.
Comparison with BNM OR Paper with BCM Institute's Operational Resilience Planning Methodology
OR BB_v4_12

[OR] [BNM] [C3] Comparison Between BNM OR Paper with “Implement” Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology

BNM Speaker Banner

New call-to-action

Bank Negara Malaysia’s Discussion Paper on Operational Resilience articulates high-level expectations for financial institutions to develop resilience capabilities in a rapidly evolving operational risk landscape.

Key principles include:

  • Ensuring continuity of critical financial services during severe disruptions.
  • Managing digitalisation pressures and interconnected operations with third parties.
  • Strengthening governance, incident response, resilience testing, and third-party risk management.
  • Emphasising the ability to respond, recover, adapt, and learn from disruptions.

The BNM OR consultative paper is consultative in nature but signals significant regulatory direction on outcomes related to operational resilience.

This chapter is a continuation of the "Comparison with BNM OR consultative paper" with the Implement Phase [P2] of the OR Planning Methodology

Moh Heng Goh
Operational Resilience Certified Planner-Specialist-Expert

New call-to-actionChapter 3

BNM Speaker Banner

Comparison with the Implement Phase [P2] of the OR Planning Methodology

Context: BNM Operational Resilience Discussion Paper (Emerging Regulatory Expectations)

[OR] [BNM] [C3] Comparison with BNM OR Paper [Implement Phase]Bank Negara Malaysia’s Discussion Paper on Operational Resilience articulates high-level expectations for financial institutions to develop resilience capabilities in a rapidly evolving operational risk landscape. Key principles include:

  • Ensuring continuity of critical financial services during severe disruptions.
  • Managing digitalisation pressures and interconnected operations with third parties.
  • Strengthening governance, incident response, resilience testing, and third-party risk management.
  • Emphasising the ability to respond, recover, adapt, and learn from disruptions.

The chapter is consultative in nature but signals significant regulatory direction on operational resilience outcomes.

Overview: BCM Institute’s Implement Phase (OR-P2)

The Implement Phase of the BCM Institute’s Operational Resilience Planning Methodology translates strategy into actionable steps that build the resilience program.

It typically follows completion of the Plan Phase (P1) and consists of five key stages:

New call-to-action

Stage

Key Activity

S1

Identify Critical Business Services

S2

Map Processes and Resources (dependencies)

S3

Set Impact Tolerance

S4

Conduct Scenario Testing

S5

Improve — Lesson Learned Incorporation

This phase involves transforming high-level strategy into a detailed resilience architecture and operational model.

Detailed Comparison: Implement Phase vs. BNM Expectations

Component

BNM Discussion Paper Expectations

BCM Institute Implement Phase Guidance

Analysis & Alignment

[P2-S1] Identify Critical Business Services

BNM emphasises maintaining the continuity of critical financial services, requiring firms to identify which services are most vital and why.

BCM Institute explicitly requires the identification of critical business services (S1) to prioritise resilience efforts.

Aligned: Both require articulation of critical services; BCM Institute adds a structured methodology to define and document them.

[P2-S2] Map Processes and Resources (Map Dependencies)

BNM emphasises the need to understand internal and external dependencies, including third-party providers and digital infrastructure.

BCM Institute requires mapping processes and resources (people, technology, facilities, and information) for services (S2).

Highly aligned: BNM’s call for deep dependency visibility is structurally captured within mapping activities.

[P2-S3] Set Impact Tolerance

BNM’s paper emphasises tolerances based on customer and systemic harm, going beyond traditional RTOs.

BCM Institute requires setting impact tolerance for services (S3), assessing acceptable disruption limits.

Aligned in intent: BCM Institute provides implementation mechanics to quantify and justify tolerances that BNM expects.

[P2-S4] Conduct Scenario Testing

BNM expects organisations to conduct severe but plausible scenario testing that stresses critical operations, including ICT, third parties, and systemic scenarios.

BCM Institute sets out scenario testing as a formal stage (S4) to validate the ability to manage service delivery within tolerances.

Closely aligned: Both frameworks treat scenario testing as fundamental; BCM Institute gives structured testing steps.

[P2-S5] Improve Lessons Learned & Continuous Improvement

BNM emphasises that resilience must be adaptable and evolving, encouraging learning from disruptions.

BCM Institute has a stage for Improve Lessons Learned (S5) that integrates findings into resilience enhancements.

Aligned: Continuous learning and improvement are core to both, though BCM Institute defines a formal mechanism to embed them.

Third-Party Risk & Outsourcing [P2-S2]

BNM specifically highlights oversight of third parties and concentration risks across the ecosystem.

Third-party dependencies are captured within mapping and testing, but not as a distinct stage.

Partially aligned: BCM Institute covers third parties indirectly; BNM elevates third-party operational risk as a standalone regulatory emphasis.

Governance, Culture & Accountability [P1-S5]

BNM places strong regulatory emphasis on governance, board ownership, and accountability for resilience outcomes.

Governance and accountability are established in the Plan phase (P1), not the Implement phase (P2).

