[OR] [BDO] [E2] [P1 to P3] [C1] OR Planning Methodology

Operational Resilience Planning Methodology for BDO Unibank

Introduction

BDO Unibank operates at the heart of the Philippine financial system, serving millions of customers across retail, corporate, and institutional segments.

As the scale, complexity, and interconnectivity of banking operations continue to grow—driven by digital transformation, third-party dependencies, and evolving cyber threats—the ability to anticipate, withstand, respond to, and recover from disruptions has become a defining capability for sustained success.

Operational resilience, therefore, is no longer limited to traditional business continuity or disaster recovery practices. It represents a holistic, enterprise-wide discipline that integrates risk management, technology resilience, third-party oversight, crisis management, and customer service continuity into a unified framework.

For BDO Unibank, this means ensuring that critical business services remain available within acceptable thresholds, even in the face of severe but plausible disruptions such as system outages, cyber incidents, natural disasters, or supply chain failures.

To achieve this, BDO Unibank adopts a structured Operational Resilience Planning Methodology built around three progressive and interdependent phases: Plan, Implement, and Sustain.

These phases reflect a lifecycle approach that begins with understanding the organisation’s current resilience posture, moves into the execution and validation of resilience capabilities, and culminates in embedding resilience into the organisation’s culture and continuous improvement processes.

• The Plan Phase establishes the strategic foundation by assessing capabilities, identifying gaps, and defining governance and direction.
• The Implement Phase translates strategy into action by identifying critical business services, mapping dependencies, and validating resilience through testing.
• The Sustain Phase ensures that resilience is continuously reinforced, measured, and embedded into day-to-day operations and organisational behaviour.

Together, these phases provide a structured yet adaptable framework that enables BDO Unibank to respond effectively to regulatory expectations—such as those from the Bangko Sentral ng Pilipinas (BSP)—while also strengthening customer trust and operational stability.

This chapter introduces the methodology at a high level, setting the stage for a deeper exploration of each phase and its associated stages. It highlights how a large and complex banking institution can systematically operationalise resilience, aligning strategic intent with practical execution.

Purpose of the Chapter

The purpose of this chapter is to provide readers with a clear and structured overview of BDO Unibank’s three-phase Operational Resilience Planning Methodology and its associated stages.

It is designed to help readers understand how a large, complex financial institution approaches resilience in a systematic and practical manner.

By the end of this chapter, readers are expected to:

• Appreciate the end-to-end lifecycle of operational resilience planning
• Understand the objectives and outputs of each phase and stage
• Recognise how resilience is built, tested, and sustained over time
• Gain insights that can be adapted to their own organisation’s resilience journey

This foundational understanding will prepare the reader for a deeper exploration of each phase and stage in subsequent chapters.

Overview of the Three Phases of Operational Resilience Planning Methodology

The Operational Resilience Planning Methodology is structured into three key phases:

Phase 1: Plan – Establishing the Foundations

The Plan Phase establishes the foundation for operational resilience by assessing the organisation’s current state, identifying gaps, and defining a strategic roadmap aligned with business objectives and risk appetite.

Stages in Phase 1

• Assess Capability and Maturity
  Evaluate existing resilience capabilities, frameworks, and maturity levels across business units.

• Analyse Gap
  Identify gaps between current capabilities and desired resilience outcomes, including regulatory expectations and industry standards.

• Develop Strategy and Roadmap
  Define a clear operational resilience strategy and implementation roadmap with prioritised initiatives.

• Confirm Risk Appetite
  Establish the organisation’s tolerance for disruption and align resilience objectives with the business risk appetite.

• Develop and Embed Governance
  Set up governance structures, roles, responsibilities, and policies to oversee and drive resilience initiatives.

Phase 2: Implement – Translating Strategy into Action

The Implement Phase focuses on operationalising the resilience strategy by identifying critical services, mapping dependencies, setting tolerances, and validating resilience through testing.

Stages in Phase 2

• Identify Critical Business Services
  Determine which services are essential to customers and to financial stability.

• Map Processes and Resources
  Document end-to-end processes, systems, people, and third-party dependencies supporting each critical service.

• Set Impact Tolerance
  Define acceptable levels of disruption (e.g., maximum tolerable downtime) for each critical service.

• Conduct Scenario Testing
  Test the organisation’s ability to remain within impact tolerances under severe but plausible disruption scenarios.

• Improve Lesson Learned
  Analyse test outcomes and incidents to identify areas for improvement and enhance resilience measures.

Phase 3: Sustain – Embedding and Continuously Improving Resilience

The Sustain Phase ensures that operational resilience becomes embedded within the organisation’s culture, continuously monitored, and improved over time.

Stages in Phase 3

• Introduce Cultural Change
  Promote a resilience-first mindset across all levels of the organisation.

• Develop Communication Strategy
  Establish clear communication plans for both internal stakeholders and external parties during disruptions.

• Implement Training and Awareness
  Provide ongoing training programmes to build staff awareness of and capabilities in resilience.

• Provide Self-assessment
  Enable business units to regularly assess their resilience readiness and compliance.

• Conduct an Independent Quality Review
  Perform independent reviews and audits to validate the resilience framework's effectiveness.

BDO Unibank’s three-phase Operational Resilience Planning Methodology demonstrates that resilience is not a standalone initiative, but a continuous, organisation-wide capability that evolves alongside the bank’s operating environment.

By structuring its approach into the Plan, Implement, and Sustain phases, the bank ensures that resilience is developed with clarity, executed with discipline, and maintained with consistency.

The Plan Phase provides the critical groundwork, enabling the organisation to understand its current state, define its ambition, and establish governance structures that support effective decision-making.

The Implement Phase brings this strategy to life by focusing on what truly matters—protecting critical business services through detailed mapping, defined tolerances, and rigorous testing.

Finally, the Sustain Phase ensures that resilience is not static; instead, it is continuously reinforced through cultural change, communication, training, and independent review.

What makes this methodology particularly effective is its emphasis on integration and iteration.

Each phase feeds into the next, and lessons learned from implementation and testing are continuously looped back into planning and improvement.

This creates a dynamic resilience framework that can adapt to emerging risks, technological changes, and evolving regulatory expectations.

For BDO Unibank, this approach strengthens not only its ability to manage disruptions but also its capacity to deliver consistent, reliable services to customers under all conditions.

It reinforces stakeholder confidence, supports regulatory compliance, and enhances the bank’s long-term sustainability.

For readers, this chapter provides a clear blueprint for structuring and implementing operational resilience within a large financial institution. More importantly, it highlights that achieving resilience is a journey rather than a destination—one that requires ongoing commitment, leadership support, and continuous refinement.

As the subsequent chapters delve deeper into each phase and stage, readers will gain practical insights and actionable guidance to apply these principles within their own organisations, regardless of size or industry.

Blogs marked [x] are under construction.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.