Supporting continual improvement
Resilience improves when the organization monitors performance against predetermined criteria, learns from experience and takes advantage of opportunities, supported by a culture of continual improvement.
What clause 5.9 says
The clause asks for two demonstrations: a culture of continual improvement that keeps objectives, strategies and procedures relevant, and a commitment to validate and improve resilience activities and capabilities. It lists two activities: implement performance monitoring and evaluation mechanisms, and ensure that performance criteria respond to changes that affect objectives. The clause is short but demanding. Predetermined criteria mean the organization decided what good looks like before it measured. Validation means testing whether an activity still works, not only whether it happened. Responsive criteria mean the measurement itself changes when the objectives change. A programme that measures the same things for five years is not improving; it is repeating.
Why it matters
Continual improvement is the attribute most likely to be claimed and least likely to be evidenced. An annual review that produces a document is not improvement. The clause wants a loop: measure, compare with a criterion, learn, change something, and measure again. It also wants the criteria to stay relevant. If the organization's strategy shifts from growth to resilience, the old efficiency measures may reward the wrong behaviour. The clause gives the programme permission to retire a measure, provided the replacement is deliberate.
What good looks like
Write the improvement loop on one page: the criteria, the measures, the review rhythm, the decision forum and the change log. For each measure, record the criterion and the last action it triggered. Retire any measure that has not changed a decision in two cycles, and replace it with one that will. Keep a validation schedule for the resilience activities themselves, not only for the services.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask for a change that came from monitoring. A dashboard with no decision attached is reporting, not improvement.
- Performance criteria The predetermined criteria for the attributes and the core services
- Improvement loop The measures, review rhythm, decision forum and change log on one page
- Change evidence A change made because a measure missed its criterion, with the result
- Validation schedule When each resilience activity was last tested, and the outcome
- Retired measures Measures retired because they no longer reflect the objectives, with the replacement
Where it commonly fails
- The review produces a report but no change.
- The measures have no criteria, so every result can be explained away.
- The same measures are used after a major strategy change.
What to do before the second edition
Choose three measures and ask what decision each triggered in the last year. If the answer is none, the measure is decoration. Replace one and run the loop for a quarter before adding more.
Read across
← 5.8 Development and coordination of management disciplines5.10 Ability to anticipate and managing change →