ISO 22336, the new standard that was released in 2024 and which covers the strategic elements of managing and directing organizational resilience, states that an organization’s top management should develop a resilience policy which sets the parameters for embedding resilience objectives into organizational strategies.
This Resilience Forward article looks at this area and the steps that top management needs to take to comply with the ISO 22336 guidelines.
For c-level executives and boards, crafting a robust resilience policy is not merely a compliance exercise; it is a strategic imperative that aligns organizational purpose, culture, and strategy to deliver real organizational value.
What does ISO 22336 require?
ISO 22336 states that an organization looking to be in alignment with the standard should establish a resilience policy that aligns the organization’s values and behaviours with a shared vision and purpose. Such a policy aims to encourage a shared understanding of the organization’s vision and purpose among all interested parties and leverage positive elements of its culture during the design and implementation of the strategy.
The resilience policy should document the organization’s intention to enhance its resilience. It articulates the organization’s commitment to resilience, sets parameters for resilience objectives, guides strategy, and provides a framework for embedding resilience into decision-making. Crucially, the resilience policy also assigns accountability for delivery of the resilience strategy.
For executives and boards, the policy is a formal commitment to organizational resilience, signalling an understanding of the need for top management governance, oversight, and appropriate funding in this area.
What should c-level executives and boards consider when developing a resilience policy? Here are some important areas to think about:
Establish leadership commitment
ISO 22336 emphasizes that top management must own and drive the resilience policy. This starts with explicit leadership commitment:
- The CEO and board chair should publicly endorse resilience as a strategic priority.
- A resilience sponsor or champion should be appointed at the executive level to oversee policy development.
- Resilience should be integrated into board-level discussions, alongside financial, operational, and compliance reviews.
Leadership commitment ensures that resilience is not relegated to operational silos but becomes an enterprise-wide imperative.
Align with organizational values, vision, and culture
A resilience policy should not be a generic statement; it must reflect the organization’s unique values, culture, vision, and purpose. Boards and executives should ask:
- How does resilience align with our mission and long-term goals?
- What aspects of our culture can we leverage to strengthen resilience?
- How do we balance agility and control without stifling innovation?
This alignment encourages a shared understanding of resilience across stakeholders and fosters behaviours that reinforce, rather than undermine, resilience objectives.
Define policy scope and boundaries
Executives should define what the policy covers. Will it apply enterprise-wide, or focus on critical business units, supply chains, or operations? Does it address all types of risks (strategic, operational, financial, reputational), or prioritize specific threat categories?
Defining scope helps set clear expectations for where resilience efforts will be prioritised and ensures resources are allocated accordingly.
Establish resilience objectives
ISO 22336 advises that the policy should set parameters for embedding resilience objectives into strategy. Objectives should be:
- Aligned with organizational goals: supporting not only survival but strategic growth.
- SMART (Specific, Measurable, Achievable, Relevant, Time-bound): to enable effective monitoring and accountability.
- Comprehensive: addressing anticipation, prevention, response, adaptation, and recovery.
Executives should involve risk, operations, IT, HR, legal, and other functions in defining objectives to ensure they reflect enterprise realities.
Assign accountability and governance
A critical aspect of the resilience policy is defining accountability for resilience outcomes:
- Who is responsible for implementing the resilience strategy?
- How will accountability be cascaded through the organization?
- What governance structures (committees, reporting lines, oversight mechanisms) will ensure policy adherence?
Clear accountability prevents resilience from becoming a vague aspiration and ensures operationalisation.
Integrate with broader strategies and policies
A resilience policy should not exist in isolation. Executives must ensure that it integrates with:
- Enterprise risk management (ERM) frameworks
- Operational resilience, business continuity, disaster recovery, and crisis management plans
- Sustainability and ESG strategies
- Corporate governance policies
- Other areas as appropriate to the organization.
Integration avoids duplication, leverages synergies, and embeds resilience across organizational systems.
Engage stakeholders and build awareness
An effective resilience policy requires buy-in from stakeholders at all levels:
- Internally: employees, management teams, unions
- Externally: suppliers, customers, regulators, investors.
Executives should lead awareness campaigns, communicate the policy’s intent and benefits, and foster an environment where feedback and improvement are encouraged.
Include continuous improvement mechanisms
Resilience is not static. The policy should embed mechanisms for review, evaluation, and continuous improvement, including:
- Regular audits and assessments of resilience capabilities
- Feedback loops from crisis events, exercises, and simulations
- Clear triggers for policy revision based on changing risks or organizational shifts.
Executives must commit to periodic policy reviews to maintain relevance and effectiveness.
Formalise and communicate the policy
Once developed, the policy should be documented, approved at the board level, and formally communicated. Key actions include:
- Including the policy in governance documents
- Communicating it through CEO messages, company meetings / town halls, and leadership briefings
- Ensuring it is easily accessible and understandable to all stakeholders.
Formal communication reinforces the policy’s authority and supports its adoption.
Board oversight role
Boards have a fiduciary duty to oversee resilience as part of enterprise risk and governance. Key board actions include:
- Approving the resilience policy and ensuring alignment with strategic objectives
- Monitoring policy implementation and resilience metrics
- Challenging management’s assumptions about resilience activities.
Active board oversight ensures that resilience remains a strategic priority rather than a compliance checkbox.
Conclusion
A well-crafted resilience policy is a foundational tool for embedding resilience into the DNA of an organization. For c-level executives and boards, it is a mechanism to align culture, strategy, and governance toward a shared vision of sustainable, adaptive, and proactive resilience.
By taking ownership of the policy development process, aligning it with organizational values, assigning clear accountability, and integrating it across strategies, leadership can position the organization not only to survive disruptions but to prosper during and after disruption. This is, after all, the stated aim of resilience activities, according to ISO 22316, the parent standard for ISO 22336. ISO 22316 defines organizational resilience as the ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper. This is the goal of resilience: and is something that the resilience policy needs to encapsulate.
Finally, developing a resilience policy is not a one-size-fits-all task. A phased approach may be prudent, starting with core operations and expanding policy coverage over time.
The author
David Honour is editor of Resilience Forward.
Using a ‘critical friend’ to help improve your resilience policy…
When developing resilience policies an external ‘critical friend’ can be very helpful. A critical friend isn’t embedded in the organization’s internal politics or culture, so they can challenge assumptions, question biases, and highlight blind spots that insiders might overlook. This can help to improve policies and ensure that they don’t miss important areas.
As an organizational resilience subject matter expert with board level experience, David Honour can act as a critical friend when it comes to the development of resilience policies. Contact him to discuss this further.
