[OR] [AmB] [E2] [P2] [S5] [C13] Improving Lessons Learned

Improving Lessons Learned: Enhancing AmBank Malaysia’s Operational Resilience

(Stage of the “Implement” Phase – Operational Resilience Planning Methodology for Metrobank)

Introduction

Operational resilience is a crucial component of AmBank Malaysia’s risk management and business continuity framework.

In an ever-evolving financial landscape, where threats such as cyberattacks, natural disasters, and system failures can disrupt operations, financial institutions must have a structured approach to learning from past incidents.

The "Improving Lessons Learned" stage is a vital part of the "Implement" phase in AmBank Malaysia’s Operational Resilience Planning Methodology.

It focuses on systematically identifying, analysing, and integrating insights gained from operational disruptions, resilience exercises, and crisis events to enhance the bank’s preparedness and response mechanisms.

This stage ensures that AmBank Malaysia continuously refines its resilience strategies, strengthens its ability to adapt to emerging threats, and fosters a culture of continuous improvement.

By institutionalising a robust lessons-learned process, the bank not only complies with regulatory expectations but also reinforces its commitment to delivering uninterrupted services to customers and stakeholders.

This chapter explores the key implementation steps involved in the "Improving Lessons Learned" stage, supported by real-world examples that demonstrate how AmBank Malaysia enhances its operational resilience framework.

Implementation Steps

Collect and Document Lessons Learned

After any operational disruption, crisis, or resilience exercise, it is essential to collect data on what transpired. This involves conducting post-incident reviews (PIRs) and after-action reviews (AARs) to document observations and insights.

Example: Following a cyber incident that temporarily disrupted online banking services, AmBank Malaysia collects logs, reports from IT teams, and customer service feedback to assess the impact and effectiveness of the response.

Engage Stakeholders in Review Sessions

Involving key stakeholders—including senior management, risk management teams, business continuity professionals, and IT security personnel—in structured review sessions fosters a comprehensive understanding of the incident and areas for improvement.

Example: A review session after a regional power outage includes facility managers, IT support, and business unit heads to discuss response actions and contingency measures.

Identify Root Causes and Improvement Areas

A thorough root cause analysis (RCA) should be performed to determine the underlying factors contributing to the incident. This process involves using frameworks like the Five Whys or Fishbone Diagrams to trace back to the fundamental causes of failures.

Example: If a key application failed during a system update, RCA may reveal that inadequate testing procedures and change management processes were at fault.

Develop and Prioritise Corrective Actions

Once improvement areas are identified, corrective actions should be developed and prioritized based on their impact on operational resilience. These actions should be specific, measurable, achievable, relevant, and time-bound (SMART).

Example: If a delay in crisis communication was noted, AmBank Malaysia may implement an automated alert system to ensure rapid dissemination of critical information.

Update Policies, Procedures, and Training Programs

Policies and standard operating procedures (SOPs) should be revised to incorporate lessons learned. Regular training and awareness programs should reinforce these updates to ensure all employees understand their roles in enhancing resilience.

Example: Following a phishing attack, AmBank Malaysia updates its cybersecurity policy to include mandatory multi-factor authentication and launches an internal awareness campaign on phishing threats.

Test and Validate Enhancements

Corrective actions and policy updates should be validated through scenario-based testing, simulations, or live drills. This ensures that new strategies effectively address identified gaps.

Example: After refining disaster recovery protocols, AmBank Malaysia conducts an unannounced simulation of a ransomware attack to assess the effectiveness of response measures.

Monitor Progress and Establish Continuous Improvement Mechanisms

Regular tracking and assessment of implemented actions ensure sustained improvement. Periodic resilience audits, key performance indicators (KPIs), and feedback loops help measure progress and drive ongoing enhancements.

Example: The bank establishes quarterly resilience reviews where senior management evaluates key metrics such as incident response times and system recovery performance.

The "Improving Lessons Learned" stage is a crucial step in AmBank Malaysia’s journey toward operational resilience excellence. By systematically capturing insights from past incidents and integrating them into business continuity and resilience strategies, the bank strengthens its ability to respond effectively to future disruptions. This proactive approach not only enhances regulatory compliance but also fortifies AmBank Malaysia’s reputation as a resilient and dependable financial institution.

Continuous learning and adaptation are key drivers of resilience. As new threats emerge and operational environments evolve, AmBank Malaysia remains committed to fostering a culture of preparedness, agility, and innovation. By embedding a lessons-learned framework into its operational resilience planning, the bank ensures it is well-equipped to navigate challenges and uphold its commitment to service excellence, customer trust, and financial stability.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.