Risk management
Risk management supplies the method for identifying and treating uncertainty, and it connects the context, resource and change work to a decision about what to do.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names risk management as a supporting discipline, and clause 4.1 makes effective risk management one of the principles. The standard does not require a particular risk framework. Within 5.8, the contribution is a consistent way to identify risk, assess likelihood and impact against the objectives, choose a treatment and monitor it. The resilience question is whether the risk process sees the dependencies that matter to a core service and whether the treatment decisions are real. A risk register that lists hundreds of items and changes nothing is not risk management.
Why it matters
Risk work is the connective tissue of the standard. Context work identifies what is changing; risk work judges what it means; resource work decides what to do; monitoring checks whether it worked. The failure mode is a register owned by a risk function and read by no one. The clause 5.8 coordination asks risk to bring its top items to the same forum as continuity, security and operations, so that a risk accepted in one discipline is visible to the others.
What good looks like
Agree the risk criteria with the executive owners, including the appetite and the thresholds. Keep the register focused on the risks that could stop a core service or a strategic objective. For each, record the owner, the treatment, the residual position and the review date. Bring the top items to the coordination forum. Test one treatment to see whether it worked. Review the criteria when the strategy changes.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the organization decides which risks matter and whether the treatments are tested. A long register with no criteria and no test is an inventory of concerns.
- Risk criteria The appetite, the likelihood and impact scales and the thresholds, approved by the owners
- Focused register The risks that could stop a core service or objective, with owners and treatments
- Treatment evidence A treatment tested, with the result and the residual position
- Coordination record The top risks shared with the other disciplines and the forum where they were discussed
Where it commonly fails
- The register is owned by the risk function and not used by the executive.
- Every risk is rated high, so the rating carries no information.
- Treatments are recorded but never tested or reviewed.
What to do before the second edition
Cut the register to the ten risks that could stop a core service. For each, ask the owner what they decided and what would change their mind. That conversation is the risk process.
Read across
- 4.1 General
- 5.8 Development and coordination of management disciplines
- 6.2.1 General
- 6.3.1 Methods and processes