[OR] [BB] [E3] [C1] Starting Your OR Implementation

eBook 3: Chapter 1

Starting Your Operational Resilience Implementation

Introduction

Operational Resilience (OR) moves from intention to implementation   at this stage of the journey.

In eBook 1: Understanding Your Organisation, Boost Bank’s structure, operating model, and Critical Business Services (CBS) were clearly defined.

In eBook 2: Implementing Operational Resilience for Digital Banking Resilience: Strengthening Boost Bank for Tomorrow, the Operational Resilience Planning Methodology was introduced, providing the strategic framework and regulatory alignment required for a digital bank operating in a highly   interconnected financial ecosystem.

This chapter marks the beginning of Phase 2 (P2) — the core implementation stage of the Operational Resilience Planning Methodology.

For a fully digital institution like Boost Bank, resilience cannot rely solely on high-level governance statements or recovery playbooks. It must be embedded into:

• End-to-end service processes
• Technology architecture
• Third-party ecosystems
• Customer-facing channels
• Decision-making and escalation structures

Phase 2 requires Boost Bank to break down each Critical Business Service — from Digital Account Access & Management (CBS-1) to Incident Response & Customer Support Channels (CBS-8) — into measurable, testable components.

It demands clarity on how services operate, where vulnerabilities exist, what level of disruption is intolerable, and how the bank performs under severe but plausible stress conditions.

This chapter therefore focuses on the six core requirements of Phase 2:

1. Outline Detailed Processes (DP)
2. Map Dependencies (MD)
3. Map Processes and Resources (MPR)
4. Establish Impact Tolerances (iTo)
5. Identify Severe but Plausible Scenarios (SuPS)
6. Perform Scenario Testing (ST)

Together, these requirements transform Operational Resilience from a compliance initiative into a structured resilience engineering programme.

This chapter is also part of the value-adding and complementary services provided under the BCM Institute’s training-led implementation approach.

It reflects actual structured submissions developed during an operational resilience exercise, enabling organisations to convert training knowledge into practical, implementable documentation.

This is where planning becomes operational capability.

This third eBook in the series, “Starting Your OR Implementation,” represents the transition from understanding and design to execution and evidence. While:

• eBook 1 – Understanding Your Organisation established organisational context, regulatory drivers, stakeholder expectations, and critical business services; and
• eBook 2 – Implementing Operational Resilience for Maybank Investment Bank translated OR principles into governance structures, policy direction, and high-level framework design;

eBook 3 drills down into the practical, documentable, and auditable requirements of Phase 2 of the Operational Resilience Planning Methodology.

The five core stages of the “Implement” phase in the Operational Resilience Planning Methodology are central to this ebook.

These stages form the backbone of OR implementation:

• Identify Critical Business Services [DP]
  Determining the business services that, if disrupted, could pose a significant risk to Maybank Investment Bank’s customers, market integrity, or financial stability.
  
  
• Map Dependency and Connectivity [MD]
  Uncovering and documenting the relationships and interdependencies—both internal and external—that support the delivery of critical business services.
  
  
• Map Processes and Resources [MPR]
  Cataloguing the key operational elements—people, systems, data, and facilities—that underpin each critical business service's performance and continuity.
  
  
• Establish Impact Tolerances [ITo]
  Setting defined thresholds for disruption to determine how much stress a service can endure before unacceptable harm occurs.
  
  
• Identify Severe but Plausible Scenarios [SuPS]
  Identifying Severe but Plausible Scenarios that could critically impact each detailed process within the Critical Business Service
  
  
• Perform Scenario Testing [ST]
  Validating assumptions and capabilities by simulating disruptive scenarios to evaluate how well the bank can maintain or recover its critical business services.

This eBook applies the methodology to Boost Bank’s defined Critical Business Services:

• CBS-1 Digital Account Access & Management

• CBS-2 Payments & Fund Transfers (Interbank & P2P)

• CBS-3 Deposit & Withdrawal Services

• CBS-4 Debit Card Transaction Processing

• CBS-5 Digital Lending & Credit Disbursement

• CBS-6 Customer Authentication & eKYC

• CBS-7 API & Ecosystem Integration Services

• CBS-8 Incident Response & Customer Support Channels

Each CBS will be systematically analysed using the six Phase 2 requirements.

This structured approach ensures that resilience is:

• Service-centric
• Evidence-based
• Quantifiable
• Testable
• Board-reportable

This eBook is delivered as part of the value-adding and complementary services offered to organisations that intend to:

• Implement an actual operational resilience or BCM project, or
• Upgrade an existing BCM programme to meet evolving regulatory and supervisory expectations.

It supports organisations participating in the BCM Institute’s training-led implementation approach, particularly those attending:

• Certification programmes, and
• Competency-based professional training courses.

Rather than treating training and implementation as separate activities, this approach integrates learning, application, and evidence creation, allowing organisations to build real operational resilience artefacts while developing internal capability and practitioner competence. 

By the end of this eBook, readers should be able to:

• Translate high-level Critical Business Services into detailed, defensible process maps
• Identify and document material dependencies and resource concentrations
• Set impact tolerances that are realistic, measurable, and regulator-ready
• Design and execute scenario testing that focuses on service continuity rather than system recovery
• Produce structured outputs suitable for internal governance, regulatory review, and audit scrutiny

This eBook is not intended to be read passively. It is designed to be used as a working reference during an operational resilience exercise, supporting teams as they move from planning to execution in a controlled, methodical, and regulator-aligned manner.

Blogs marked [x] are under construction.