A board matter, not an IT matter
When a payment service, a refinery control room or a hospital admissions system stops for a day, the damage lands on the assets a board holds in trust: the balance sheet, the customer franchise and the licence to operate. Directors' duty of care has always extended to foreseeable harm, and a prolonged outage of a critical service is today among the most foreseeable harms a company faces. Regulators have stopped implying this and started writing it. The governance clauses of NCEMA 7000, the UAE business continuity standard, assign accountability for the programme to top management by name and expect it to approve policy and review results. The Central Bank of the UAE expects boards of licensed institutions to own operational and business continuity risk, not merely to be briefed on it. In Europe, DORA makes the management body — the board and executive committee — bear final responsibility for digital operational resilience, down to a personal obligation to keep their own knowledge current. Handing resilience wholesale to the IT department is therefore not a matter of style; it is a governance gap a supervisor can cite by clause number.
What the board must own
Three decisions cannot be delegated below the boardroom.
- The appetite for disruption. The board approves how much disruption the company will tolerate — expressed as impact tolerances for each key service: the hours of outage, the volume of failed transactions, the point at which harm to customers becomes unacceptable. How to construct and defend that statement is a discipline of its own, covered in our risk appetite guide.
- One accountable executive. A named person — not a committee, not a shared mandate — who answers to the board for resilience across the whole organisation, with the budget and the authority to match. Where accountability is collective, exercises slip and findings age quietly.
- The three lines of defence, applied to resilience. Operating management owns and runs continuity as the first line; the risk function sets the framework and challenges as the second; internal audit independently verifies as the third. The board should hear from all three — a report that has never passed through the second or third line is a self-assessment, not assurance.
Oversight, not management
The fastest way for a board to fail at resilience is to try to run it. The board does not write continuity plans, design scenarios, facilitate exercises or select recovery technology; those belong to the executive team and its programme. The board's two verbs are direct — approve the appetite, appoint the accountable executive, require an exercise calendar and an annual review — and verify: read the reports, probe the results, commission independent assurance, and return to the subject after every incident rather than only at the scheduled slot. The distinction is practical, not ceremonial. A board that edits plans has made itself part of the first line, and then no one is left to check its work.
Classification: which services and which decisions belong to the board
Classification is where the line between oversight and management becomes concrete. The board classifies two things: services, by the harm their disruption would cause, and decisions, by who takes them.
| Tier | What falls into it | What the board sets | Who runs it |
|---|---|---|---|
| Critical services | Disruption harms customers, the market or the organisation's viability within hours or days | Approves the list, an impact tolerance for each service and a named executive owner | Management, tested against the tolerance at least once a year |
| Important services | Disruption hurts revenue or operations but stays recoverable without lasting harm | Sees the list and the recovery objectives in the annual review | Management sets and tests recovery objectives |
| Other services | Disruption is absorbed by normal operations | Nothing specific | Managed operationally |
The same line runs through decisions. The board takes the few that set direction and accountability; everything that builds and operates the capability stays with management.
| Decision or activity | Board | Management |
|---|---|---|
| Disruption appetite and impact tolerances | Approves | Proposes and calibrates per service |
| List of critical services | Approves, reviews annually | Identifies services and maps dependencies |
| Accountable executive | Appoints, sets mandate and budget | Answers to the board |
| Business continuity policy | Approves | Drafts, implements, keeps current |
| Impact analysis, risk assessment, recovery objectives | Receives the summary and challenges it | Performs and maintains |
| Continuity plans and recovery strategies | Verifies coverage of critical services | Writes, owns, maintains |
| Exercise programme | Requires a calendar, reads results and findings | Designs, runs, closes findings |
| Critical third parties | Sets expectations for material outsourcing | Evaluates providers, agrees recovery terms, plans exit |
| Response in the first hours of an incident | Informed at agreed escalation thresholds | Decides and acts |
| Independent assurance | Commissions an internal audit review through the audit or risk committee | Responds to findings |
| Resilience reporting | Sets frequency and content, reads and acts | Prepares the report |
Seven questions a director should ask management
Oversight is exercised through questions. These seven require no technical vocabulary, and an evasive answer to any of them is itself a finding.
- “Which of our services would hurt customers within hours if they stopped?” If management cannot name them in one breath, the analysis has not been done.
- “What is our tolerance for each — and when did we last test to that tolerance?” A tolerance never tested against is a wish, not a boundary.
- “What did the last exercise fail, and what changed as a result?” An exercise programme that never fails anything is not exercising; it is rehearsing applause.
- “What does one day of downtime cost us — in money, customers and licence?” The number anchors every later debate about the resilience budget.
- “Who decides in the first hour, and does that person know it?” Disruptions are lost in the gap between the incident and the first decision.
- “When did this board last see a resilience report, and what did we do with it?” If the honest answer is “over a year ago” or “we noted it”, oversight exists on paper only.
- “If the regulator arrived tomorrow, what would they find?” The answer should come from the second and third lines, not from the team being inspected.
What comes back to the board matters as much as what it asks. The format and metrics of a board-grade resilience report — one page, tolerances against test results, findings and their age — are covered separately in operational resilience reporting for boards. For directors and executives who want the full governance architecture — appetite, accountability, assurance — Module 1 of the ERGP programme is devoted to resilience governance and the board's role in it.
One live picture of resilience for the board and the audit committee: a single index, the cost of a downtime day, recovery targets against reality — fed by your own numbers.
Explore the dashboard →Frequently asked questions
What is the board's role in business resilience?
To own the questions that only the board can answer: which services the organisation must keep running whatever happens, how much disruption is tolerable for each, what risk appetite the executive works within, and whether management's assurance is credible. The board does not write plans or run tests; it sets the thresholds, classifies the services and challenges the evidence.
How does a board classify services and decisions for resilience?
In three tiers. Critical services are those whose disruption harms customers, the market or the organisation's viability; each gets an impact tolerance and a named executive owner. Important services get recovery objectives but no board-level tolerance. Everything else is managed operationally. Decisions are classified by who takes them: the board approves appetite, tolerances, the critical-service list and the accountable executive; management builds and runs everything else. The classification is reviewed annually and after any material change in the business.
What should a board ask management about resilience?
Seven questions, listed above, from “Which of our services would hurt customers within hours if they stopped?” to “If the regulator arrived tomorrow, what would they find?”. A board that gets specific answers to these has done its job; a board that gets a maturity score has not.
Is business resilience a board matter or a management matter?
Both, with a clear line between them. Management builds and operates the capability; the board sets appetite, approves the classification of critical services and holds management to evidence. Regulators in the UAE, the UK and the EU now write this split into their rules, and directors are personally accountable for their side of it.