Compliance

Compliance exists because a claim of conformity is worthless without proof: it obliges the organisation to know every requirement that applies to it and to hold evidence that each one is met. This changes management behaviour, since obligations get owners, evidence gets collected as work happens rather than reconstructed before an audit, and gaps become visible early. For the board, compliance is the baseline signal that the organisation is at least standing on the floor the regulator has set. It answers the narrow question of whether the rules are met, not the larger one of whether the firm would survive a disruption.

In the UAE the compliance perimeter depends on who you are: government entities and critical infrastructure must conform to NCEMA 7000, banks answer to CBUAE expectations, and firms that adopted ISO 22301 voluntarily are audited against it by their certification body. Evidence is fixed in compliance registers, audit trails, test reports and management review minutes. Compliance also feeds assurance: internal audit and external reviewers rely on the same evidence base to tell the board whether conformity is real. A typical trigger is a supervisory data request, where the firm that collects evidence continuously answers in days and the one that does not spends weeks reconstructing it.

The classic mistake is letting compliance degenerate into paper conformity: documents perfectly aligned with the standard, capability untested, and audits reduced to checking that files exist. The second mistake is declaring victory at compliance, proving the minimum while intolerable weaknesses remain outside the rulebook's scope. Compliance proves the floor; resilience is built above it. The relationship between requirements, compliance and genuine capability is developed in ERGP module M5, Regulatory requirements for resilience.