Reporting
The output of monitoring may include summary reporting that gives top management an assessment against the attributes that matter most here. Top management should use it to track trends, confirm that information systems supply the data, and develop action plans.
What clause 6.4 says
The clause describes reporting as a management tool rather than a public disclosure. The output may be a summary against the attributes that matter most. Top management should use ongoing reports to track trends, confirm that current information systems provide the essential data, and use the output to develop action plans. The three activities connect reporting to decisions and to the systems that make it possible. Trend tracking requires stable definitions; if the measures change every year, there is no trend. The systems check is a reminder that a report is only as good as the data behind it. The action plan is the point of the report. Without it, reporting is a cost with no return.
Why it matters
Reporting is where resilience work meets the board. Directors need a small number of clear judgements, not a data dump. The clause's emphasis on the attributes that matter most here gives permission to report selectively, provided the selection is explained. It also implies a duty to say what is not reported and why. A board that only sees green indicators will not know which risks are outside the frame. The action plan should be short, owned and dated, and the next report should show what happened.
What good looks like
Design a two-page report: the attribute profile, the trend, the three judgements that matter, the actions from last time and their status. Add a note on what the report does not cover. Confirm the data sources and any known weakness. Present it in person where possible. Record the board's decisions and carry them into the next report. Keep the format stable for at least four cycles so a trend is visible.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask what the board did with the report. A pack that was noted and filed, with no action and no follow-up, does not meet the intent of the clause.
- Report pack The two-page attribute report, the trend and the three judgements
- Trend record The same measures over at least four cycles, with the definitions held stable
- Data confirmation The systems and sources behind the report, with any known weakness stated
- Action plan The actions, owners, dates and status, carried forward from the previous report
- Coverage note What the report does not cover and why
Where it commonly fails
- The report is a data dump with no judgement or action.
- The measures change each cycle, so no trend can be read.
- The board sees only favourable indicators and is not told what is excluded.
What to do before the second edition
Cut the report to two pages and force three judgements. If the team cannot agree the three, the monitoring design is not yet good enough. Add the status of last cycle's actions to every report.