---
title: [OR] [C3] Designing the Governance Architecture
description: [OR] [C3] Designing the Governance Architecture
---

[eBook OR](https://blog.bcm-institute.org/ebook-or)

# [\[OR\] \[C3\] Designing the Governance Architecture](https://blog.bcm-institute.org/ebook-or/or-c3-designing-the-governance-architecture)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) | Mar 9, 2026 4:54:05 AM

### Chapter 3

   

### Designing the Governance Architecture

#### **Governance as the Backbone of Operational Resilience**

Operational resilience succeeds or fails at the governance level.  

While service mapping, scenario testing, and remediation activities occur at the operational layer, accountability rests with senior management and the Board.

Regulatory expectations influenced by the Bank for International Settlements make clear that resilience of critical services is not merely a technical issue—it is a governance responsibility.

Designing the governance architecture ensures that:

- Oversight is structured
- Decision rights are clear
- Escalation pathways are defined
- Reporting is consistent
- Accountability is traceable

Without a deliberate governance design, operational resilience risks becoming fragmented, reactive, and compliance-driven.

 

#### **Principles of Effective Governance Architecture**

Before determining committees and reporting lines, institutions should anchor governance design on five principles:

##### **Clarity of Accountability**

Each level must understand its decision authority and responsibility.

##### **Separation of Oversight and Execution**

Those executing resilience activities should not be the sole evaluators of effectiveness.

##### **Proportionality**

The structure must reflect the size, complexity, and systemic importance of the institution.

##### **Integration**

Operational resilience should align with existing risk and operational governance frameworks.

##### **Escalation Discipline**

Material vulnerabilities and breaches of impact tolerances must flow upward without delay.

 

#### **The Three-Tier Governance Model**

Most financial institutions benefit from a three-tier governance architecture:

##### **Tier 1: Board and Senior Executive Oversight**

**Typical Bodies:**

- Board Risk Committee
- Board Audit Committee (where relevant)
- Executive Committee

**Responsibilities:**

- Approve Critical Business Services (CBS)
- Approve impact tolerances
- Review severe scenario test outcomes
- Oversee remediation of material vulnerabilities
- Accept accountability for systemic disruption risk

At this level, the focus is strategic oversight rather than operational detail.

 

##### **Tier 2: Operational Resilience Committee**

This is the core governance engine.

**Typical Chair:**

- Chief Risk Officer (CRO)  
  or
- Chief Operating Officer (COO)

**Members typically include:**

- Head of Risk
- Head of Operations
- CIO / CTO
- Chief Information Security Officer
- Head of BCM
- Compliance Representative
- Business Line Heads

**Responsibilities:**

- Endorse CBS identification before Board approval
- Recommend impact tolerances
- Review service mapping completeness
- Evaluate scenario testing results
- Track remediation progress
- Escalate material risks to Tier 1

This committee bridges strategy and execution.

 

##### **Tier 3: Operational Resilience Working Group**

This is the execution layer.

**Members include:**

- Operational Resilience Lead
- Service Mapping Specialists
- Scenario Testing Lead
- Data and Reporting Analysts
- Technology Representatives
- Third-Party Risk Specialists

**Responsibilities:**

- Conduct service mapping workshops
- Perform dependency analysis
- Design severe but plausible scenarios
- Conduct resilience testing
- Consolidate resilience metrics
- Prepare reporting packs

This layer executes the framework approved by Tier 2.

 

#### **Designing Clear Reporting Flows**

Governance architecture must include structured reporting flows:

1. Working Group → OR Committee
2. OR Committee → Board Risk Committee

Reports should include:

- Service-level dashboards
- Trend analysis
- Risk heat maps
- Remediation tracking
- Escalation triggers

Consistency in reporting builds institutional discipline.

 

#### **Defining Escalation Triggers**

Escalation must not rely on subjective judgment alone.

Predefined triggers may include:

- Breach of impact tolerance
- Failure of the critical third-party
- Severe system outage affecting CBS
- Repeated failed scenario testing
- Significant regulatory finding

Documented escalation pathways ensure rapid and accountable decision-making during stress events.

