Calibrated to GCC central bank frameworks · CBUAE · SAMA · CBB · QCB · CBK · CBO
Operational risk, resilience and controls
What does the CBUAE 2026 operational risk regulation require, and how do controls scale? The Operational Risk Management Regulation in force from 14 September 2026, internal control over financial reporting as a continuous discipline, controls at scale, and staying ready for an on-site examination.
4 articles in this topic
Read in this order.
- 12 Sept 2026 Operational resilience under the CBUAE's 2026 regulation: what changes on 14 September The CBUAE Operational Risk Management Regulation takes effect on 14 September 2026 and adds a second obligation to the first: not only manage operational risk, but prove you can deliver critical operations through disruption. A four-hour clock and a report to the regulator.
- 20 Jun 2026 ICoFR as continuous discipline — beyond the annual testing cycle ICoFR was conceived under COSO as a continuous discipline. In practice, in many institutions it has become a sequence of annual testing exercises around year-end. The substantive difference between continuous and periodic ICoFR, and where the largest control gaps tend to cluster.
- 26 Nov 2026 Internal controls at scale — the case against manual proliferation As institutions grow, manual controls multiply without matching risk reduction. The CBUAE three-lines framework requires effective controls, not numerous ones. The discipline of distinguishing risk-reducing controls from procedural overhead is the harder governance investment.
- 10 Dec 2026 Regulatory inspection readiness — continuous posture, not crisis preparation When an inspection is announced, many teams shift to crisis mode. The supervisory signal this sends is unfavourable: a mature framework is inspection-ready continuously, not on announcement. This article addresses the gap between the two states and the investments that close it.
Where this becomes work