Shared information and knowledge

What clause 5.6 says

The clause asks the organization to value information, knowledge and learning, and to draw learning from all available sources. It then lists six conditions for knowledge and information: accessible, understandable and adequate for the objectives; effectively shared for decision-making; recognised as a critical resource; generated, kept and used through defined processes; shared in a timely way with relevant interested parties; and applied in organizational learning. The list moves from quality to use. A document that is accessible but not understandable does not satisfy the first condition. A report that is shared after the decision does not satisfy the second. The clause also makes knowledge a resource to be managed, not a by-product of individual experience.

Why it matters

In a disruption, the organization discovers how much knowledge lives in one person's head. The clause is a prompt to find those dependencies before they fail. It also addresses a subtler problem: information that is technically available but impossible to use under pressure. A shared drive full of documents is not shared knowledge. The standard asks for knowledge that is adequate, timely and applied. That means someone has decided what a decision-maker needs, in what form, and by when.

What good looks like

Map the knowledge that the critical services depend on and the people who hold it. For each critical knowledge item, record where it is documented, who can use it, and what happens if the holder is unavailable. Then test one decision with the information a new person could find. Fix the gaps in form and timing, not just in storage. Add a learning loop: after an exercise or an incident, record what was learned, who needs it and what changed.

Evidence a reviewer asks for

There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.

An assessor will ask whether a new joiner could make a routine resilience decision from the record. If the answer depends on asking the person who has always done it, the knowledge is not shared.

• Knowledge map The knowledge critical services depend on, the holders and the documentation
• Information test A decision tested with the information a new person could find, and the gaps fixed
• Timeliness evidence A case where information reached the decision-maker in time to change the decision
• Learning record What was learned from an exercise or incident, who received it and what changed
• External learning How the organization learns from other organizations and sectors

Where it commonly fails

• Critical knowledge is held by one or two people with no succession plan.
• Information is shared through a drive with no curation or timeliness rule.
• Lessons are recorded but not distributed beyond the team that wrote them.

What to do before the second edition

Pick the three decisions that matter most in a disruption. Ask a person who has never made them to find what they need. Time the exercise and record what was missing. That list is the knowledge plan.

Read across

• 5.3 Understanding and influencing context
• 5.7 Availability of resources
• 5.9 Supporting continual improvement
• 6.4 Reporting

← 5.5 A culture supportive of organizational resilience5.7 Availability of resources →

Full register / The dates / Free transition check