---
title: [OR] [BCPC] [C11] Aligning with Regulatory Expectations
description: [OR] [BCPC] [C11] Aligning with Regulatory Expectations
image: https://blog.bcm-institute.org/hubfs/Langkawi%20Conference%20Graphic%20Folder/Langkawi%20Conference%20Morepost/%5BBCM%5D%20%5BC2026%5D%20%5BC11%5D%20Aligning%20with%20Regulatory%20Expectations.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Bridging the Divide: Culture as the Linchpin of Business Continuity
![BB OR \[D\] 6](https://blog.bcm-institute.org/hs-fs/hubfs/BB%20OR%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20Pictures%20A/BB%20OR%20Folder%20D/BB%20OR%20%5BD%5D%206.jpg?width=2000&height=1333&name=BB%20OR%20%5BD%5D%206.jpg "BB OR [D] 6")
# \[OR\] \[BCPC\] \[C11\] Aligning with Regulatory Expectations
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c106f4a4-d728-45ad-9cf9-334d2701f911)
Regulatory expectations across Malaysia and the broader ASEAN region are evolving rapidly.
Supervisory authorities are no longer satisfied with organisations simply demonstrating the existence of Business Continuity Management (BCM) frameworks.
Instead, they increasingly expect institutions to prove that they can maintain critical services under stress.
This shift reflects a broader move toward operational resilience—a discipline that emphasises outcomes, not just processes.
While regulations may not explicitly mandate “culture,” they are increasingly assessing it implicitly through how organisations behave, respond, and improve.
This chapter explores how organisations can align with these expectations and demonstrate credible evidence of a resilience-driven culture during audits and regulatory reviews.
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 24, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c106f4a4-d728-45ad-9cf9-334d2701f911)
### Chapter 11
### Aligning with Regulatory Expectations
#### **Introduction**
[![\[BCM\] \[C2026\] \[C11\] Aligning with Regulatory Expectations](https://no-cache.hubspot.com/cta/default/3893111/b4cc0c54-0c05-4ee0-a933-ecb7c349c6fd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b4cc0c54-0c05-4ee0-a933-ecb7c349c6fd)Regulatory expectations across Malaysia and the broader ASEAN region are evolving rapidly.
Supervisory authorities are no longer satisfied with organisations simply demonstrating the existence of Business Continuity Management (BCM) frameworks.
Instead, they increasingly expect institutions to prove that they can maintain critical services under stress.
This shift reflects a broader move toward operational resilience—a discipline that emphasises outcomes, not just processes.
While regulations may not explicitly mandate “culture,” they are increasingly assessing it implicitly through how organisations behave, respond, and improve.
This chapter explores how organisations can align with these expectations and demonstrate credible evidence of a resilience-driven culture during audits and regulatory reviews.
#### Purpose of the Chapter
The purpose of this chapter is to:
- Explain the regulatory shift toward operational resilience
- Highlight key areas of regulatory focus
- Describe how regulators assess culture indirectly
- Provide guidance on demonstrating evidence of culture in audits and reviews
By the end of this chapter, readers will understand how to align cultural initiatives with regulatory expectations and strengthen audit readiness.
#### **The Shift Toward Operational Resilience**
Regulators are moving beyond traditional BCM compliance to focus on whether organisations can **withstand and recover from disruptions while continuing to deliver critical services**.
In Malaysia, this shift is strongly influenced by **Bank Negara Malaysia (BNM)**, which has emphasised operational resilience through its evolving guidelines and discussion papers.
##### **Key Regulatory Themes**
Across Malaysia and ASEAN, regulators are increasingly emphasising:
- **Outcome-Based Resilience**
Organisations must demonstrate the ability to maintain service continuity, not just document recovery plans
- **End-to-End Service Perspective**
Focus on critical business services rather than isolated processes
- **Integration Across Risk Domains**
Alignment of BCM with operational risk, cyber resilience, and third-party risk
- **Continuous Testing and Improvement**
Regular validation of resilience capabilities through scenario testing
#### **Increasing Emphasis Areas**
##### **Operational Resilience**
Operational resilience requires organisations to:
- Identify and prioritise critical services
- Understand dependencies and interconnections
- Build the capability to absorb and recover from disruptions
**Cultural implication:**
- Resilience must be embedded across all levels
- Employees must understand their role in maintaining service continuity
##### **Critical Business Services (CBS)**
Regulators now expect organisations to:
- Define their **critical business services**
- Assess the impact of disruptions on these services
- Establish tolerances for disruption
**Cultural implication:**
- Business units must take ownership of their services
- Decisions must prioritise service continuity over internal convenience
##### **Scenario Testing**
Scenario testing is a key regulatory requirement for validating resilience.
