General
Evaluation gives management information on whether the resilience strategy and objectives still meet the organization's needs and where improvement is possible. The organization should track and review what builds resilience, aim the work at its own attributes, and judge how well they perform.
What clause 6.1 says
The clause sets three expectations. First, establish processes to measure and monitor the factors continuously, as an aid to management decisions. Second, target measurement at the specific attributes that enhance the organization's resilience, rather than a generic checklist. Third, evaluate the effectiveness of the approach and its objectives against those attributes. The word continuously is important. An annual assessment is a snapshot; the clause asks for a process that produces management information between snapshots. The clause also keeps the evaluation tied to the organization's own attributes and objectives. A benchmark against other organizations can inform, but it cannot replace the judgement of whether this organization, with these objectives, is resilient enough.
Why it matters
Evaluation is where a resilience programme earns its keep or becomes a reporting burden. The clause's answer is targeting. Measure what matters to this organization's attributes and core services, and use the result to allocate attention and resource. The output should be a profile of strength and weakness, not a single score. The executive needs to see the two or three attributes that would most improve the organization's ability to absorb and adapt, and the evidence behind the judgement. That is a different product from a maturity dashboard.
What good looks like
Design the evaluation around the nine attributes and the core services. Choose a small set of measures for each material attribute, with a criterion and a data source. Set the rhythm: a light quarterly read and a deeper annual review. Define who interprets the result and who decides the response. Keep a record of the decisions the evaluation produced. If it produces none for two cycles, the design is wrong.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the evaluation changed a decision. A design that cannot show a decision is a measurement exercise, not an evaluation.
- Evaluation design The attributes and services in scope, the measures, criteria and data sources
- Evaluation rhythm The quarterly and annual reviews, with the participants and the decision forum
- Profile report The attribute profile with the strongest and weakest areas and the evidence
- Decision record The resource or priority decisions the evaluation produced
Where it commonly fails
- The evaluation is a generic maturity questionnaire unrelated to the organization's attributes.
- The output is a single score with no profile of weakness.
- The evaluation happens annually and is forgotten until the next cycle.
What to do before the second edition
Start with the two weakest attributes from the materiality session and design a measure and a criterion for each. Run one quarterly read. Use the result in a real resource conversation before extending the design.
Read across
← 5.10 Ability to anticipate and managing change6.2.1 General →