Having a Plan and Being Able to Use It: What ISO 22361 Opens and What Practice Adds
ISO 22361, the international standard for crisis management published in 2022, makes something clear from the outset: in crisis, there is often no ideal solution. Decision-makers sometimes have to choose the least detrimental option. Every choice can come with a penalty of some kind.
That acknowledgement — honest, understated — runs through the entire standard. It also points toward a question the standard raises but cannot answer on its own.
What the standard covers
ISO 22361 is comprehensive. It defines what a crisis is and how it differs from an incident. It identifies seven principles for building a crisis management capability: governance, strategy, risk management, decision-making, communication, ethics, and learning. It addresses leadership, structures, culture, competence, and a full crisis management process running from anticipation through to continual improvement.
Clause 6 covers crisis leadership — the skills and attributes required of those who lead a response, and the importance of well-being in sustained crisis operations. Clause 8 addresses crisis communication in detail. Clause 9 is unambiguous: developing capability requires deliberate investment — through training, exercising, and learning from real experience.
For any organisation serious about crisis preparedness, it is a credible foundation.
What Clause 7 identifies
Clause 7 addresses strategic crisis decision-making — and names, with precision, what makes it difficult.
The challenges it identifies are not primarily technical. They are human and organisational: the complexity and instability of the situation, dilemmas that resist clean resolution, the pull toward decision delay or avoidance when every option feels inadequate, groupthink, poor situational awareness, and the difficulty of maintaining a strategic focus when the pressure to respond operationally is intense.
The standard makes one point with particular force: the crisis management team’s primary role is strategic. Getting drawn into the operational response — however urgent it feels — is one of the most common ways a crisis team loses its effectiveness.
Clause 7 then describes what effective crisis decision-making requires: a structured process, maintained situational awareness, and the deliberate separation of strategic from operational decision-making.
The gap between having a plan and being able to use it
Here is the question ISO 22361 raises and cannot resolve on its own.
A plan describes what should happen. A structure defines who is responsible for what. Principles establish the framework within which decisions should be made. All of this is necessary. None of it guarantees that the people responsible for carrying it will be able to do so when the moment arrives — when the situation is moving faster than anticipated, the information is incomplete, the team is under pressure, and the instinct to act conflicts with the discipline to think.
Clause 9 points toward the answer: training, exercising, and deliberate practice. The capacity to navigate crisis is not built by reading a plan. It is built by confronting uncertainty, making decisions under pressure, and reflecting on how the reasoning held — or didn’t.
This is not a critique of the standard. It is precisely what the standard says. The gap between having a plan and being able to use it is not a failure of documentation. It is a human and organisational challenge that requires its own investment.
A framework, not a destination
ISO 22361 is best understood as a framework — a rigorous and well-constructed map of what crisis management capability looks like. Like any map, its value depends on the people who use it and the practice they bring to the terrain.
The organisations that navigate crisis well are rarely those with the most detailed plans. They are those whose people have developed the judgment, the posture, and the collective discipline to act clearly when clarity is in short supply.
That capacity is built before the crisis arrives. It requires deliberate work — structured, contextual, and grounded in the specific culture and constraints of each organisation.