activities, not only the service processes. Review the process map when a service changes. Keep the language of nonconformity separate from blame.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask whether corrective actions are verified and whether the audit programme covers the resilience activities. A certificate alone does not show either.
- Critical process map The processes each core service depends on, with the standard and owner
- Measures and deviations The measures, the last deviation and the corrective action
- Corrective action record The cause identified, the action taken and the verification
- Audit coverage The resilience activities included in the audit programme, with the findings
Where it commonly fails
- The quality system covers service delivery but not the resilience activities.
- Corrective actions are closed when the paperwork is done, not when the cause is fixed.
- Audits find the same issue repeatedly with no escalation.
What to do before the second edition
Take the last three corrective actions and ask whether the cause was fixed or the symptom was covered. The answer tells you whether the loop works.