[OR] [AmB] [E2] [P2] [S2] [C10] Mapping of Processes and Resources

Mapping Processes and Resources in the "Implement" Phase of Operational Resilience Planning at AmBank Malaysia

(Stage of the “Implement” Phase – Operational Resilience Planning Methodology for Metrobank)

Introduction

Operational resilience is a crucial aspect of financial institutions, ensuring that key business services remain uninterrupted despite disruptions. In the “Implement” phase of AmBank Malaysia’s Operational Resilience Planning Methodology, one of the key stages is “Map Processes and Resources.”

This stage is fundamental in identifying and documenting the essential processes, resources, and dependencies that support AmBank’s critical business services.

Understanding the “Map Processes and Resources” Stage

The “Map Processes and Resources” stage focuses on:

1. Identifying critical business services.
2. Mapping the processes that support these services.
3. Documenting the resources required, including people, technology, facilities, and third parties.
4. Establishing interdependencies between processes and resources.

By thoroughly mapping these elements, AmBank Malaysia can build a strong foundation for impact tolerance assessment, scenario testing, and resilience enhancement strategies.

Implementation Steps for Mapping Processes and Resources

Step 1: Identify and Prioritise Critical Business Services

Before mapping processes and resources, AmBank must determine which services are critical based on regulatory requirements and business impact analysis.

Example:

• Critical Service: Real-time funds transfer via DuitNow.
• Justification: This service is essential for retail and corporate banking clients, as its disruption could have significant reputational and financial implications.

AmBank can use the following criteria to prioritise business services:

• Regulatory significance: Services mandated by Bank Negara Malaysia.
• Customer impact: High-volume transactions affecting customers.
• Revenue contribution: Services that generate significant income.

Step 2: Map End-to-End Processes Supporting Each Critical Business Service

For each identified critical service, AmBank must map out the underlying business processes that enable its operation.

Example – DuitNow Real-Time Payments:

1. Customer initiates transaction (via AmBank online banking or mobile app).
2. Payment authentication process (OTP verification and fraud checks).
3. Transaction routing and processing (via the national payment network).
4. Funds settlement and reconciliation (between banks and regulatory reporting).

Each process should be documented in a process flow diagram to visualise dependencies and potential failure points.

Step 3: Identify and Document Key Resources

Mapping processes alone is insufficient—AmBank must document the resources supporting these processes. Resources typically include:

• People: Staff responsible for transaction processing, fraud monitoring, and IT support.
• Technology: Core banking systems, cloud infrastructure, payment gateways, and cybersecurity tools.
• Facilities: Data centers and backup sites ensuring operational continuity.
• Third Parties: Payment processors, telecommunications providers, and cloud service vendors.

Example – Technology Mapping for DuitNow Payments:

Step 4: Establish Dependencies and Interconnections

AmBank must identify dependencies across processes and resources to understand single points of failure and resilience gaps.

Example – Interdependencies in DuitNow Payments:

• If the core banking system fails, all real-time transactions will be impacted.
• If the payment gateway provider experiences downtime, AmBank must have an alternative route for processing transactions.
• If a third-party fraud monitoring system becomes unavailable, AmBank must ensure internal fraud detection mechanisms can compensate.

Step 5: Develop Resilience Enhancements Based on Findings

Once AmBank maps processes and resources, the next step is to implement resilience measures to strengthen operational continuity.

Examples of Resilience Measures:

1. Technology Failover Solutions – Implement active-active data center configurations to minimize downtime.
2. Redundant Vendors – Engage multiple third-party providers for payment processing.
3. Workforce Resilience – Train staff in alternative workflows during system outages.
4. Alternative Transaction Processing – Allow batch processing in case of real-time payment failures.

The “Map Processes and Resources” stage is a foundational step in AmBank Malaysia’s Operational Resilience Planning Methodology.

By identifying critical business services, mapping processes, documenting resources, and understanding dependencies, AmBank can proactively enhance resilience against disruptions.

The insights gained from this stage will feed into impact tolerance assessments, scenario testing, and the development of robust contingency plans, ensuring that AmBank remains a resilient and trusted financial institution.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.