[OR] [DBP] [E2] [P1 to P3] [C1] OR Planning Methodology

Operational Resilience Planning Methodology for Development Bank of the Philippines

Introduction

Operational resilience has become a strategic imperative for financial institutions operating in increasingly complex, interconnected, and risk-prone environments.

For the Development Bank of the Philippines (DBP), as a government-owned financial institution with a mandate to support national development, ensuring continuity of critical services is not only a business necessity but also a public responsibility.

Disruptions—whether arising from cyber threats, system failures, third-party dependencies, or natural disasters—can significantly impact economic stability, public trust, and regulatory compliance.

As such, DBP must adopt a structured and disciplined approach to operational resilience that aligns with regulatory expectations such as the Bangko Sentral ng Pilipinas (BSP) Circular No. 1203 on Operational Resilience.

To address this, DBP adopts a comprehensive three-phase Operational Resilience Planning Methodology comprising Plan, Implement, and Sustain phases.

This methodology provides a structured pathway for the bank to assess its current capabilities, design and execute resilience strategies, and continuously improve its ability to withstand and recover from disruptions.

Each phase is supported by five key stages, ensuring that resilience is embedded not only in systems and processes but also in governance, culture, and day-to-day operations.

Purpose of the Chapter

The purpose of this chapter is to provide readers with a clear and structured overview of the three phases of the Operational Resilience Planning Methodology adopted by the Development Bank of the Philippines.

It serves as a foundational guide that outlines how DBP systematically progresses from understanding its current resilience posture to implementing practical resilience measures and ultimately embedding resilience into its organisational culture and governance framework.

By the end of this chapter, the reader is expected to understand the end-to-end lifecycle of operational resilience implementation, including the objectives and key activities within each phase.

This understanding will enable stakeholders, business units, and project teams to align their efforts with the methodology, ensuring consistency, regulatory compliance, and effective execution of DBP’s operational resilience programme.

Overview of the Three Phases of Operational Resilience

DBP’s Operational Resilience Planning Methodology is structured into three distinct yet interconnected phases:

Phase 1: Plan

This phase focuses on establishing a strong foundation by understanding the bank’s current resilience capabilities and defining a clear strategic direction.

The five stages are:

• Assess Capability and Maturity [Stage 1]
  Evaluate existing business continuity, risk management, IT resilience, and third-party risk capabilities against regulatory and industry benchmarks.
• Analyse Gap  [Stage 2]
  Identify gaps between current capabilities and desired resilience targets, including regulatory requirements such as BSP Circular 1203.
• Develop Strategy and Roadmap  [Stage 3]
  Formulate a structured roadmap outlining key initiatives, priorities, timelines, and resource requirements for operational resilience.
• Confirm Risk Appetite  [Stage 4]
  Define the level of disruption the bank is willing to tolerate, aligned with its strategic objectives and regulatory expectations.
• Develop and Embed Governance [Stage 5]
  Establish governance structures, roles, responsibilities, and policies to oversee and drive the resilience programme.

Phase 2: Implement

This phase translates strategy into action by operationalising resilience across critical business services and their supporting resources.

The five stages are:

• Identify Critical Business Services [Stage 1]
  Determine the most important services whose disruption would have a significant impact on customers, financial stability, or regulatory obligations.
• Map Processes and Resources [Stage 2]
  Document end-to-end processes and identify dependencies across people, technology, facilities, and third parties supporting each critical service.
• Set Impact Tolerance [Stage 3]
  Define acceptable levels of disruption (e.g., maximum tolerable downtime, data loss) for each critical business service.
• Conduct Scenario Testing [Stage 4]
  Test the bank’s ability to remain within impact tolerance under severe but plausible disruption scenarios.
• Improve Lessons Learned [Stage 5]
  Analyse test outcomes and real incidents to identify weaknesses and implement corrective actions for continuous improvement.

Phase 3: Sustain

This phase ensures that operational resilience becomes an integral and continuously evolving capability within the organisation.

The five stages are:

• Introduce Cultural Change [Stage 1]
  Promote a resilience-first mindset across all levels of the organisation, embedding accountability and awareness.
• Develop Communication Strategy [Stage 2]
  Establish clear communication protocols for both normal operations and crises, including internal and external stakeholders.
• Implement Training and Awareness [Stage 3]
  Conduct regular training programmes, simulations, and awareness campaigns to reinforce resilience capabilities.
• Provide Self-assessment [Stage 4]
  Enable business units to periodically assess their own resilience posture and identify areas for improvement.
• Conduct Independent Quality Review [Stage 5]
  Perform independent reviews or audits to validate the operational resilience framework's effectiveness and ensure compliance.

The three-phase Operational Resilience Planning Methodology provides the Development Bank of the Philippines with a structured, end-to-end framework to build, implement, and sustain resilience across its operations.

By progressing systematically from planning to implementation and continuous improvement, DBP can enhance its ability to deliver critical services even under adverse conditions.

More importantly, this methodology ensures that operational resilience is not treated as a one-time initiative but as an ongoing organisational capability, embedded into governance, culture, and strategic decision-making—thereby supporting DBP’s mandate to contribute to national development while maintaining financial system stability.

Blogs marked [x] are under construction

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.