Review
Top management should review resilience periodically against changes in context, strategy, structure, markets, products, staff, improvements, feedback and risk, and compare the result with related reviews such as internal audit, incident debriefs and regulatory compliance.
What clause 6.3.2 says
The clause lists what the review should weigh: shifts in direction, plan or goals; big changes to structure or the business model, such as mergers, takeovers and sell-offs; markets or places newly entered; recently launched offerings; major personnel shifts, senior leaders included; whether earlier improvements worked; what the organization has heard about how well it copes; and movement in the risks that need action. It then asks senior leaders to set the resilience output beside related reviews, such as findings from internal audit, what incident debriefs showed, the strategy plan, near-miss reports and compliance checks, and to check that the watching arrangements still fit and feed action before the impact is damaging. The list is a reading of where resilience assumptions go stale. The comparison is a check against a self-referential view.
Why it matters
The periodic review is the moment the organization reconciles what it believes about its resilience with what the rest of its assurance work shows. If the resilience review says the organization is strong and the internal audit reports repeat findings, the review is not looking at the same evidence. The clause asks for that comparison explicitly. It also asks top management to confirm the monitoring arrangements, which is a decision about the quality of the information, not only the performance of the organization.
What good looks like
Build the review agenda from the clause's list and add the related assurance inputs. Send the pack a week ahead. At the review, ask three questions: what has changed since the last review, what does the wider assurance evidence say that our own monitoring missed, and what will we decide today. Record the decisions, the owners and the dates. Keep the agenda stable so the reviews are comparable.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask for the last review's decisions and their status. A review with no decisions is a briefing, and a follow-up with no closure shows the review has no consequence.
- Review agenda The clause's change list and the related assurance inputs, with the date and participants
- Assurance comparison Where the resilience view agrees or disagrees with audit, incident and compliance evidence
- Review minutes The changes considered, the decisions taken, the owners and the dates
- Monitoring confirmation Top management's confirmation that the monitoring arrangements are appropriate, with any change
- Follow-up The status of the previous review's decisions
Where it commonly fails
- The review repeats the monitoring report without comparing it with audit or incident evidence.
- The agenda changes every year, so no trend can be seen.
- Decisions are recorded without owners or dates.
What to do before the second edition
Put the last internal audit findings beside the last resilience report before the review. Where they disagree, ask which is wrong. That conversation is the review's value.