Determining gaps
An initial resilience assessment should establish the baseline before monitoring begins, decide whether the result is acceptable to top management, and set out strategies to address significant gaps.
What clause 6.2.2 says
The clause describes the first assessment and its use. The organization should apply the agreed metrics to establish its resilience position before implementing a monitoring process. It should judge whether senior leaders find the position sufficient or below what the organization needs. And it should consider appropriate strategies for any significant gap. The sequence is baseline, judgement, response. The clause does not require every gap to be closed. It requires the gap to be known, judged and addressed by a chosen strategy, which may include accepting the risk. The initial assessment also has a communication purpose: it can reinforce the concept of resilience with interested parties by showing that the organization has looked honestly at itself.
Why it matters
A baseline is useful only if it is comparable over time. That means the measures and the method must be stable enough to show change, while the criteria can evolve with the objectives. The judgement step is where many programmes go soft. A gap is reported, everyone agrees it is important, and no one decides. The clause puts the decision with top management, which is the right place: the executive owns the trade-off between investing in the gap and accepting it. The strategy can be to close, reduce, transfer or accept. What it cannot be is to leave the gap unowned.
What good looks like
Run the baseline with the measures agreed under 6.2.1 and record the method so it can be repeated. Present the profile to top management with the gaps and the options. Ask for an explicit decision on each significant gap: close, reduce, transfer or accept. Record the owner, the date and the evidence that will show change. Repeat the baseline at a fixed interval and compare like with like.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask whether top management judged the baseline and what it decided. A gap register without a decision is a list of things everyone already knew.
- Baseline report The initial assessment, the method, the date and the evidence
- Gap register Each significant gap, its size, the affected attribute and the owner
- Management decision For each gap, close, reduce, transfer or accept, with the reason and the date
- Improvement strategy The chosen response, the resources and the evidence that will show progress
- Repeat method The instruction that lets a later team repeat the baseline comparably
Where it commonly fails
- The baseline is a one-off study with no method note, so it cannot be repeated.
- Every gap is marked high priority, which is the same as no priority.
- Top management notes the gaps and sets no strategy or owner.
What to do before the second edition
Present no more than five gaps to top management and ask for a decision on each in the meeting. Five decisions are better than a forty-page report with none.