[CM] [RYT] [E3] [CRA] [T2] Treatment and Control

Conclusion

Introduction

More Information About Crisis Management Blended/ Hybrid Learning Courses

Part 2: CRA – Treatment and Control for Ryt Bank

Legend

As part of Ryt Bank's ongoing efforts to enhance operational resilience and risk preparedness, this section outlines the existing and planned measures for treating and controlling potential crisis scenarios.

The Crisis Risk Assessment (CRA) framework categorises threats based on their nature, ranging from natural disasters and technological failures to organisational misdeeds and reputational crises.

Each threat is mapped against a four-pronged risk treatment approach: risk avoidance, risk reduction, risk transference, and risk acceptance.

This systematic analysis allows Ryt Bank to:

Mitigate the likelihood of crises materialising,
Minimise potential impact on operations, customers, and stakeholders, and
Ensure regulatory compliance with Bank Negara Malaysia and PIDM guidelines.

By identifying existing controls and additional planned controls, this chapter supports decision-making for investment in further resilience measures. It serves as a critical foundation for business continuity, crisis response, and enterprise risk management.

Table Below: Notes for BCM Institute's Course Participants: This is the template for completing the "Part 2: CRA – Treatment and Control."

RAR Risk Treatment and Evaluation of Existing Controls

Threat	Existing Risk Treatment – Risk Avoidance	Existing Risk Treatment – Risk Reduction	Existing Risk Treatment – Risk Transference	Existing Risk Treatment – Risk Acceptance	Existing Controls	Additional (Planned) Controls
Flood (Denial of Access – Natural Disaster)	Not locating data centres in flood-prone areas	Implement flood sensors and drainage systems at the premises	Insurance coverage for property damage	Accepted for non-critical remote offices	Elevated server rooms, DR site in low-risk zones	Cloud-first strategy with geo-redundancy
Power Outage (Technological)	Avoid single power source dependency	Install UPS and backup generators	Utility failure insurance	Accepted for low-priority sites	Dual power feeds in Tier 3 DC	Expand solar-powered failover solutions
Cyberattack – DDoS (Malevolence)	Avoid the use of unsecured public APIs	Implement WAF, rate-limiting, and DDoS mitigation tools	Cyber liability insurance	None	24/7 SOC monitoring, incident response playbook	Advanced AI-driven traffic analysis
Pandemic (Unavailability of People)	Shift to full remote operations during the outbreak	Enforce hygiene SOPs, flexible working policies	Health insurance, COVID-specific riders	Yes, limited to minor roles	Vaccination programs, remote access VPN	Formal pandemic-resilience workstream
Vendor Cloud Outage (Disruption to Supply Chain)	Multi-cloud architecture to avoid vendor lock-in	SLA governance, regular testing of failover	Transfer risk via contractual penalties	Yes, for short-term disruption	Redundancy with backup cloud providers	Explore the on-prem hybrid fallback option
Riot/Civil Unrest (Denial of Access – Man-made)	Avoid leasing offices in high-risk zones	Real-time alerts, security vendor engagement	Property damage insurance	Accepted for HQ access delays	Evacuation SOPs, remote work protocol	Hardened physical access and guard patrols
Industrial Action (Confrontation)	Engage in regular staff dialogues and union consultation	HR escalation matrix, performance engagement	Legal coverage via labour advisors	Partially accepted in low-skill segments	Employee grievance channel, staff surveys	Workforce sentiment monitoring AI
Phishing Attack (Malevolence – Social Engineering)	Block suspicious domains and unauthorised email servers	Cybersecurity training, phishing simulations	Third-party cyber response partners	Accepted at a minor exposure level	DKIM, SPF, DMARC protocols	Voice biometrics for high-risk transactions
Profit Over Ethics (Org Misdeeds – Skewed Values)	Avoid a culture driven solely by aggressive growth KPIs	Integrate ethics into performance appraisals	Compliance insurance, board audit committee	None	Corporate Code of Conduct	Whistleblower hotline revamp and board review
Concealed Breach (Org Misdeeds – Deception)	Avoid non-disclosure by enforcing a transparency policy	Legal training for compliance staff	D&O insurance	None	Disclosure guidelines under Bank Negara rules	Implement a real-time breach detection dashboard
Bribery or Corruption (Org Misdeeds – Misconduct)	Strict anti-bribery policy and KYC due diligence	Internal audit rotation and integrity checks	Insurance under the financial crime umbrella	None	MACC compliance policy, HR legal audit	AI fraud detection in procurement workflow
Workplace Violence	Avoid volatile HR cases with robust hiring vetting	De-escalation training, emergency response protocol	Legal indemnity and staff insurance	Yes, in low-likelihood roles	Staff reporting mechanism, HR mediation	Crisis counselling access and mental health leave
Fake News / Viral Rumours	Avoid an information vacuum by proactive comms	Monitor social media trends, rapid response team	Crisis PR agency retainer	Yes, minor reputational impact accepted	Media SOP, verified Twitter/X/X alerts	Deploy AI for early rumour detection
Liquidity Crunch (Lack of Funds)	Maintain above-minimum capital reserves	Stress testing, real-time liquidity dashboards	Transfer risk via interbank borrowing and capital buffers	Yes, within tolerable financial ratios	PIDM protection, board oversight	Establish a contingency funding plan
Haze / Pollution (Natural Factors)	Avoid non-essential on-site presence during haze	Equip offices with air purifiers and N95 distribution	Not applicable	Yes, operational continuity is acceptable	Haze SOP, remote work fallback	Air quality app integration for staff alerts

Risk Avoidance: A Strategy to prevent risk from occurring entirely.
Risk Reduction: Minimise the likelihood or impact through controls.
Risk Transference: Shift impact to third parties (e.g., insurers).
Risk Acceptance: Tolerating the risk as part of the business strategy.
Existing Controls: Measures already implemented.
Additional Controls: Planned improvements and new initiatives.

The comprehensive treatment and control strategies outlined in this section reflect Ryt Bank’s proactive approach to managing a wide range of crisis scenarios relevant to a digital banking environment.

Each identified threat is aligned with pragmatic mitigation strategies that incorporate best practices from financial sector risk management and the BCM Institute frameworks.

This assessment not only documents current preparedness levels but also highlights gaps and areas for improvement that will inform future enhancements.

Ryt Bank’s commitment to digital innovation must be matched by equally robust crisis and risk management capabilities to ensure uninterrupted services, maintain customer trust, and comply with regulations.

Moving forward, the identified additional controls will serve as the basis for implementing roadmaps, conducting internal audits, and performing regular stress testing. Continuous review and refinement of these controls will be essential to building long-term resilience in a dynamic and high-risk digital financial ecosystem.

Crisis Management Blueprint for Ryt Bank

eBook 3: Starting Your Crisis Management Implementation

To learn more about the course and schedule, click the buttons below for the CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].