---
title: [OR] [BNM] [C3] Comparison Between BNM OR Paper with “Implement” Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology
description: [OR] [BNM] [C3] Comparison Between BNM OR Paper with “Implement” Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology
---

[eBook OR](https://blog.bcm-institute.org/ebook-or)

# [\[OR\] \[BNM\] \[C3\] Comparison Between BNM OR Paper with “Implement” Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology](https://blog.bcm-institute.org/ebook-or/or-bnm-c3-comparison-between-bnm-or-paper-with-implement-phase-p2-of-the-bcm-institutes-operational-resilience-planning-methodology)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) | Jan 15, 2026 6:16:43 AM

### Chapter 3

### Comparison with the Implement Phase \[P2\] of the OR Planning Methodology

#### **Context: BNM Operational Resilience Discussion Paper (Emerging Regulatory Expectations)**

Bank Negara Malaysia’s **Discussion Paper on Operational Resilience** articulates **high-level expectations for financial institutions** to develop resilience capabilities in a rapidly evolving operational risk landscape. Key principles include:

- Ensuring **continuity of critical financial services** during severe disruptions.
- Managing **digitalisation pressures** and interconnected operations with third parties.
- Strengthening governance, incident response, resilience testing, and **third-party risk management**.
- Emphasising the ability to **respond, recover, adapt, and learn** from disruptions.

The chapter is consultative in nature but signals significant regulatory direction on operational resilience outcomes.

#### **Overview: BCM Institute’s Implement Phase (OR-P2)**

The **Implement Phase** of the BCM Institute’s Operational Resilience Planning Methodology translates strategy into **actionable steps** that build the resilience program.

It typically follows completion of the **Plan Phase (P1)** and consists of **five key stages**:

| Stage | Key Activity |
| --- | --- |
| S1 | Identify Critical Business Services |
| S2 | Map Processes and Resources (dependencies) |
| S3 | Set Impact Tolerance |
| S4 | Conduct Scenario Testing |
| S5 | Improve — Lesson Learned Incorporation |

This phase involves transforming high-level strategy into a detailed resilience architecture and operational** model**.

#### **Detailed Comparison: Implement Phase vs. BNM Expectations**

| Component | BNM Discussion Paper Expectations | BCM Institute Implement Phase Guidance | Analysis & Alignment |
| --- | --- | --- | --- |
| \[P2-S1\] Identify Critical Business Services | BNM emphasises maintaining the continuity of critical financial services, requiring firms to identify which services are most vital and why. | BCM Institute explicitly requires the identification of critical business services (S1) to prioritise resilience efforts. | Aligned: Both require articulation of critical services; BCM Institute adds a structured methodology to define and document them. |
| \[P2-S2\] Map Processes and Resources (Map Dependencies) | BNM emphasises the need to understand internal and external dependencies, including third-party providers and digital infrastructure. | BCM Institute requires mapping processes and resources (people, technology, facilities, and information) for services (S2). | Highly aligned: BNM’s call for deep dependency visibility is structurally captured within mapping activities. |
| \[P2-S3\] Set Impact Tolerance | BNM’s paper emphasises tolerances based on customer and systemic harm, going beyond traditional RTOs. | BCM Institute requires setting impact tolerance for services (S3), assessing acceptable disruption limits. | Aligned in intent: BCM Institute provides implementation mechanics to quantify and justify tolerances that BNM expects. |
| \[P2-S4\] Conduct Scenario Testing | BNM expects organisations to conduct severe but plausible scenario testing that stresses critical operations, including ICT, third parties, and systemic scenarios. | BCM Institute sets out scenario testing as a formal stage (S4) to validate the ability to manage service delivery within tolerances. | Closely aligned: Both frameworks treat scenario testing as fundamental; BCM Institute gives structured testing steps. |
| \[P2-S5\] Improve Lessons Learned & Continuous Improvement | BNM emphasises that resilience must be adaptable and evolving, encouraging learning from disruptions. | BCM Institute has a stage for Improve Lessons Learned (S5) that integrates findings into resilience enhancements. | Aligned: Continuous learning and improvement are core to both, though BCM Institute defines a formal mechanism to embed them. |
| Third-Party Risk & Outsourcing \[P2-S2\] | BNM specifically highlights oversight of third parties and concentration risks across the ecosystem. | Third-party dependencies are captured within mapping and testing, but not as a distinct stage. | Partially aligned: BCM Institute covers third parties indirectly; BNM elevates third-party operational risk as a standalone regulatory emphasis. |
| Governance, Culture & Accountability \[P1-S5\] | BNM places strong regulatory emphasis on governance, board ownership, and accountability for resilience outcomes. | Governance and accountability are established in the Plan phase (P1), not the Implement phase (P2). | Different focus: BNM’s governance expectations span implementation and oversight, whereas the BCM Institute anchors governance primarily in planning. |
| Regulatory Reporting & Evidence | BNM implicitly indicates that firms must be able to demonstrate evidence of resilience design, testing, and outcomes. | BCM Institute’s Implement phase is operational, not focused on regulatory reporting per se. | Partial overlap: The Implement outputs can serve as regulatory evidence, but the BCM Institute’s phase does not explicitly address external reporting requirements. |

#### **Areas of Convergence**

##### **✔ Operational Prioritisation**

Both frameworks begin implementation with a grounded understanding of what matters operationally—i.e., the services that must remain resilient.

