[OR] [EWB] [E2] [P1 to P3] [C1] OR Planning Methodology

Operational Resilience Planning Methodology for EastWest Banking Corporation

Introduction

In today’s increasingly complex and interconnected financial ecosystem, operational resilience has become a strategic imperative for banks.

For EastWest Banking Corporation, ensuring the continuity of critical business services amid disruptions—whether from cyber threats, system failures, third-party dependencies, or external crises—is essential to maintaining customer trust, regulatory compliance, and financial stability.

This chapter introduces the structured Operational Resilience Planning Methodology adopted by EastWest Banking Corporation.

The methodology is designed to guide the organisation through a comprehensive journey—from understanding its current resilience posture to embedding resilience into its culture and operations.

It is organised into three integrated phases: Plan, Implement, and Sustain, each comprising five clearly defined stages.

Together, these phases provide a practical, systematic approach to building, testing, and continuously enhancing operational resilience in alignment with regulatory expectations, such as BSP Circular No. 1203, Series of 2024.

Purpose of the Chapter

The purpose of this chapter is to provide readers with a clear and structured overview of the three phases of the Operational Resilience Planning Methodology implemented by EastWest Banking Corporation. It aims to:

• Establish a foundational understanding of how operational resilience is approached in a structured, phased manner
• Explain the objectives and expected outcomes of each phase and its corresponding stages
• Prepare stakeholders, business units, and resilience practitioners for the detailed execution covered in subsequent chapters
• Align readers with regulatory expectations and industry best practices for operational resilience

By the end of this chapter, readers will have a holistic view of the methodology, enabling them to understand how each phase contributes to strengthening the bank’s ability to prevent, respond to, and recover from disruptions.

Overview of the Three Phases of the OR Planning Methodology

The Operational Resilience Planning Methodology for EastWest Banking Corporation is structured into three key phases:

• Phase 1: Plan – Establishing the foundation and strategic direction
• Phase 2: Implement – Executing resilience measures and validating capabilities
• Phase 3: Sustain – Embedding resilience into organisational culture and continuous improvement

Each phase is interdependent, forming a continuous lifecycle of resilience enhancement.

Phase 1: Plan

The Plan phase focuses on understanding the organisation's current state, identifying gaps, and defining a clear roadmap for operational resilience.

Stages in Phase 1: Plan

• Assess Capability and Maturity [Stage 1]
  Evaluate the current level of operational resilience across business units, including existing policies, processes, and capabilities.

• Analyse Gap [Stage 2]
  Identify gaps between the current state and regulatory or best practice requirements, including those outlined in BSP Circular 1203.

• Develop Strategy and Roadmap [Stage 3]
  Define a structured implementation plan that includes timelines, priorities, and resource allocation.

• Confirm Risk Appetite [Stage 4]
  Establish the organisation’s tolerance for disruption, ensuring alignment with business objectives and regulatory expectations.
• Develop and Embed Governance [Stage 5]
  Set up governance structures, roles, and accountability frameworks to support operational resilience initiatives.

Outcome of Phase 1

A clearly defined operational resilience strategy, supported by governance and aligned with regulatory requirements.

Phase 2: Implement

The Implement phase translates strategy into action by identifying critical services, mapping dependencies, and testing the organisation’s ability to withstand disruptions.

Stages in Phase 2: Implement

• Identify Critical Business Services [Stage 1]
  Determine which services are essential to customers and the financial system, and whose disruption would have a significant impact.

• Map Processes and Resources [Stage 2]
  Identify and document the people, processes, technology, and third-party dependencies supporting each critical business service.

• Set Impact Tolerance [Stage 3]
  Define acceptable levels of disruption (e.g., maximum tolerable downtime) for each critical service.

• Conduct Scenario Testing [Stage 4]
  Test the organisation’s resilience against severe but plausible scenarios, including cyber incidents, system outages, and third-party failures.
• Improve Lesson Learned [Stage 5]
  Capture insights from testing and incidents to strengthen resilience capabilities and address identified weaknesses.

Outcome of Phase 2

Validated resilience capabilities with clearly defined impact tolerances and tested response strategies.

Phase 3: Sustain

The Sustain phase ensures that operational resilience is continuously improved and embedded into the organisation’s culture and day-to-day operations.

Stages in Phase 3: Sustain

• Introduce Cultural Change [Stage 1]
  Promote a resilience-focused mindset across the organisation, ensuring that all employees understand their roles in maintaining resilience.

• Develop Communication Strategy [Stage 2]
  Establish clear communication protocols for internal and external stakeholders during disruptions.

• Implement Training and Awareness [Stage 3]
  Conduct regular training programs and awareness campaigns to reinforce resilience practices.

• Provide Self-assessment [Stage 4]
  Enable business units to periodically assess their own resilience capabilities and identify areas for improvement.
• Conduct Independent Quality Review [Stage 5]
  Perform independent audits and reviews to validate the effectiveness of the operational resilience framework.

Outcome of Phase 3

A resilient organisation with embedded practices, continuous monitoring, and ongoing improvement mechanisms.

The three-phase Operational Resilience Planning Methodology—Plan, Implement, and Sustain—provides EastWest Banking Corporation with a comprehensive and structured approach to achieving resilience.

By progressing through these phases, the bank not only meets regulatory expectations, including BSP Circular No. 1203, Series of 2024, but also strengthens its ability to deliver critical services consistently under adverse conditions.

This methodology is not a one-time exercise but a continuous cycle of improvement.

As the threat landscape evolves, so too must the organisation’s resilience capabilities—ensuring that EastWest Banking Corporation remains robust, adaptive, and prepared for future uncertainties.

Blogs marked [x] are under construction

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.