 

#### **Integrating with the Three Lines Model**

Operational resilience governance should align with the three lines structure:

**First Line**

Business and technology owners responsible for delivering services within tolerance.

**Second Line**

Operational Resilience function overseeing framework, monitoring compliance, and challenging assumptions.

**Third Line**

Internal Audit providing independent assurance on the effectiveness of the OR framework.

Clear delineation prevents overlap and strengthens credibility with regulators.

 

#### **Avoiding Governance Duplication**

One common mistake is creating excessive committees.

To avoid governance fatigue:

- Embed OR agenda items into existing Risk Committees where feasible
- Use joint sessions with Technology and Risk Committees
- Align OR reporting cycles with enterprise risk reporting

Operational resilience should integrate, not inflate bureaucracy.

 

#### **Documentation Requirements**

A robust governance architecture must be supported by formal documentation:

- Operational Resilience Policy
- OR Charter
- Committee Terms of Reference
- Reporting Templates
- Escalation Matrix
- Annual OR Plan

Documentation clarifies expectations and ensures continuity even when leadership changes.

 

#### **Governance During Disruption**

The governance architecture must function not only in a steady state but also during a crisis.

During disruption:

- Crisis Management Team activates
- Operational Resilience Committee receives updates
- The board is briefed according to the defined thresholds
- Post-incident reviews feed into resilience improvement

Governance architecture must integrate seamlessly with crisis management structures.

 

#### **Common Design Pitfalls**

Financial institutions frequently encounter:

**Ambiguous Ownership**

Multiple executives believe OR belongs elsewhere.

**Over-Centralisation**

OR team attempts to control operational execution rather than govern.

**Weak Escalation Discipline**

Impact tolerance breaches not reported promptly.

**Passive Board Engagement**

Board receives reports but does not challenge or question assumptions.

**Lack of Metrics**

Governance meetings without measurable resilience indicators.

Avoiding these pitfalls strengthens institutional maturity.

 

#### **Characteristics of a Mature Governance Architecture**

A mature governance design demonstrates:

- Clear CBS ownership
- Quantified impact tolerances
- Regular severe scenario testing
- Transparent vulnerability reporting
- Board-level engagement
- Evidence of continuous improvement

It shifts operational resilience from theoretical compliance to embedded strategic oversight.

 

   

Designing the governance architecture is not about creating hierarchy—it is about establishing accountability, authority, and oversight mechanisms that protect critical business services.

A well-structured governance framework:

- Enables informed decision-making
- Clarifies roles across risk, operations, and technology
- Supports rapid escalation during crisis
- Demonstrates regulatory alignment
- Embeds resilience into enterprise strategy

Operational resilience without governance is fragmented execution.

Operational resilience with structured governance becomes an institutional capability.

 

**Key Insight:**

Governance architecture is the structural backbone that ensures operational resilience is not dependent on individual effort, but sustained through institutional accountability and disciplined oversight.

 

| ###### Building Operational Resilience in Financial Institutions: A Practical Guide to Governance, Team Structure and Sustainable Implementation |  |  |  |
| --- | --- | --- | --- |
| **C1** | **C2** | **C3** | **C4** |
|  |  |  |  |
|  |  |  |  |

 

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

#### More Information About Operational Resilience Course OR-5000 \[OR-5\] or OR-300 \[OR-3\]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer \[OR-3\] course and the  OR-5000 Operational Resilience Expert Implementer \[OR-5\] course.

|  |  |  |
| --- | --- | --- |
|  |  |  |
|  | If you have any questions, click to contact us. |  |
|  |  |  |

[View full post](https://blog.bcm-institute.org/ebook-or/or-c3-designing-the-governance-architecture)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2026-03-11T06:37:41.865Z",
  "datePublished" : "2026-03-09T04:54:05Z",
  "headline" : "[OR] [C3] Designing the Governance Architecture",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/Composition%20of%20the%20OR%20Team%20Graphic%20Folder/Composition%20of%20the%20Operational%20Resilience%20Team%20Morepost/%5BOR%5D%20%5BC3%5D%20Designing%20the%20Governance%20Architecture.jpg",
    "width" : 400
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/ebook-or/or-c3-designing-the-governance-architecture",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "eBook OR"
  }
}
```