[OR] [BNM] [C2] Comparison Between BNM OR Paper with “Plan” Phase (P1) of the BCM Institute’s Operational Resilience Planning Methodology

Chapter 2

Comparison with Plan Phase [P1] of OR Planning Methodology

BNM’s Discussion Paper articulates high-level principles and focus areas to strengthen operational resilience across financial institutions.

It reflects the realities of increased digital reliance, interconnected systems, and reliance on external parties, with the aim of ensuring the continuity of critical services during significant disruptions, such as cyber incidents, system outages, or external shocks.

Key themes include:

• Need to identify and maintain critical services that, if disrupted, could harm customers or systemic stability.
• Focus on interdependencies, especially third-party and technology relationships.
• Governance and Board Accountability for Resilience Outcomes.
• Moving beyond internal recovery metrics toward customer-centric tolerances of disruption.
• Importance of scenario testing across people, process, technology and ecosystem levels.

Overview of the BCM Institute’s “Plan” Phase (OR-P1)

The BCM Institute’s Plan phase (the first of three phases in operational resilience planning) establishes the foundational thinking and organisational preparedness necessary before detailed resilience work begins. It comprises five sequential stages:

1. Assess Capability & Maturity – Establish current resilience capabilities and gaps.
2. Analyse Gap  – Identify and prioritise where resilience capabilities require strengthening.
3. Develop Strategy & Roadmap – Develop a strategic plan to enhance resilience capabilities, aligned with organisational directives.
4. Confirm Risk Appetite – Establish risk appetite and thresholds (KPIs/KRIs) aligned to organisational objectives and resilience outcomes.
5. Develop & Embed Governance – Embed operational resilience within governance and decision-making structures.

Detailed Comparison: Plan Phase vs. BNM Expectations

Key Observations

Shared Orientation Toward Outcomes

Both BNM’s discussion paper and the BCM Institute’s Plan phase recognise that traditional resilience (recovery times, backups) is insufficient on its own. What matters is maintaining customer-facing critical services within tolerable limits during disruptions.

Governance and Accountability Are Central

BNM’s emphasis on board and senior management's responsibility aligns closely with the Plan phase’s requirement to embed governance and secure executive approval for the resilience strategy and risk appetite.

Strategic Thinking Is a Foundation

While BNM provides high-level expectations, the BCM Institute’s Plan phase provides a structured process for translating those expectations into executable plans, including maturity assessments, gap analyses, and strategic roadmaps.

Risk Appetite vs Impact Tolerances

BCM Institute’s Plan phase begins with the risk appetite, expressed in general terms (KPIs/KRIs).

BNM specifically advocates defining impact tolerances for critical services, thereby pushing organisations toward tolerances based on external impact rather than internal operational metrics.

Planning vs Implementation Timing

BNM’s Discussion Paper sets out requirements that span both planning and implementation (e.g., dependency mapping and scenario testing).

In BCM Institute’s model, these deeper analytical and tactical activities (e.g., mapping, testing) are intentionally reserved for the Implement phase (P2), underscoring that Plan is about strategic readiness, not execution.

Practical Implications

If an organisation is using the BCM Institute’s Plan phase as its methodological start:

• BNM’s expectations validate the Plan phase’s activities and provide regulatory impetus for organisations to take them seriously.
• The outputs of the Plan phase (maturity baseline, gap analysis, resilience strategy, risk appetite, and governance) will be foundational for meeting BNM’s evolving expectations.
• BNM’s emphasis on impact tolerances and customer-centric tolerances should be embedded in the Plan phase’s strategy and risk appetite formulation, even if the detailed implementation (mapping and testing) occurs later.
• The governance work of the Plan phase should explicitly reference board oversight and accountability mechanisms for operational resilience, as required by BNM.

Note from Author/Speaker

Author Comment: This is a detailed comparison between Bank Negara Malaysia’s (BNM) Discussion Paper on Operational Resilience (the regulator’s emerging expectations for financial institutions) and the “Plan” phase of the BCM Institute’s Operational Resilience Planning Methodology (as laid out in the OR-P1 guidance).

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About Operational Resilience Course OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer [OR-3] course and the  OR-5000 Operational Resilience Expert Implementer [OR-5] course.