Organisations are expected to:
- Conduct **severe but plausible scenarios**
- Test cross-functional coordination
- Evaluate decision-making under stress
**Cultural implication:**
- Employees must engage actively in exercises
- Leadership must demonstrate decisiveness and accountability
- Learning must be continuous and transparent
#### **How Regulators Are Implicitly Assessing Culture**
While culture is rarely assessed directly, regulators evaluate it through **observable behaviours and outcomes**.
##### **Indicators Used by Regulators**
Regulators assess culture indirectly by examining:
- **Leadership Engagement**
- **Decision-Making Effectiveness**
- **Cross-Functional Coordination**
- **Quality of Exercises**
- **Continuous Improvement**
##### **Behaviour vs Documentation**
Regulators increasingly differentiate between:
- **What is documented** (policies, plans)
- **What is demonstrated** (actual performance)
An organisation with strong documentation but weak execution may still be viewed as **high risk**.
#### **Demonstrating “Evidence of Culture” in Audits and Reviews**
To meet regulatory expectations, organisations must provide **tangible evidence that culture supports resilience**.
##### **Types of Evidence**
Evidence of culture can be demonstrated through:
**1. Exercise Outcomes**
- Detailed reports showing:
**2. Incident Response Records**
- Documentation of real incidents, including:
**3. Training and Awareness Metrics**
- Participation rates in BCM training
- Feedback from employees
- Evidence of role-based capability development
**4. Governance and Oversight**
- Board and management meeting minutes
- Evidence of leadership engagement in resilience discussions
- Oversight of critical business services
##### **Behavioural Evidence**
Beyond documentation, organisations should demonstrate:
- Empowered decision-making at operational levels
- Effective cross-functional collaboration
- Proactive identification and escalation of risks
This can be captured through:
- Exercise observations
- Post-incident reviews
- Internal assessments
##### **Linking Evidence to Outcomes**
Regulators are particularly interested in outcomes such as:
- Ability to maintain critical services
- Reduced recovery times
- Improved response coordination
Organisations should clearly link:
- Cultural initiatives → behavioural improvements → resilience outcomes
#### **Integrating Culture into Regulatory Compliance**
To align culture with regulatory expectations, organisations should:
##### **Embed Culture into BCM Frameworks**
- Align policies with behavioural expectations
- Integrate cultural objectives into resilience programs
##### **Strengthen Leadership Accountability**
- Ensure leadership actively participates in resilience initiatives
- Link resilience outcomes to performance metrics
##### **Enhance Scenario Testing**
- Use realistic and challenging scenarios
- Focus on behaviour, not just process validation
##### **Establish Continuous Feedback Loops**
- Capture lessons learned from exercises and incidents
- Implement improvements consistently
#### **From Compliance to Demonstrated Capability**
The ultimate goal of regulatory alignment is not just compliance, but **demonstrated capability**.
This requires organisations to:
- Move beyond documentation
- Focus on execution and outcomes
- Embed resilience into culture and behaviour
Organisations that achieve this will not only meet regulatory expectations but also gain a competitive advantage through enhanced resilience.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3a5927f9-c2a4-4d3e-a8e4-b444b04b9975)
Regulatory expectations in Malaysia and ASEAN are increasingly focused on operational resilience, critical business services, and scenario testing.
While culture may not always be explicitly defined in regulations, it is **implicitly assessed through behaviour, performance, and outcomes**.
Organisations must therefore demonstrate not only that they have frameworks in place, but that they can execute effectively during disruptions.
This requires providing clear evidence of a resilience-driven culture—through exercises, incident responses, governance, and continuous improvement.
Ultimately, aligning with regulatory expectations is not about meeting minimum requirements. It is about building an organisation that can **consistently deliver critical services under stress**.
