Oversight

Oversight exists because the people who run a company should not be the only judges of their own work. It gives the board a defined job: set direction, question management and verify that what was promised is actually happening. For an owner, oversight is the difference between knowing that risk is managed and merely hoping so. Without it, resilience claims rest on management's word alone.

In practice oversight runs on a rhythm: an annual board calendar, committee terms of reference, a management reporting pack and a small set of indicators the board tracks over time. The key instruments are questions and evidence, not instructions. For example, a board reviewing the annual exercise report notices that one critical service missed its recovery time objective twice, and asks management for a dated remediation plan instead of accepting a verbal reassurance. That single habit changes how seriously the organisation treats its own plans.

Two confusions recur. Oversight is not supervision, which is what a regulator does to the company from outside; and it is not doing management's job with extra seniority. A board that starts approving operational detail loses the distance it needs to judge results. Module M1 of the ERGP programme, Resilience governance and the board, works through this boundary in depth.