Why the annual slide is dead
Both regulatory layers in the UAE point the same way. The CBUAE Rulebook requires business continuity arrangements the board can be held accountable for; NCEMA 7000 puts top management accountability and measurable performance indicators into the standard itself. Supervisory interviews now routinely ask directors what they know about the institution's recovery capability — and «we approved the policy» is a weak answer.
The failure is rarely willingness; it is format. Continuity teams produce operational detail the board cannot act on, or a reassuring annual summary the board cannot interrogate. The fix is a short, recurring report built on a handful of metrics that do not change shape month to month.
The five metrics that belong in front of the board
| Metric | What it answers | Red flag |
|---|---|---|
| Resilience index (0-100) | Overall: are we getting stronger or weaker? | Falling trend, or a number nobody can decompose |
| Cost of one lost day | How much is at stake, per critical facility or function | «We have never calculated it» |
| Recovery objectives vs tested reality | Can we actually recover in the time we promise? | Objectives without a test date next to them |
| Single points of failure | Where one supplier, system or person stops the business | A list that has not shrunk in two quarters |
| Last test: findings and closure | Is the system alive and learning? | A test with zero findings — nothing real was tested |
The one-page format
- Top strip: the index, its 12-month trend, and one sentence of leadership commentary.
- Middle: the five metrics with traffic-light status and the single most important change since last report.
- Bottom: decisions requested from the board — budget, risk acceptance, deadline — never more than three.
- Frequency: monthly to the risk committee, quarterly to the full board, immediately after any material incident or failed test.
The test of a good board report: a director who reads only this page can answer the supervisor's question «how do you satisfy yourself the institution can recover?» — with numbers, dates and a trend.
From report to dashboard
A static report ages the day it is issued. The step beyond it is a live dashboard fed by the same data: resilience index, downtime cost, recovery status of critical processes — visible to the executive team continuously and exported to the board pack in one click. That is precisely the product we build: deployed on-premise, so the data never leaves your infrastructure — a requirement most financial institutions will recognise.
Frequently asked questions
How is a resilience index calculated?
A weighted score across measurable components: BIA currency, plan coverage, test results against recovery objectives, closure of findings, dependency risk. The exact model matters less than consistency — the board reads the trend, the supervisor reads the decomposition.
What does the supervisor actually ask boards?
Variants of three questions: how do you know your recovery capability is real, when was it last tested against your stated objectives, and what did you change after the last incident or test. The one-page format answers all three.
Can we build this reporting ourselves?
Yes — the format above is deliberately tool-agnostic. The effort is in the data discipline underneath: current BIA, tested objectives, tracked findings. If that discipline exists, a spreadsheet works; a dashboard makes it continuous.