[OR] [BDCB] [E3] [CBS] [2] [ST] Perform Scenario Testing

CBS-2 Currency Management

Introduction

Scenario Testing is a fundamental component of an Operational Resilience programme because it provides objective evidence that a Critical Business Service (CBS) can continue operating within its defined Impact Tolerance when subjected to severe but plausible disruptions.

Rather than validating individual recovery plans or technology components in isolation, Scenario Testing evaluates the resilience of the complete service delivery chain, including people, business processes, technology, information, facilities, third-party providers, governance, and decision-making.

For Brunei Darussalam Central Bank (BDCB), Scenario Testing for CBS-2 Currency Management should evaluate the end-to-end capability to forecast currency demand, procure and safeguard banknotes and coins, distribute currency to financial institutions, authenticate returned currency, manage counterfeit investigations, reconcile inventories, maintain custody, and restore normal operations following significant disruptions.

Since these activities are highly interconnected, testing should not consist of isolated exercises for each Sub-CBS. Instead, multiple Sub-CBS processes should participate in integrated scenario tests that simulate realistic disruptions affecting several operational stages simultaneously.

The foundation of every scenario test should be a Severe but Plausible Scenario that challenges assumptions, exposes vulnerabilities, and identifies resilience gaps before an actual disruption occurs.

Performance should be assessed against predefined Impact Tolerance measures, such as maximum acceptable disruption to national currency availability, reconciliation accuracy, vault integrity, authentication capability, regulatory reporting timeliness, and restoration objectives.

Cyber and ICT Risks—including ransomware, data corruption, network failures, privileged access compromise, infrastructure outages, and third-party technology failures—should be embedded throughout the testing programme because such failures increasingly propagate rapidly across operational processes and interdependent services.

Table 1: Recommended Scenario Testing Programme

Sub-CBS Code	Name of Sub-CBS	Severe but Plausible Scenario	Recommended Scenario Test	Testing Method	Scenario Testing Objective	Key Scenario Injects / Disruption Conditions	Interconnections and Interdependencies Tested
CBS-2.1	Currency Demand Forecasting	National emergency causes sudden surge in currency withdrawals	Integrated Cash Demand Surge Exercise	Capacity & Stress Test with Business Simulation	Validate forecasting accuracy and contingency planning	Withdrawal demand triples; payment network disruption; incomplete market data	Treasury, commercial banks, statistics, cash operations, forecasting systems
CBS-2.2	Currency Production Planning	Regional supplier production delay	Currency Supply Continuity Exercise	Tabletop + Business Simulation	Validate alternative production planning	Supplier delay, inventory depletion, emergency production approval	Forecasting, procurement, vault capacity, senior management decisions
CBS-2.3	Currency Procurement and Manufacturing Oversight	Overseas currency manufacturer suffers cyberattack	Third-Party Resilience Exercise	Third-party Disruption Exercise	Assess resilience of outsourced manufacturing	Production halted; secure communications unavailable	External manufacturer, logistics, procurement, security oversight
CBS-2.4	Currency Inventory and Vault Management	Primary vault unavailable after fire suppression activation	Vault Continuity Exercise	Integrated Business & Technology Simulation	Validate continuity of secure inventory operations	Vault inaccessible; inventory movement suspended	Security, physical facilities, inventory systems, custody teams
CBS-2.5	Currency Distribution and Replenishment	Major transportation disruption during festive demand peak	End-to-End Currency Distribution Exercise	Simulation Exercise	Maintain nationwide cash availability	Road closures, vehicle failure, delayed deliveries	Logistics providers, commercial banks, vault operations
CBS-2.6	Currency Receipt and Return Processing	Large volume of returned notes exceeds processing capacity	Currency Processing Surge Exercise	Capacity Stress Test	Validate processing resilience under extreme workload	Processing backlog; staff shortages	Distribution, authentication, reconciliation processes
CBS-2.7	Currency Authentication and Quality Verification	Counterfeit campaign introduces sophisticated forged notes	Counterfeit Response Exercise	Tabletop with Technical Validation	Validate counterfeit detection capability	Multiple counterfeit batches received	Law enforcement, laboratories, banks, authentication systems
CBS-2.8	Currency Fitness Sorting and Recirculation Management	Automated sorting equipment fails nationwide	Currency Sorting Continuity Exercise	Technical Recovery + Business Simulation	Validate manual processing and alternative facilities	Sorting equipment unavailable	Processing centres, maintenance vendors, logistics
CBS-2.9	Counterfeit Currency Investigation and Reporting	Coordinated counterfeit attack across financial institutions	National Counterfeit Crisis Exercise	Crisis Management Exercise	Assess investigation coordination	Multiple banks report counterfeit circulation	Police, financial institutions, intelligence units
CBS-2.10	Currency Destruction and Disposal Management	Destruction facility unavailable during high disposal volume	Currency Disposal Continuity Exercise	Walk-through + Simulation	Validate secure temporary storage arrangements	Incinerator unavailable; disposal delayed	Vaults, security, environmental contractors
CBS-2.11	Currency Accounting and Reconciliation	Reconciliation database corruption	Data Integrity Exercise	Data Integrity & Reconciliation Test	Validate financial integrity restoration	Ledger mismatch; corrupted reconciliation records	Accounting systems, ERP, finance, audit
CBS-2.12	Currency Security and Custody Management	Insider compromise of vault access privileges	Insider Threat Exercise	Cyber Incident Simulation + Tabletop	Validate security governance and escalation	Privileged credentials misused	Cybersecurity, HR, physical security, audit
CBS-2.13	Currency Information and Operational Monitoring	Operational monitoring platform unavailable	Monitoring Continuity Exercise	Failover & Redundancy Test	Validate alternative operational visibility	Dashboard unavailable; monitoring alerts fail	ICT operations, SOC, business monitoring
CBS-2.14	Currency Incident Management and Service Recovery	Simultaneous cyberattack and facility disruption	Enterprise Currency Crisis Exercise	Integrated Crisis Management Exercise	Assess coordinated recovery across all Sub-CBS	Ransomware; communications disruption; facility closure	Crisis team, ICT, operations, communications
CBS-2.15	Regulatory Reporting and Continuous Service Improvement	Regulatory submission delayed following operational disruption	Regulatory Reporting Resilience Exercise	Walk-through + Tabletop	Validate reporting continuity and governance	Incomplete operational data; compressed reporting timeline	Risk, compliance, finance, senior management

