[OR] [BC] [E1] [C1] Introducing OR Case Study

eBook 1: Chapter 1

Introduction to Bank of Commerce – Understanding the Organisation

Introduction

This eBook series, “A Practical Guide to Operational Resilience for Bank of Commerce,” is designed to help the Bank of Commerce strengthen its ability to anticipate, withstand, respond to, and recover from disruptions.

As financial institutions face increasing operational, technological, and cyber risks, operational resilience has become a regulatory and strategic imperative—particularly under frameworks such as the Bangko Sentral ng Pilipinas (BSP) guidelines.

This chapter provides a consolidated summary of the first eBook, “Understanding Your Organisation.” It establishes the foundational knowledge required before embarking on designing and implementing a robust operational resilience programme.

By examining the Bank’s structure, environment, services, and strategic priorities, this chapter equips stakeholders with the contextual understanding necessary to effectively anchor resilience initiatives.

Purpose of Chapter

The purpose of this chapter is to synthesise the key insights from eBook 1 into a cohesive overview, preparing stakeholders for the subsequent phases of operational resilience planning. It aims to:

Provide a clear understanding of Bank of Commerce’s organisational structure and operating context
Highlight the importance of identifying and protecting critical business services
Establish the rationale for forming a dedicated operational resilience governance structure
Align organisational characteristics and strategic objectives with resilience outcomes

By the end of this chapter, readers will have a holistic appreciation of how organisational understanding forms the cornerstone of operational resilience.

Introduction to the Case Study of the Bank of Commerce

The case study focuses on Bank of Commerce as a mid-sized universal bank in the Philippines, offering a range of financial products and services, including deposits, loans, trade finance, treasury services, and digital banking solutions.

Like many financial institutions operating in a dynamic and highly regulated environment, the Bank must ensure continuity of its critical operations amidst disruptions such as cyber incidents, system failures, natural disasters, and third-party outages.

The Bank’s commitment to customer service, regulatory compliance, and digital transformation makes operational resilience a critical capability rather than a compliance exercise.

Understanding the Bank of Commerce

Understanding the organisation involves analysing its structure, governance, business model, and service delivery mechanisms. For Bank of Commerce, this includes:

Business Model: A customer-centric banking model supporting retail, commercial, and corporate clients
Service Delivery Channels: Branch banking, digital platforms, ATM networks, and third-party integrations
Operational Structure: Functional divisions such as operations, IT, risk management, compliance, and customer service

A clear understanding of these elements enables the Bank to identify vulnerabilities and dependencies that may impact service continuity.

Bank of Commerce’s Operating Environment

Bank of Commerce operates within a complex ecosystem shaped by:

Regulatory Requirements: Compliance with BSP regulations, including operational resilience expectations under Circular No. 1203
Technological Evolution: Increasing reliance on digital banking platforms and cybersecurity measures
Customer Expectations: Demand for uninterrupted, real-time financial services
External Threat Landscape: Exposure to cyber threats, fraud risks, natural disasters, and third-party disruptions

This environment necessitates a proactive and structured approach to resilience, ensuring that the Bank can maintain critical services even under severe but plausible scenarios.

Composition of an Operational Resilience Team

A robust operational resilience programme requires a cross-functional team with clearly defined roles and responsibilities. At Bank of Commerce, the Operational Resilience Team typically includes:

Senior Management / Board Representatives: Providing strategic oversight and risk appetite direction
Risk Management Function: Leading the resilience framework and risk assessments
Business Unit Heads: Ensuring continuity of critical business services
IT and Cybersecurity Teams: Managing technology resilience and incident response
Operations and Support Functions: Supporting process continuity and recovery execution
Compliance and Internal Audit: Ensuring adherence to regulatory requirements and continuous improvement

This integrated governance structure ensures that resilience is embedded across the organisation rather than siloed within a single function.

Critical Business Services of Bank of Commerce

A central concept in operational resilience is the identification of Critical Business Services (CBS)—services whose disruption would significantly impact customers, financial stability, or regulatory compliance.

For Bank of Commerce, typical CBS may include:

Deposit and account services
Payments and funds transfer services
Digital and electronic banking services
Lending and credit processing

Key considerations when identifying CBS include:

Customer Impact: The extent of disruption to customers
Market and Financial Stability: Potential systemic implications
Regulatory Obligations: Compliance with BSP requirements
Substitutability: Availability of alternative service providers

Understanding these services enables the Bank to prioritise resilience efforts where they matter most.

Key Characteristics of the Bank of Commerce

Several organisational characteristics influence the design of the Bank’s operational resilience framework:

Digital Transformation Focus: Increasing reliance on technology-driven service delivery
Interconnected Operations: Dependencies across internal systems and external partners
Regulatory Sensitivity: Strong alignment with BSP and international standards
Customer-Centric Approach: Emphasis on service reliability and trust

These characteristics highlight the need for resilience strategies that are adaptive, technology-driven, and customer-focused.

Establishing Organisational Goals for Operational Resilience

To translate understanding into action, Bank of Commerce must define clear operational resilience objectives aligned with its strategic priorities. These goals typically include:

Ensuring Continuity of Critical Business Services within defined impact tolerances
Strengthening Incident Response and Recovery Capabilities across all disruption scenarios
Enhancing Visibility of Dependencies across people, processes, technology, and third parties
Embedding a Culture of Resilience across all business units
Achieving Regulatory Compliance with BSP operational resilience guidelines

These goals provide the foundation for the subsequent phases of the operational resilience journey.

This chapter has summarised the key elements of “Understanding Your Organisation” for Bank of Commerce, establishing the critical baseline required for operational resilience.

By examining the Bank’s structure, operating environment, governance, critical services, and strategic objectives, stakeholders gain a comprehensive understanding of the organisation’s resilience context.

This foundational knowledge is essential before progressing to the next stage—“Implementing Operational Resilience”—where strategies, frameworks, and methodologies will be developed and applied.

Ultimately, a deep understanding of the organisation ensures that resilience initiatives are not only compliant but also practical, targeted, and sustainable.

Blogs marked [x] are under construction.

eBook 1: Understanding Your Organisation: Bank of Commerce
C1	C2 [x]	C3 [x]	C4 [x]

C5	C6 [x]	C7 [x]	C8 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.