Defensible decision making is the process of reaching and documenting decisions in a way that is transparent, evidence-based, consistent, and capable of withstanding examination. It uses a consistent structure for decision making, which ensures that important considerations are always taken into account, often resulting in better decisions but, crucially, meaning that decision makers and their organizations can demonstrate that the decision was reasonable, proportionate, and made through a fair and accountable process.
In many businesses, critical decisions are made with no documentation and no record of the decision-making process. This is a business risk in its own right, since if the decision proves to be one that has a poor, or unexpected, outcome, the individual and the organization have no way to show that even though the outcome was not a good one, the process that the organization went through to make the decision was strong and well grounded. Being able to demonstrate this can be important to scrutiny by stakeholders, regulators, courts, the media, or the general public; and having a structure for defensible decision making which is used and recorded for all important decisions is key to this.
Defensible decision making is particularly helpful in crisis management, where rapid decisions made under pressure are required. Having a decision making structure helps ensure that even in time-critical situations, corners are not cut, and being able to clearly and quickly record the steps and information used for the decision still happens.
Defensible decision making in ISO 22361
The ISO 22361 guidelines standard for crisis management supports the use of defensible decision making. It states that:
- Effective decision making must be based on good information management, situational awareness, and understanding of stakeholders’ needs and expectations.
- Leaders should make decisions grounded in evidence, logic, and judgment, and with awareness of potential consequences.
- All decisions should take into account the organization’s strategic objectives, core values, and priorities.
The standard confirms that decisions and the underlying rationale must be recorded and documented so they can withstand scrutiny and analysis after the event; and so lessons can be identified. The basis for decisions must be recorded with relevant context so they can be adequately justified.
The principle of defensible decision making is also confirmed in the section in the standard on ‘Evaluating and learning’. This states that crisis managers should understand that: “Post-crisis reviews are not intended to assess whether their decisions were correct, but whether they were defensible given what was known at the time. A ‘defensible’ decision is one that was necessary, proportionate, legal, ethical, and consistent with the values of the organization. This expectation should be understood by individual decision makers and across the organization.”
ISO 22361 frames defensible decision making as a cornerstone of effective crisis management. It does not demand perfect outcomes but requires that decisions be:
- Rooted in the best available information,
- Consistent with organizational values and ethics,
- Necessary and proportionate to the circumstances, and
- Fully documented to show transparency and accountability.
The key characteristics of defensible decision making
Building on the above, the following provides an extended checklist for how to build a defensible decision-making structure. This needs to be:
Evidence-based
Decisions are grounded in verifiable data, analysis, or expert input, rather than solely on opinion, intuition, or pressure.
Transparent
The reasoning behind the decision is clear and open to inspection. Others can see what information was considered, what trade-offs were made, and why a particular course of action was chosen.
Consistent and fair
Decisions are made in line with established principles, frameworks, or policies, reducing the risk of arbitrariness or bias.
Proportionate and balanced
Risks, costs, and benefits are weighed carefully. The decision reflects a reasonable balance between competing interests.
Documented and traceable
Records show who was involved, what information was reviewed, what options were considered, and why the final decision was made.
Ethical and compliant
The decision aligns with legal, regulatory, and ethical obligations, showing that duty of care and accountability were taken seriously.
Learning from the experts in defensible decision making
The emergency services continually have to make defensible decisions quickly in extremely pressured situations, where the wrong decision could have the most severe consequences. In the UK, a lot of work has been done on developing joint ways of working to ensure consistency between the different emergency services; and the outputs of this are held within the JESIP interoperability framework. One element of this is the Joint Decision Model (JDM).
The JDM’s central principle is ‘Working together, saving lives, reducing harm’. Setting this out acts as a reminder of the central mission. For an organizational crisis management team, this could be changed to something which more closely maps to crisis management aims.
Circling the central principle are five decision making stages which flow into each other in a repeating cycle. Given an organizational crisis management spin, these are:
Gather information and intelligence
From an organizational perspective, this involves gaining the current and background information that is necessary to make a decision and to establish situational awareness.
Assess threats and risks and develop a working strategy
Assessing the situation, including any specific threats, hazards, and the risk of harm. The working strategy is the plan of action (decision) which you are then going to evaluate in the following steps.
Consider powers, policies, and procedures
This stage evaluates your plan of action in relation to any relevant procedures or policies that may impact on it. Is it in line with the business continuity plan, for example? Are there any organizational policies which inform the decision, either in support or which would preclude the decision being made?
Identify options and contingencies
“There will almost always be more than one way to achieve the desired outcomes,” states JESIP. Crisis managers should consider if their working strategy is the best option, or whether, on reflection or in discussion with others, a better decision could be made.
Take action and review what happened
Having made a final decision, act upon it decisively, and then consider and review the outcome. If this crisis situation continues, or the action taken proves to be unsuccessful, return to the start of the process and continue this cycle until the incident is resolved.
Throughout the above process, each step should be documented and the information retained so that it can be referred to in future as the core of your defensible decision-making system.
Conclusion
The JDM is just one example of a defensible decision-making system, but it is one that is tried and tested and very easy to convert for organizational and business use. It can even be used in your personal life for making good decisions in difficult situations!
Whether you use the JDM or not, having a structured system is not only good practice in crisis management, as evidenced by ISO 22361, it is essential for protecting you and your organization from the very real risk that when things go wrong – and they inevitably will at some point – you cannot show that best, or at least reasonable, endeavours were taken.
The author
David Honour is editor of Resilience Forward.
Reader comment
I read your piece on defensible decision making and thought the distinction you make around “defensible given what was known at the time” was particularly sharp.
One thing that stood out to me is that many existing frameworks still focus primarily on demonstrating that a decision process was reasonable after execution — documentation, rationale, proportionality, accountability, etc.
What seems less resolved operationally is a slightly earlier boundary: whether the decision was actually authorised to proceed at execution time, under the exact conditions that existed at that moment.
In many environments, especially where authority, exposure, mandates or conditions change continuously, organizations can often reconstruct why a decision was taken — but cannot deterministically prove that execution was admissible when it happened.
That distinction feels increasingly important as operational flows become more automated, delegated and state-dependent.
I’m working in this area from more of an execution-control perspective, so your article resonated strongly.
Magnus Högfeldt, CEO ClearState Network