Table 2. Scenario Testing Outcomes

Sub-CBS Code	Name of Sub-CBS	Cyber and ICT Risk Linkage	Impact Tolerance Boundary Tested	Expected Resilience Outcome	Evidence to be Collected	Proactive Risk Management Action	Evidence of Proactive Risk Management
CBS-2.1	Currency Demand Forecasting	Data feed interruption, analytics platform failure	Forecast produced within tolerance period	Accurate contingency forecast maintained	Forecast reports, exercise logs	Diversify forecasting inputs	Updated forecasting methodology and approvals
CBS-2.2	Currency Production Planning	Planning application outage	Production decisions completed within recovery objective	Alternative production approved promptly	Planning records, approvals	Dual production planning process	Approved contingency production procedures
CBS-2.3	Currency Procurement and Manufacturing Oversight	Third-party cyberattack	Procurement continuity maintained	Alternative sourcing initiated	Supplier participation records	Strengthen supplier resilience reviews	Updated third-party risk assessments
CBS-2.4	Currency Inventory and Vault Management	Access control failure, network outage	Secure custody maintained	Inventory integrity preserved	Vault logs, access records	Secondary vault arrangements	Successful alternate vault validation
CBS-2.5	Currency Distribution and Replenishment	Logistics platform disruption	Nationwide cash availability maintained	Priority distribution sustained	Delivery timelines, service metrics	Diversify transport providers	Revised logistics contracts
CBS-2.6	Currency Receipt and Return Processing	Processing application slowdown	Processing backlog within tolerance	Critical processing completed	Queue statistics, throughput reports	Surge staffing arrangements	Capacity improvement plans
CBS-2.7	Currency Authentication and Quality Verification	Authentication database outage	Counterfeit detection maintained	Detection rates remain effective	Authentication results	Enhance detection capability	Updated authentication controls
CBS-2.8	Currency Fitness Sorting and Recirculation Management	Equipment control system failure	Currency recirculation maintained	Manual fallback successful	Recovery measurements	Expand equipment redundancy	Tested alternate processing procedures
CBS-2.9	Counterfeit Currency Investigation and Reporting	Intelligence-sharing platform outage	Investigation initiated within required timeframe	Coordinated response maintained	Investigation timeline	Improve intelligence integration	Updated inter-agency protocols
CBS-2.10	Currency Destruction and Disposal Management	Facility management system outage	Secure disposal backlog within tolerance	Secure storage maintained	Custody logs	Increase temporary storage capacity	Inspection and audit reports
CBS-2.11	Currency Accounting and Reconciliation	Database corruption	Financial reconciliation completed accurately	Data integrity restored	Reconciliation reports	Strengthen integrity monitoring	Independent validation reports
CBS-2.12	Currency Security and Custody Management	Privileged-access compromise	Vault security never breached	Access compromise contained	SIEM logs, audit trails	Enhance privileged-access monitoring	Access review reports
CBS-2.13	Currency Information and Operational Monitoring	Monitoring platform failure	Operational awareness maintained	Backup monitoring activated	System monitoring evidence	Deploy redundant monitoring capability	Successful failover evidence
CBS-2.14	Currency Incident Management and Service Recovery	Ransomware, communication outage	Currency service restored within Impact Tolerance	Coordinated enterprise recovery achieved	Crisis logs, recovery metrics	Improve integrated response plans	Approved remediation closure reports
CBS-2.15	Regulatory Reporting and Continuous Service Improvement	Reporting application outage	Regulatory reporting completed within obligations	Accurate reporting maintained	Regulatory submissions, management reports	Automate reporting resilience	Internal audit validation and management approval

