Methods and processes
Monitoring helps identify an emerging issue or opportunity before it has an impact. The organization should use existing monitoring methods, watch the effectiveness of risk initiatives, consider employee and customer surveys, and understand what data an assessment needs.
What clause 6.3.1 says
The clause is practical. It asks the organization to apply existing monitoring methods to the attributes, monitor the effectiveness of the initiatives established to manage risk, consider employee and customer surveys as indicators, and understand what data an assessment needs with a process to support it. The emphasis on existing methods is a warning against a parallel monitoring industry. Most organizations already have operational, financial, customer and people data that can signal resilience. The clause asks for those signals to be read against the attributes, not for a new dashboard. It also names the risk initiatives specifically, because a control that was introduced to reduce a risk can decay or create a new dependency.
Why it matters
Monitoring is only useful if it is close enough to the work to notice a change and connected enough to escalate it. A monthly report that reaches the executive three weeks after the event is a history lesson. The clause's mention of surveys is a reminder that some of the best signals are perceptual: how staff and customers experience the organization. Those signals are weak on their own and strong when triangulated with operational data. The clause does not prescribe a method. It asks for a deliberate one.
What good looks like
List the existing monitoring sources and map each to an attribute or a core service. For each material attribute, choose one leading and one lagging indicator. Set the frequency and the route to the decision forum. Add a short interpretation note to each report: what changed, what it might mean and who should look. Test the route by sending a signal that requires a decision and seeing what happens.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how a signal becomes a decision. A monitoring pack with no route and no decision record is a reporting habit, not a monitoring process.
- Monitoring map Existing sources mapped to attributes and core services, with the frequency
- Indicator set The leading and lagging indicators for each material attribute, with the owner
- Risk initiative review The effectiveness of the initiatives established to manage risk, with the last review
- Survey use How employee and customer signals are read alongside operational data
- Route test A signal that required a decision, and the record of how it travelled
Where it commonly fails
- A new dashboard is built while the operational data that already exists is ignored.
- Surveys are collected but never read against the resilience attributes.
- Risk controls are assumed to keep working because no one has tested them.
What to do before the second edition
Take one existing report and add an interpretation column: what changed, what it might mean, who should act. Run it for a quarter. If it produces no action, the report is not monitoring the right thing.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.9 Supporting continual improvement
- 6.4 Reporting