A majority of UAE organisations have lost more than US$500K due to poor business continuity management. A new study from Optro, formerly AuditBoard, highlights growing weaknesses in business continuity across the UAE. It shows that despite high confidence levels, many organisations are not able to recover effectively during disruption.

The report finds that only 19% of UAE organisations have a formal disaster recovery plan in place. This is the lowest level recorded globally and well below the global average of 31%. In addition, just 38% have defined recovery time objectives and recovery point objectives for all critical business processes. Meanwhile, only 22% have fully mapped key processes to supporting technology systems, third parties, and supply chain dependencies. This raises serious concerns about business continuity readiness.

However, confidence remains high across organisations. Nearly 73% of respondents said they are confident in meeting recovery objectives during major disruptions. In addition, 79% believe they can demonstrate operational resilience compliance to regulators. Despite this, real-world performance shows a different picture for business continuity.

In fact, among organisations that faced major disruption in the past year, 62% failed to recover within established recovery time objectives. Furthermore, 34% exceeded their targets by more than twice the planned timeframe. At the same time, 42% were unable to activate business continuity management plans within the first 24 hours of an incident. Only 15% managed activation within four hours.

Financial impact remains significant. Over the past 24 months, 59% of UAE organisations reported losses of more than US$500,000. These losses were linked to vendor outages, supply chain disruptions, IT and cloud failures, and weather events. Therefore, gaps in business continuity are directly affecting financial stability.

“The findings reveal a dangerous resilience gap. Many organisations have confidence in their preparedness, but confidence alone does not reduce downtime or protect revenue,” said Richard Chambers, Senior Advisor, Risk and Audit at Optro and former CEO of The Institute of Internal Auditors. He added that operational resilience is only proven during disruption.

Third-party risk is also a major issue. According to the study, 82% of respondents experienced disruption due to third-party outages in the past two years. Among them, 67% reported losses exceeding US$1 million. However, only 31% of UAE organisations have full visibility into vendor business continuity plans, which is the lowest globally.

Meanwhile, awareness of global frameworks remains high. Around 92% are familiar with G-SIB requirements, 85% with SR 14-1, and 78% with DORA. Even so, this awareness has not translated into stronger business continuity execution.

On the positive side, 47% of organisations increased business continuity budgets in the past year. In addition, 51% expect further increases over the next two years. However, Optro notes that investment must be paired with independent validation. Nearly 25% of UAE organisations have never subjected their business continuity programmes to external audit.

According to organisations with stronger outcomes, key success factors include regular testing of plans, better third-party risk management, and clear crisis decision-making structures.

“Recent disruptions across the region show that risks can emerge without warning,” Chambers said. He added that business continuity must be continuously tested and validated, not assumed.

Overall, the findings highlight a widening gap between confidence and capability in business continuity across UAE organisations.

Related post

View all