Optro’s Richard Chambers on what UAE boards get wrong about business continuity
The senior advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors shares how organisations are navigating an increasingly unpredictable operating environment.
09 August, 2026
TT
16
Recent months have tested the resolve of businesses across the region in ways few could have planned for. Geopolitical shocks, cyber incidents and supply chain disruption have moved from abstract risk categories to lived experience for many organisations in the UAE and the wider region.
Against that backdrop, business continuity management (BCM) has quietly become one of the more consequential boardroom conversations of the year. New research from Optro (formerly AuditBoard) puts numbers to what many leaders have sensed instinctively: confidence in resilience is high, but performance under real pressure often tells a different story. Richard Chambers, senior advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors, spoke to Gulf Business about what the findings mean for organisations navigating an increasingly unpredictable operating environment.
It’s been an unsettled period for businesses in this region, on multiple fronts. How should leadership teams be thinking about resilience right now?
What we’ve seen over the past year is resilience moving from a risk management conversation to a boardroom conversation. Geopolitical instability, supply chain shocks, and high-profile cyber incidents have made it impossible for senior leaders to treat business continuity solely as an IT department concern. It’s now clearly an enterprise issue, and leadership teams are responding.
Nearly half of UAE organisations reported increased BCM budgets over the past 12 months, and 51 per cent expect spending to rise further over the next two years. That’s a meaningful directional signal.
Our research also found that BCM is led by IT in nearly a third of organisations. That might seem logical on the surface, but it fundamentally misframes what resilience is. When you position it as a technology function, you end up with siloed integration, fragmented accountability, and programmes built around reactive recovery rather than proactive resilience. The business ends up running on confidence borrowed from a framework that was never designed to protect the whole enterprise.
Given everything organisations here have had to absorb recently, would you say the region is more prepared than it was, or has confidence outpaced actual readiness?
Confidence has certainly grown, but our research suggests it hasn’t always been earned through testing. Often, that confidence comes from the top. Senior leadership typically sets the tone on resilience, and if they haven’t been through a serious disruption themselves, it’s easy to believe the plans are solid without ever stress-testing them.
The problem is that BCM complexity is often invisible until it isn’t. When something goes wrong, the lack of a clear chain of command, undefined accountability, and untested plans don’t just slow you down; they can cause organisations to miss their own recovery targets by more than twice the planned timeframe.
The numbers back this up. For organisations that experienced a significant disruption during the past 12 months, 62 per cent failed to recover within their established recovery time objectives, and over the past 24 months, 59 per cent of UAE organisations reported losses exceeding $500,000 as a result. Nearly one in four have never subjected their BCM programme to formal external validation or audit.
Spending more on a programme you’ve never stress-tested doesn’t build resilience. On the contrary, it risks building a more expensive false sense of security.
The threat landscape in this part of the world looks quite different to other markets Optro has researched. What makes resilience a harder problem here specifically?
The threat environment here is uniquely severe. The UAE’s Cybersecurity Council has shown that the country is one of the most targeted in the world for cyber attacks, and with the majority being state-sponsored, that means greater sophistication, greater persistence, and a significantly higher bar for what “adequate protection” actually looks like. Layer on top the geopolitical volatility we’ve seen this year, and the case for resilience has never been more urgent.
What I find genuinely encouraging, though, is that business leaders are taking note. BCM is moving up the agenda, budgets are increasing, and organisations are starting to treat this as a strategic priority rather than a checkbox exercise. The gap between where organisations are and where they need to be is real, but so is the momentum to close it.
A lot of the disruption businesses here have faced hasn’t originated inside their own operations at all; it’s come through partners and vendors. How much of a factor has that been?
A significant one, and it’s often underappreciated. Businesses today don’t operate in isolation. They depend on complex, interconnected networks of vendors, cloud providers, logistics partners, and service platforms. When one link in that chain breaks, the impact ripples fast. We’ve seen this play out recently in the region when a cloud provider outage brought businesses to a grinding halt.
Our research makes the scale of this risk very clear. More than four in five UAE organisations reported that a third-party outage or failure had caused significant disruption to their operations in the last two years. Among those, 67 per cent said the resulting business impact exceeded one million dollars. What makes this particularly concerning is the visibility gap: just 31 per cent of UAE organisations report having full visibility into the BCM plans of their critical vendors. This is the lowest figure globally, and far below the international average of 49 per cent.
You can’t manage risk you can’t see, and for most organisations here, a significant portion of their operational risk lives outside their own four walls, in a supply chain they’ve never fully mapped.
For a business that recognises it needs to do more but doesn’t know where to start, particularly with so much else competing for attention right now, what would you tell them?
I’d tell them it doesn’t require starting from scratch, and that’s the reassuring part. Our research points to three practices that separate organisations that recover quickly from those that don’t.
The most cited contributor to success, at 44 per cent, was regularly testing and updating plans before incidents occurred, not once at onboarding, but as an ongoing discipline. Strong management of third-party continuity risks was the second differentiator at 41 per cent. Given how dependent most organisations are on cloud providers and critical suppliers, resilience is only as good as the ecosystem around it. The best performers actively manage that exposure rather than assuming their vendors have it covered. The third, at 35 per cent, was clearly defined and tested decision-making authority and crisis communications.
When an incident unfolds in real time, the organisations that respond well aren’t improvising; they’ve already answered who decides, who communicates, and who has authority to act. That clarity is the difference between a controlled response and an escalating crisis.
None of these happens without deliberate intent. So, a realistic starting point would be to pick one, and make it continuous rather than periodic.
Looking beyond risk mitigation, could how a business handles disruption actually become part of how it competes in this market?
Absolutely, and I think that’s an angle that businesses here underestimate. Consider what happens when a major bank experiences downtime because a critical cloud provider goes offline. When customers can’t transact, can’t access funds, and can’t run their business, they’re not interested in the technical explanation. They’ll question why their provider can’t meet expectations, and in a market where customers have genuine choice, that question has real commercial consequences.
UAE customers place a clear premium on reliability. Look at Emirates, consistently one of the country’s most valuable brands. The consistency of that service experience is central to what the brand stands for, and it didn’t happen by accident. It’s the result of deep investment in operational resilience across every layer of the business. That’s a trait that resonates strongly here, where trust and dependability carry real weight in purchasing and partnership decisions.
Given where BCM maturity currently sits across the UAE market, the gap between best-in-class and average is wide, making the opportunity to leverage resilience as a competitive differentiator more immediate than most organisations realise.