Regulatory Considerations for Scenario Testing by a Brunei Financial Services Institution

Although Brunei Darussalam Central Bank (BDCB) expects financial institutions to maintain sound governance, effective risk management, business continuity capabilities, ICT resilience, and operational risk management, organisations should distinguish between explicit supervisory expectations and implementation practices derived from international Operational Resilience guidance.

Explicit supervisory expectations

A Brunei financial institution should ensure that:

Critical services are identified and appropriately governed.
Operational, ICT, and cyber risks are effectively managed.
Business continuity arrangements are periodically exercised and reviewed.
Senior management and the Board receive sufficient assurance regarding operational resilience capabilities.
Material incidents are reported, and lessons are incorporated into future improvements.

Implementation recommendations based on Operational Resilience good practice

Beyond regulatory expectations, an effective Scenario Testing programme should:

Test complete end-to-end Currency Management services rather than individual systems.
Define measurable Impact Tolerances before executing scenario tests.
Use severe but plausible scenarios that combine operational, cyber, physical, and third-party disruptions.
Challenge critical interconnections between treasury, vault operations, logistics providers, commercial banks, law enforcement agencies, ICT infrastructure, and external currency manufacturers.
Integrate cyber incident response, crisis management, technology recovery, manual workarounds, and executive decision-making within a single exercise.
Collect auditable evidence including scenario plans, inject logs, recovery measurements, decision records, reconciliation results, lessons identified, remediation plans, independent assurance reports, and Board reporting.
Track remediation actions through formal governance processes until verified closure, ensuring that recurring scenario testing demonstrates measurable improvements in resilience maturity.

Scenario Testing provides BDCB with practical evidence that CBS-2 Currency Management can continue operating within its defined Impact Tolerance despite severe operational, cyber, technology, physical, and third-party disruptions.

Testing each Sub-CBS while integrating them into broader end-to-end exercises enables the Bank to understand how failures propagate across forecasting, procurement, vault operations, distribution, authentication, accounting, security, and regulatory reporting.

Embedding Cyber and ICT Risks throughout these scenarios ensures that resilience is assessed under realistic operating conditions rather than through isolated technology or business continuity tests.

The evidence generated—including recovery metrics, decision logs, reconciliation results, cyber monitoring records, lessons identified, and remediation tracking—provides demonstrable assurance to senior management, the Board, auditors, and supervisors that operational resilience is actively managed and continuously improved through structured governance, targeted investment, and disciplined remediation.

eBook 3: Starting Your OR Implementation
CBS-2 Currency Management
CBS-2 DP	CBS-2 MII	CBS-2 ITo	CBS-2 SbPS	CBS-2 ST

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.



	If you have any questions, click to contact us.

Operational Resilience in Practice: The Brunei Darussalam Central Bank Approach

[OR] [BDCB] [E3] [CBS] [2] [ST] Perform Scenario Testing

Operational Resilience Certified Planner-Specialist-Expert

CBS-2 Currency Management

Introduction

Table 1: Recommended Scenario Testing Programme

Table 2. Scenario Testing Outcomes

Regulatory Considerations for Scenario Testing by a Brunei Financial Services Institution

Explicit supervisory expectations

Implementation recommendations based on Operational Resilience good practice

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Your Comments Here:

Operational Resilience in Practice: The Brunei Darussalam Central Bank Approach

[OR] [BDCB] [E3] [CBS] [2] [ST] Perform Scenario Testing

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '3c32e9b3-ea88-44c3-9182-fa3e6a9aadee', {"useNewLoader":"true","region":"na1"});

Operational Resilience Certified Planner-Specialist-Expert

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, 'e988f5bf-ed94-4847-aa5a-ae35f45e639e', {"useNewLoader":"true","region":"na1"});

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '3c32e9b3-ea88-44c3-9182-fa3e6a9aadee', {"useNewLoader":"true","region":"na1"});

CBS-2 Currency Management

Introduction

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, 'a45e9708-7139-4f4e-8e0e-41179f5cacc3', {"useNewLoader":"true","region":"na1"});

Table 1: Recommended Scenario Testing Programme

Table 2. Scenario Testing Outcomes

Regulatory Considerations for Scenario Testing by a Brunei Financial Services Institution

Explicit supervisory expectations

Implementation recommendations based on Operational Resilience good practice

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Your Comments Here: