Strategic planning
Strategic planning sets the objectives and the change agenda that give the resilience attributes their direction, and it is the forum where the context and change work in 5.3 and 5.10 becomes a decision.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names strategic planning as a supporting discipline; the standard does not prescribe a planning method. Within 5.8, the contribution is the link between resilience and the organization's direction. The attributes are not ends in themselves. They matter because they help the organization deliver its objectives and survive and prosper through change. Strategic planning supplies the objectives, the time horizon and the trade-offs that let the executive decide which attributes are most material. It also supplies the change agenda that the resilience work must anticipate.
Why it matters
If resilience is planned separately from strategy, it will be funded separately and cut first. The discipline earns its place when the strategy discussion uses the resilience profile as an input and when the resilience plan names the strategic objective each action supports. The clause 5.8 coordination asks strategy to bring its assumptions about the future to the same table as risk, continuity and finance. A strategy that assumes a stable environment is a resilience risk in its own right.
What good looks like
Bring the resilience profile into the strategy cycle. For each strategic objective, record the resilience attributes and dependencies it relies on and the risks that could stop it. Use the context register to test the assumptions. Decide the trade-offs explicitly, including what the organization will not protect. Carry the decisions into the resilience plan with an owner and a date.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the resilience work supports the strategy and how the strategy accounts for disruption. Two separate documents with no cross-reference do not answer either question.
- Strategy and resilience link Each strategic objective, the attributes and dependencies it relies on
- Assumption test The strategy assumptions tested against the context register, with the changes
- Trade-off record What the organization chose to protect and what it chose not to, with the reason
- Plan alignment The resilience actions tied to a strategic objective, an owner and a date
Where it commonly fails
- The resilience plan is written after the strategy and never influences it.
- The strategy assumes a stable environment and a growing market.
- Trade-offs are made implicitly, so no one knows what was given up.
What to do before the second edition
Put the resilience profile on the first page of the strategy pack. Ask the executive team which objective is most exposed. The answer sets the resilience priority for the year.
Read across
- 4.1 General
- 5.2 Shared vision and clarity of purpose
- 5.10 Ability to anticipate and managing change
- 6.1 General