Different focus: BNM’s governance expectations span implementation and oversight, whereas the BCM Institute anchors governance primarily in planning.

Regulatory Reporting & Evidence

BNM implicitly indicates that firms must be able to demonstrate evidence of resilience design, testing, and outcomes.

BCM Institute’s Implement phase is operational, not focused on regulatory reporting per se.

Partial overlap: The Implement outputs can serve as regulatory evidence, but the BCM Institute’s phase does not explicitly address external reporting requirements.

Areas of Convergence

✔ Operational Prioritisation

Both frameworks begin implementation with a grounded understanding of what matters operationally—i.e., the services that must remain resilient.

✔ Dependency Mapping & Impact Assessment

BNM’s call to understand where operations might fail is reflected in BCM Institute’s mapping and impact tolerance setting steps.

✔ Structured Testing

Both frameworks see scenario testing as central not only to plan design but to the validation of resilience capabilities.

Key Differences and Nuances

BNM’s Regulatory Emphasis vs BCM Institute’s Implementation Mechanics
  • BNM’s Discussion Paper is principle-based and regulatory in tone, emphasising outcomes, governance, cross-institution dependencies, and broader systemic considerations.
  • BCM Institute’s Implement phase is procedural, providing a step-by-step operationalisation of resilience —but not a regulatory compliance template per se.
Third-Party Risk Elevated by BNM

BNM explicitly raises third-party and cloud dependencies as core resilience risks. BCM Institute’s methodology includes them in mapping and testing, but does not treat third-party risk as a distinct category.

Governance and Accountability Expectations

BNM expects board and senior management ownership of resilience outcomes (including potentially appointing accountable executives). BCM Institute emphasises governance earlier, but the Implementation phase focuses mainly on technical steps.

Regulatory Evidence & Reporting

BNM’s discussion paper implies that firms will need to provide evidence of resilience actions (e.g., test results, impact-tolerance justifications). BCM Institute’s Implement phase naturally generates evidence but doesn’t explicitly frame it as regulatory evidence.

What This Means for Organisations

When using the BCM Institute’s Implement Phase as an implementation playbook.  The organisation:

  • Aligned methodologically with many of BNM’s emerging expectations (identification, mapping, tolerances, scenario testing, and lessons learned).
  • Identifying governance and third-party dependency requirements from BNM may require additional emphasis beyond the BCM Institute’s procedural steps.
  • Ensure that outputs (e.g., documented tests, impact tolerance justifications, dependency maps) are structured for regulatory reporting and evidence beyond internal documentation.
  • Strengthen board oversight and accountability mechanisms during the implementation, not only in planning.

New call-to-action

 

Aspect

BNM OR Discussion Paper

BCM Institute Implement Phase

Strategic Focus

High-level principles, governance, ecosystem risk

Actionable steps to implement resilience

Critical Business Services

Regulatory focus on continuity

Methodology to identify & document

Dependency Mapping

Mandatory visibility

Structured mapping activity

Impact Tolerance

Customer & systemic impact focused

Defined via the implementation process

Scenario Testing

Severe and systemic scenarios

Formal testing stage

Governance & Accountability

Explicit regulatory expectations

Embedded earlier in planning

Evidence & Reporting

Implied as a regulatory need

Not explicitly measured
 
Note from Author/Speaker

Goh Moh Heng Speaker CVEmail to Dr Goh Moh HengAuthor Comment: This is a detailed comparison between Bank Negara Malaysia’s (BNM) Discussion Paper on Operational Resilience and the "Implement" Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology (which defines the core tactical execution steps of operational resilience).

This comparison highlights where BNM’s regulatory expectations align, exceed, or differ from the BCM Institute’s structured implementation guidance.

 

Comparison with BNM OR Paper with BCM Institute's Operational Resilience Planning Methodology
C1 C2 C3 C4 C5
[OR] [BNM] [C1] Executive Summary of the BNM Discussion Paper [OR] [BNM] [C2] Comparison with BNM OR Paper [Plan Phase] [OR] [BNM] [C3] Comparison with BNM OR Paper [Implement Phase] [OR] [BNM] [C4] Comparison with BNM OR Paper [Sustain Phase] [OR] [BNM] [C5] OR Planning BCMI 3-Phase Method [BNM-Aligned]

New call-to-actionNew call-to-actionGain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

 

More Information About Operational Resilience Course OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer [OR-3] course and the  OR-5000 Operational Resilience Expert Implementer [OR-5] course.

BL-OR-3 Register Now BL-OR-3_Tell Me More BL-OR-3_View Schedule
BL-OR-5_Register Now BL-OR-5_Tell Me More [BL-OR] [3-4-5] View Schedule
[BL-OR] [3] FAQ OR-300

If you have any questions, click to contact us.Email to Sales Team [BCM Institute]

 FAQ BL-OR-5 OR-5000
OR Implementer Landing Page

New call-to-action

 New call-to-action

Comments

 
CTA Banner_OR
CTA Banner_ORA
CTA Banner_BCM
CTA Banner_ITDR
CTA Banner_CM
BCMIWhiteLogoSmall.png
All rights reserved. Copyright 2026