And at the heart of this capability lies culture—the true linchpin of business continuity and operational resilience.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/563f1cfd-2500-4ef4-bb39-d549157fb0e9)
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** | **C7** |
| --- | --- | --- | --- | --- | --- | --- |
| [![\[BCM\] \[C2026\] \[C1\] Foundational Setting for BCM](https://no-cache.hubspot.com/cta/default/3893111/2a49cc7c-1c14-494f-8b59-4ee1be5e0c32.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2a49cc7c-1c14-494f-8b59-4ee1be5e0c32) | [![\[BCM\] \[C2026\] \[C2\] The Evolving Risk Landscape in ASEAN](https://no-cache.hubspot.com/cta/default/3893111/33c77d8f-0f49-43a1-a62f-c99a8edd39cf.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/33c77d8f-0f49-43a1-a62f-c99a8edd39cf) | [![\[BCM\] \[C2026\] \[C3\] Understanding Organisational Culture in BCM](https://no-cache.hubspot.com/cta/default/3893111/a466b1c5-6ae8-4639-b3d2-810292dd5bc1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a466b1c5-6ae8-4639-b3d2-810292dd5bc1) | [![\[BCM\] \[C2026\] \[C4\] The Cultural Gap in BCM](https://no-cache.hubspot.com/cta/default/3893111/b009d745-fc5e-4ef7-9815-65b9de30e44c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b009d745-fc5e-4ef7-9815-65b9de30e44c) | [![\[BCM\] \[C2026\] \[C5\] Culture as the Linchpin of Resilience](https://no-cache.hubspot.com/cta/default/3893111/a402d98d-76f4-40b6-9abb-38f70e642c43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a402d98d-76f4-40b6-9abb-38f70e642c43) | [![\[BCM\] \[C2026\] \[C6\] Leadership’s Role in Driving BCM Culture](https://no-cache.hubspot.com/cta/default/3893111/1fa19e9c-d01f-4cc6-8db8-426ab5d9401f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1fa19e9c-d01f-4cc6-8db8-426ab5d9401f) | [![\[BCM\] \[C2026\] \[C7\] Building a Resilience-Driven Culture](https://no-cache.hubspot.com/cta/default/3893111/b3321c7f-3f94-4fb2-97ab-cb1e6569914b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3321c7f-3f94-4fb2-97ab-cb1e6569914b) |
| **C8** | **C9** | **C10** | **C11** | **C12** | **C13** | |
| [![\[BCM\] \[C2026\] \[C8\] Practical Tools to Shift Culture](https://no-cache.hubspot.com/cta/default/3893111/a64cd511-75b7-4cc2-b091-1aa539aac30e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a64cd511-75b7-4cc2-b091-1aa539aac30e) | [![\[BCM\] \[C2026\] \[C9\] Case Studies and Regional Insights](https://no-cache.hubspot.com/cta/default/3893111/3f00af27-60ea-4ad9-8631-001d2166ef2b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3f00af27-60ea-4ad9-8631-001d2166ef2b) | [![\[BCM\] \[C2026\] \[C10\] Measuring Culture in BCM](https://no-cache.hubspot.com/cta/default/3893111/6ebf4749-8281-4834-913e-6543e7955920.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6ebf4749-8281-4834-913e-6543e7955920) | [![\[BCM\] \[C2026\] \[C11\] Aligning with Regulatory Expectations](https://no-cache.hubspot.com/cta/default/3893111/b4cc0c54-0c05-4ee0-a933-ecb7c349c6fd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b4cc0c54-0c05-4ee0-a933-ecb7c349c6fd) | [![\[BCM\] \[C2026\] \[C12\] The Future — Culture in OR](https://no-cache.hubspot.com/cta/default/3893111/eed40b9e-e75a-4ea3-ba9f-ac6eae158970.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/eed40b9e-e75a-4ea3-ba9f-ac6eae158970) | [![\[BCM\] \[C2026\] \[C13\] Key Takeaways](https://no-cache.hubspot.com/cta/default/3893111/abc73f4d-716b-4ad3-90fc-1a62a6ca9ff4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/abc73f4d-716b-4ad3-90fc-1a62a6ca9ff4) | |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-06-24T01:24:37.106Z",
"datePublished" : "2026-04-24T14:38:02.000Z",
"headline" : "[OR] [BCPC] [C11] Aligning with Regulatory Expectations",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-bcpc-c11-aligning-with-regulatory-expectations",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```