[OR] [BPI] [E2] [P1 to P3] [C1] OR Planning Methodology

Introduction to the Operational Resilience Planning Methodology for the Bank of Commerce

Introduction

In today’s increasingly volatile financial environment, operational resilience has become a strategic imperative for banks operating within complex ecosystems of digital services, third-party dependencies, and regulatory expectations.

For The Bank of the Philippine Islands (BPI), one of the Philippines’ oldest and most established financial institutions, the ability to anticipate, withstand, respond to, and recover from disruptions is critical to maintaining trust, ensuring financial stability, and meeting regulatory requirements, including BSP Circular No. 1203.

To achieve this, BPI adopts a structured Operational Resilience Planning Methodology consisting of three interrelated phases—Plan, Implement, and Sustain.

These phases provide a comprehensive lifecycle approach that ensures resilience is not treated as a one-time project, but as an ongoing organisational capability embedded across business functions, technology, and governance structures.

The Plan phase focuses on understanding the bank’s current resilience posture and defining a strategic direction.

The Implement phase translates strategy into actionable execution by identifying critical business services, mapping dependencies, and validating resilience through testing.

The Sustain phase ensures that resilience becomes part of the organisational culture through continuous improvement, training, and independent assurance.

Together, these three phases form a robust framework that aligns BPI’s operational resilience efforts with global best practices and local regulatory expectations, ensuring the bank can continue to deliver critical services even under severe but plausible disruption scenarios.

Purpose of the Chapter

The purpose of this chapter is to provide readers with a clear and structured understanding of how The Bank of the Philippine Islands approaches operational resilience through its three-phase planning methodology.

It is designed to pre-empt the reader by outlining the rationale behind each phase and illustrating how the individual stages collectively contribute to building a resilient organisation.

By the end of this chapter, the reader is expected to gain a comprehensive overview of the Plan, Implement, and Sustain phases, understand the objectives and expected outputs of each stage, and appreciate how this methodology supports compliance with regulatory expectations such as BSP Circular No. 1203 while strengthening the bank’s ability to deliver critical business services during disruptions.

Overview of the Three Phases of Operational Resilience Planning Methodology

 The Operational Resilience Planning Methodology is structured into three key phases: 

Phase 1: Plan – Establishing the Foundations

The Plan phase lays the groundwork for operational resilience by assessing the current state, identifying gaps, and defining the strategic direction.

It ensures that BPI has a clear understanding of its risk landscape, resilience priorities, and governance requirements.

Stages in Phase 1: Plan

• Assess Capability and Maturity [Plan Phase - Stage 1]
  Evaluate the current state of business continuity, disaster recovery, risk management, and operational resilience capabilities across BPI.

• Analyse Gap [Plan Phase - Stage 2]
  Identify gaps between current capabilities and regulatory expectations (e.g., BSP Circular No. 1203) and between current capabilities and international best practices.

• Develop Strategy and Roadmap [Plan Phase - Stage 3]
  Define a multi-year roadmap outlining initiatives, priorities, timelines, and resource requirements to enhance resilience.

• Confirm Risk Appetite [Plan Phase - Stage 4]
  Establish the level of disruption BPI is willing to tolerate, aligned with board-approved risk appetite and customer expectations.

• Develop and Embed Governance [Plan Phase - Stage 5]
  Create governance structures, roles, and responsibilities to oversee resilience initiatives and ensure accountability.

Phase 2: Implement – Translating Strategy into Action

 The Implement phase operationalises the strategy by identifying critical services, mapping dependencies, and validating resilience capabilities through testing and continuous improvement. 

Stages in Phase 2: Implement

• Identify Critical Business Services [Implement Phase - Stage 1]
  Determine which services are essential to customers and the financial system, and whose disruption would have a significant impact.

• Map Processes and Resources [Implement Phase - Stage 2]
  Document end-to-end processes and identify dependencies across people, technology, facilities, and third parties.

• Set Impact Tolerance [Implement Phase - Stage 3]
  Define acceptable thresholds for disruption (e.g., maximum tolerable downtime, data loss, and customer impact).

• Conduct Scenario Testing [Implement Phase - Stage 4]
  Test resilience capabilities against severe but plausible scenarios such as cyberattacks, system failures, or facility disruptions.

• Improve Lesson Learned [Implement Phase - Stage 5]
  Analyse test results, identify weaknesses, and implement corrective actions to strengthen resilience.

Phase 3: Sustain – Embedding and Continuously Improving Resilience

The Sustain Phase ensures that operational resilience becomes embedded within the organisation’s culture, continuously monitored, and improved over time.

Stages in Phase 3: Sustain

• The Sustain phase ensures that operational resilience is continuously maintained, improved, and embedded in BPI's organisational culture.

  • Introduce Cultural Change [Sustain Phase - Stage 1]
    Promote a resilience-first mindset across all levels of the organisation, from senior management to operational staff.
  • Develop Communication Strategy [Sustain Phase - Stage 2]
    Establish clear communication plans for stakeholders, including customers, regulators, and internal teams, during disruptions.
  • Implement Training and Awareness [Sustain Phase - Stage 3]
    Conduct regular training, simulations, and awareness programs to build staff readiness and capability.
  • Provide Self-assessment [Sustain Phase - Stage 4]
    Enable business units to regularly assess their resilience posture and compliance with internal standards and regulatory requirements.
  • Conduct Independent Quality Review [Sustain Phase - Stage 5]
    Perform independent audits and reviews to validate the effectiveness of the resilience framework and identify areas for improvement.
   

The three-phase Operational Resilience Planning Methodology adopted by The Bank of the Philippine Islands provides a structured and holistic approach to building, implementing, and sustaining resilience across the organisation.

By progressing from planning and strategy to execution and validation, and finally to continuous improvement and cultural embedding, BPI ensures that operational resilience is not only compliant with BSP Circular No. 1203 but is also deeply integrated into its day-to-day operations.

This methodology ultimately enables BPI to safeguard its critical business services, protect its customers, and maintain confidence in the financial system—even in the face of increasingly complex and evolving disruption scenarios.

Blogs marked [x] are under construction.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.