Scope
ISO 22316 is guidance for enhancing organizational resilience in any organization, of any size or type, at any point in its life. It is not sector specific, it does not require a uniform approach, and it does not certify anything.
ISO 22316 is guidance, not a certifiable requirements standard. It can still be made binding by a contract or an internal policy.
What clause 1 says
The document is written for the whole organization rather than one department. Its subject is the ability to take in a shock and adjust as conditions change, so the intended reader is the person who can change how the organization decides, resources work and learns. The guidance is deliberately generic: it sets out principles, attributes and an evaluation approach that each organization tailors to its own objectives, context and risk. It can be applied at any stage in the life of an organization, including a young one without a formal management system. It does not promote one operating model, one framework or one maturity score. That openness is the point. A reader who wants a checklist of mandatory controls has picked the wrong document; a reader who wants to build a defensible resilience programme has picked the right one.
Why it matters
The scope is broad because resilience is an outcome of many disciplines, not a single function. A small organization can use the principles as a board conversation and the attributes as a review agenda. A large organization can use the same material to connect business continuity, risk, security, people and operations without forcing them into one department. The guidance does not replace the specific standards for those disciplines. It gives the executive a way to see whether the disciplines, taken together, make the organization better able to absorb a shock and adapt afterwards.
What good looks like
Write a scope note before the first assessment. Name the legal entity or group, the objectives the resilience work must support, the point in the organization's life, and the parts of the organization that are out of scope with the reason. Then name the person who owns the scope and the forum where it is reviewed. Keep the note to one page. A scope that changes silently is worse than a narrow scope that is stated. If the organization operates in several countries, record which entities and which critical services are covered; a group-level claim that omits a material subsidiary will not survive the first serious incident.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask which organization the claim is about and whether the scope covers the services that matter. If the answer is a department name rather than a legal entity and its objectives, the scope is not yet usable.
- Scope note A dated one-page statement of the entity, objectives, life stage and exclusions, with the owner
- Objective link The strategic objectives and critical services the resilience work must support
- Boundary map The entities, sites and critical suppliers inside and outside the scope, with the reason
- Review record The forum and date at which the scope was last confirmed
Where it commonly fails
- The scope is a department or a project rather than the organization and its objectives.
- Material subsidiaries, sites or critical suppliers are omitted without a recorded reason.
- The scope note is undated and no one can say when it was last reviewed.
What to do before the second edition
Draft the scope note before the first workshop and have the executive owner sign it. Map the note to the organization chart and the critical service list. Where an entity is excluded, write the reason in the note rather than leaving it to memory.