Resilience Governance

Someone must answer for resilience at the level where strategy and money are decided, otherwise it competes with quarterly targets and loses. Resilience governance is the board's machinery of direction and oversight, covering appetite, accountability, reporting and assurance, applied to the firm's ability to withstand disruption. It solves the classic failure in which everyone manages incidents but nobody owns the question of how much disruption the company can accept. Governance keeps that question above the operational noise.

In practice the board or a risk committee approves the resilience policy and appetite, assigns a single accountable executive, and reviews a short dashboard, for example twice a year: services, tolerances, test results, open gaps. The record lives in board minutes, the policy and an annual resilience report, with assurance from internal audit or an external review. NCEMA 7000 in the UAE and ISO 22301 both make top-management commitment an explicit requirement, so a supervisor will ask for exactly these artefacts. A useful test: can the board name its top three resilience gaps and the date each one closes?

The classic mistake is delegating resilience wholesale to a manager and calling that governance. Oversight without direction is theatre; the board must set limits and demand evidence, not just receive presentations. The opposite failure is a board that micromanages recovery steps instead of governing outcomes. The ERGP programme is built around this discipline, and Module 1 devotes a chapter to how boards direct and oversee resilience.