BUSINESS CONTINUITY MANAGEMENT

recovery targets by more than twice the planned timeframe. Business continuity activation also proved challenging, with 42 % unable to activate their business continuity management( BCM) plans within the first 24 hours of a major incident and only 15 % able to do so within the first four hours.

The financial consequences of these shortcomings are substantial. Over the past 24 months, 59 % of UAE organisations reported losses exceeding US $ 500,000 as a result of disruptions including vendor outages, supply chain interruptions, IT and cloud service failures, and weather-related events.

Richard Chambers, Senior Advisor, Risk and Audit at Optro

s organisations across the Middle East navigate an

According to the study, just 19 % of UAE organisations have a formal disaster recovery plan in place, the lowest figure recorded globally and significantly below the global average of 31 %. Meanwhile, only 38 % have established recovery time objectives( RTOs) and recovery point objectives( RPOs) for all critical business processes, while just 22 % have fully mapped critical business processes to the technology systems, third parties and supply chain dependencies required to support them.

This is starkly contrasted by confidence levels which remain remarkably high. Nearly three-quarters( 73 %) of respondents expressed confidence in their organisation’ s ability to meet established recovery objectives during a major disruption, while 79 % said they were confident in their ability to demonstrate operational resilience compliance to regulators.

In reality however, for organisations that experienced a significant disruption during the past 12 months, 62 % failed to recover within their established RTOs with more than a third( 34 %) exceeding their

“ The findings reveal a dangerous resilience gap. Many organisations have confidence in their preparedness, but confidence alone does not reduce downtime, protect revenue or accelerate recovery,” said Richard Chambers, Senior Advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors.“ Operational resilience is ultimately measured during moments of disruption, and the data suggests many organisations are discovering weaknesses only after an incident has already occurred.”

The research identifies third-party resilience as one of the most significant contributors to operational risk.

The research identifies third-party resilience as one of the most significant contributors to operational risk. More than four in five respondents( 82 %) reported that a third-party outage or failure had caused significant disruption to their operations within the last two years. Among those organisations, 67 % estimated the resulting business impact exceeded US $ 1 million. Yet visibility into thirdparty continuity preparedness remains limited. Just 31 % of UAE organisations report having full visibility into BCM plans for critical vendors, the lowest figure globally and well below the international average of 49 %.

These BCM challenges persist despite strong awareness of global resilience standards and frameworks. UAE respondents reported high levels of familiarity with frameworks including DORA( 78 %), G-SIB requirements( 92 %) and SR 14-1( 85 %), suggesting that awareness alone is not translating into operational readiness.

30 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST