[OR] [CCB] [E3] [C1] Starting Your OR Implementation

eBook 3: Chapter 1

Starting Your Operational Resilience Implementation

Introduction

The journey toward operational resilience moves from understanding and design into disciplined execution.

In eBook 1: “Understanding Your Organisation,”   readers examined China Construction Bank (Malaysia)’s (CCB Malaysia) structure, operating environment, regulatory obligations, and strategic priorities.

In eBook 2: “Implementing Operational Resilience,” the structured three-phase Operational Resilience (OR) Planning Methodology—Plan, Implement, Sustain—was introduced, aligned with Bank Negara Malaysia (BNM) expectations and international best practices.

This eBook 3, “Starting Your OR Implementation,” transitions from framework to application. It drills down into the practical and documentary requirements of Phase 2 (Implement) of the OR Planning Methodology.

While earlier books established what operational resilience is and why it is necessary, this book focuses on how to begin the actual operational resilience exercise—through structured submissions, documented mappings, defined tolerances, and tested scenarios.

This eBook reflects a compilation of structured submissions prepared during an operational resilience exercise. It demonstrates how CCB Malaysia—or any similarly regulated financial institution—translates regulatory expectations into operational documentation and actionable outputs.

This third eBook in the series, “Starting Your OR Implementation,” represents the transition from understanding and design to execution and evidence. While:

• eBook 1 – Understanding Your Organisation established organisational context, regulatory drivers, stakeholder expectations, and critical business services; and
• eBook 2 – Implementing Operational Resilience for Agrobank translated OR principles into governance structures, policy direction, and high-level framework design;

eBook 3 drills down into the practical, documentable, and auditable requirements of Phase 2 of the Operational Resilience Planning Methodology.

The five core stages of the “Implement” phase in the Operational Resilience Planning Methodology are central to this ebook.

These stages form the backbone of OR implementation:

• Identify Critical Business Services [DP]
  Determining the business services that, if disrupted, could pose a significant risk to Metrobank’s customers, market integrity, or financial stability.
  
  
• Map Dependency and Connectivity [MD]
  Uncovering and documenting the relationships and interdependencies—both internal and external—that support the delivery of critical business services.
  
  
• Map Processes and Resources [MPR]
  Cataloguing the key operational elements—people, systems, data, and facilities—that underpin each critical business service's performance and continuity.
  
  
• Establish Impact Tolerances [ITo]
  Setting defined thresholds for disruption to determine how much stress a service can endure before unacceptable harm occurs.
  
  
• Identify Severe but Plausible Scenarios [SuPS]
  Identifying Severe but Plausible Scenarios that could critically impact each detailed process within the Critical Business Service
  
  
• Perform Scenario Testing [ST]
  Validating assumptions and capabilities by simulating disruptive scenarios to evaluate how well the bank can maintain or recover its critical business services.
  

This eBook applies the methodology to CCB Malaysia’s identified Critical Business Services:

• CBS-1: Core Deposit & Account Services
• CBS-2: Payments & Funds Transfer Services
• CBS-3: Trade Finance Services
• CBS-4: Corporate Lending & Credit Facilities
• CBS-5: Treasury & Foreign Exchange Services
• CBS-6: Digital & Online Banking Channels
• CBS-7: Regulatory & Financial Reporting Services

Each CBS requires structured documentation across the six Phase 2 requirements.

This eBook is delivered as part of the value-adding and complementary services offered to organisations that intend to:

• Implement an actual operational resilience or BCM project, or
• Upgrade an existing BCM programme to meet evolving regulatory and supervisory expectations.

It supports organisations participating in the BCM Institute’s training-led implementation approach, particularly those attending:

• Certification programmes, and
• Competency-based professional training courses.

Rather than treating training and implementation as separate activities, this approach integrates learning, application, and evidence creation, allowing organisations to build real operational resilience artefacts while developing internal capability and practitioner competence.

By the end of this eBook, readers should be able to:

• Translate high-level Critical Business Services into detailed, defensible process maps
• Identify and document material dependencies and resource concentrations
• Set impact tolerances that are realistic, measurable, and regulator-ready
• Design and execute scenario testing that focuses on service continuity rather than system recovery
• Produce structured outputs suitable for internal governance, regulatory review, and audit scrutiny

This eBook is not intended to be read passively. It is designed to be used as a working reference during an operational resilience exercise, supporting teams as they move from planning to execution in a controlled, methodical, and regulator-aligned manner.

 Blogs marked [x] are under construction. 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.