##### **✔ Dependency Mapping & Impact Assessment**

BNM’s call to understand where operations might fail is reflected in BCM Institute’s mapping and impact tolerance setting steps.

##### **✔ Structured Testing**

Both frameworks see **scenario testing** as central not only to plan design but to the validation of resilience capabilities.

#### **Key Differences and Nuances**

##### **BNM’s Regulatory Emphasis vs BCM Institute’s Implementation Mechanics**

- BNM’s Discussion Paper is **principle-based and regulatory in tone**, emphasising outcomes, governance, cross-institution dependencies, and broader systemic considerations.
- BCM Institute’s **Implement phase is procedural**, providing a **step-by-step operationalisation of resilience —**but not a regulatory compliance template per se.

##### **Third-Party Risk Elevated by BNM**

BNM explicitly raises **third-party and cloud dependencies** as core resilience risks. BCM Institute’s methodology includes them in mapping and testing, but does not treat third-party risk as a distinct category.

##### **Governance and Accountability Expectations**

BNM expects **board and senior management ownership** of resilience outcomes (including potentially appointing accountable executives). BCM Institute emphasises governance earlier, but the Implementation phase focuses mainly on technical steps.

##### **Regulatory Evidence & Reporting**

BNM’s discussion paper implies that firms will need to provide evidence of resilience actions (e.g., test results, impact-tolerance justifications). BCM Institute’s Implement phase naturally generates evidence but doesn’t explicitly frame it as **regulatory evidence**.

#### **What This Means for Organisations**

**When using the BCM Institute’s Implement Phase** as an implementation playbook.  The organisation:

- Aligned **methodologically** with many of BNM’s emerging expectations (identification, mapping, tolerances, scenario testing, and lessons learned).
- **Identifying governance and third-party dependency requirements** from BNM may require additional emphasis beyond the BCM Institute’s procedural steps.
- Ensure that outputs (e.g., documented tests, impact tolerance justifications, dependency maps) are **structured for regulatory reporting** and **evidence** beyond internal documentation.
- Strengthen **board oversight and accountability** mechanisms during the implementation, not only in planning.

 

| Aspect | BNM OR Discussion Paper | BCM Institute Implement Phase |
| --- | --- | --- |
| Strategic Focus | High-level principles, governance, ecosystem risk | Actionable steps to implement resilience |
| Critical Business Services | Regulatory focus on continuity | Methodology to identify & document |
| Dependency Mapping | Mandatory visibility | Structured mapping activity |
| Impact Tolerance | Customer & systemic impact focused | Defined via the implementation process |
| Scenario Testing | Severe and systemic scenarios | Formal testing stage |
| Governance & Accountability | Explicit regulatory expectations | Embedded earlier in planning |
| Evidence & Reporting | Implied as a regulatory need | Not explicitly measured |

 

##### Note from Author/Speaker

Author Comment: This is a detailed comparison between Bank Negara Malaysia’s (BNM) Discussion Paper on Operational Resilience and the "Implement" Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology (which defines the core tactical execution steps of operational resilience).

This comparison highlights where BNM’s regulatory expectations align, exceed, or differ from the BCM Institute’s structured implementation guidance.

 

| ###### Comparison with BNM OR Paper with BCM Institute's Operational Resilience Planning Methodology |  |  |  |  |
| --- | --- | --- | --- | --- |
| **C1** | **C2** | **C3** | **C4** | **C5** |
|  |  |  |  |  |

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

#### More Information About Operational Resilience Course OR-5000 \[OR-5\] or OR-300 \[OR-3\]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer \[OR-3\] course and the  OR-5000 Operational Resilience Expert Implementer \[OR-5\] course.

|  |  |  |
| --- | --- | --- |
|  |  |  |
|  | If you have any questions, click to contact us. |  |
|  |  |  |

[View full post](https://blog.bcm-institute.org/ebook-or/or-bnm-c3-comparison-between-bnm-or-paper-with-implement-phase-p2-of-the-bcm-institutes-operational-resilience-planning-methodology)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2026-02-22T15:11:26.150Z",
  "datePublished" : "2026-01-15T06:16:43Z",
  "headline" : "[OR] [BNM] [C3] Comparison Between BNM OR Paper with “Implement” Phase (P2) of the BCM Institute’s Operational Resilience Planning Methodology",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/OR%20BNM%20Morepost/%5BOR%5D%20%5BBNM%5D%20%5BC3%5D%20Comparison%20with%20BNM%20OR%20Paper%20%5BImplement%20Phase%5D.jpg",
    "width" : 400
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/ebook-or/or-bnm-c3-comparison-between-bnm-or-paper-with-implement-phase-p2-of-the-bcm-institutes-operational-resilience-planning-methodology",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "eBook OR"
  }
}
```