CBUAE resilience checklist: would your evidence survive an examination?

Policy and governance

• Is there a documented BCM policy stating objectives, approach, and the roles with authority to act — signed and current?
• Does a named senior executive own business continuity, with the board sighted on it at least annually?
• Are BCM responsibilities known to the people who hold them — would they answer correctly in an interview?
• Is the scope right-sized to your risk profile, nature, size and complexity — documented reasoning included?

BIA and risk assessment

• Are all critical business functions identified, with disruption impact assessed over time?
• Is the BIA refreshed on an ongoing basis — does its date follow your last material business change?
• Do recovery objectives exist per critical function — and can current arrangements actually meet them?
• Are dependencies mapped: systems, suppliers, premises, key people — with single points of failure named?

Plans and disaster recovery

• Does a documented BCP cover every critical function end to end, meeting the policy's objectives?
• Are first-hours arrangements explicit: who declares, who decides, who communicates — with written authority?
• Do disaster recovery arrangements exist for critical technology, with recovery targets consistent with the BIA?
• Are workarounds defined for the gap between disruption and recovery — tested, not assumed?

Testing and evidence

• Was the BCP tested in the last 12 months — or sooner after material change?
• Did the test produce timings, findings and actions — and are those actions closed with records?
• Can staff execute contingency plans — verified in the test, not asserted?
• Is there an evidence pack an examiner could read in an hour: policy, BIA, BCP, test reports, board minutes?
• Does the board receive resilience reporting with metrics — not a once-a-year slide?
• Are critical outsourced services covered: provider continuity evaluated, exit and workaround options defined?

Frequently asked questions