As organisations across the Middle East navigate an increasingly volatile operating environment, new research from Optro (formerly AuditBoard) reveals a concerning disconnect between how resilient UAE organisations believe they are and how they actually perform during disruption.
According to the study, just 19% of UAE organisations have a formal disaster recovery plan in place, the lowest figure recorded globally and significantly below the global average of 31%. Meanwhile, only 38% have established recovery time objectives (RTOs) and recovery point objectives (RPOs) for all critical business processes, while just 22% have fully mapped critical business processes to the technology systems, third parties and supply chain dependencies required to support them.
This is starkly contrasted by confidence levels which remain remarkably high. Nearly three-quarters (73%) of respondents expressed confidence in their organisation’s ability to meet established recovery objectives during a major disruption, while 79% said they were confident in their ability to demonstrate operational resilience compliance to regulators.
In reality however, for organisations that experienced a significant disruption during the past 12 months, 62% failed to recover within their established RTOs with more than a third (34%) exceeding their recovery targets by more than twice the planned timeframe. Business continuity activation also proved challenging, with 42% unable to activate their business continuity management (BCM) plans within the first 24 hours of a major incident and only 15% able to do so within the first four hours.
The financial consequences of these shortcomings are substantial. Over the past 24 months, 59% of UAE organisations reported losses exceeding US$500,000 as a result of disruptions including vendor outages, supply chain interruptions, IT and cloud service failures, and weather-related events. “The findings reveal a dangerous resilience gap. Many organisations have confidence in their preparedness, but confidence alone does not reduce downtime, protect revenue or accelerate recovery,” said Richard Chambers, Senior Advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors. “Operational resilience is ultimately measured during moments of disruption, and the data suggests many organisations are discovering weaknesses only after an incident has already occurred.”
The research identifies third-party resilience as one of the most significant contributors to operational risk. More than four in five respondents (82%) reported that a third-party outage or failure had caused significant disruption to their operations within the last two years. Among those organisations, 67% estimated the resulting business impact exceeded US$1 million. Yet visibility into third-party continuity preparedness remains limited. Just 31% of UAE organisations report having full visibility into BCM plans for critical vendors, the lowest figure globally and well below the international average of 49%.
These BCM challenges persist despite strong awareness of global resilience standards and frameworks. UAE respondents reported high levels of familiarity with frameworks including DORA (78%), G-SIB requirements (92%) and SR 14-1 (85%), suggesting that awareness alone is not translating into operational readiness.
The study also highlights clear lessons from organisations whose BCM programmes performed effectively during disruption. Respondents from these organisations cited regularly testing and updating plans before incidents occurred (44%), strong management of third-party continuity risks (41%), and clearly defined and tested decision-making authority and crisis communications processes (35%) as the most important contributors to successful outcomes.
Encouragingly, organisations appear prepared to invest in closing these gaps. Nearly half (47%) reported an increase in BCM budgets over the past 12 months, while 51% expect spending to increase over the next two years. According to Optro, these investments will be most effective when paired with independent validation and continuous assurance practices. The research found that nearly one in four UAE organisations have never subjected their BCM programme to formal external validation or audit.
“Recent events across the region have reinforced a reality that disruption can emerge from many directions and often with little warning,” Chambers added. “Whether organisations are dealing with geopolitical uncertainty, third-party failures, cyber incidents or operational outages, resilience cannot be assumed. It must be tested, validated and continuously improved. The organisations that recover fastest are rarely those with the most confidence. They are the ones that regularly challenge their assumptions through exercises, audits and independent reviews long before disruption occurs.”
Discussion about this post