[OR] [GCash] [E1] [C8] Summary

Chapter 8

Summary for Understanding Your Organisation: GCash

The purpose of this concluding chapter is to consolidate the key concepts, observations, and Operational Resilience considerations developed throughout Understanding Your Organisation: GCash.

The preceding chapters established the organisational foundation needed before GCash proceeds into the detailed implementation of Operational Resilience.

They examined GCash as an organisation, its internal and external operating environment, the composition and responsibilities of its Operational Resilience team, its Critical Business Services and Critical Operations, the organisational characteristics that influence its resilience profile, and the goals that should guide its Operational Resilience programme.

Bringing these areas together enables the reader to see how organisational context, governance, criticality, dependencies and resilience objectives form an integrated foundation rather than separate planning activities.

The objective of this chapter is to enable the reader to consolidate what has been learned and understand how these findings should inform the next stage of GCash's Operational Resilience journey.

By the end of the chapter, the reader should be able to explain why understanding the organisation is a prerequisite for effective resilience planning; recognise the relationship between GCash's operating model and its resilience priorities; understand how Critical Operations, supporting resources and dependencies should be governed; and identify how organisational goals provide direction for subsequent implementation.

This summary also provides the transition from understanding GCash to the more detailed activities of identifying Critical Operations, setting Tolerance for Disruption, mapping interconnections and interdependencies, assessing vulnerabilities, developing Severe but Plausible Scenarios, testing resilience and continuously improving the organisation's ability to withstand significant disruption.

Introduction

Operational Resilience begins with a thorough understanding of the organisation.

Before an organisation can determine how it should respond to disruption, it must understand what it is trying to protect.

Before it can establish a Tolerance for Disruption, it must know which operations are critical.

Before it can conduct meaningful scenario testing, it must understand the resources and dependencies supporting those operations. Before it can strengthen resilience, it must understand where vulnerabilities exist.

This principle is especially important for GCash.

GCash operates within a highly digital and interconnected financial ecosystem. The delivery of its services depends upon combinations of:

• customers;
• merchants;
• business processes;
• employees;
• technology platforms;
• applications;
• information and data;
• cybersecurity capabilities;
• telecommunications;
• banks and financial institutions;
• payment infrastructure;
• third-party service providers;
• public infrastructure; and
• regulatory arrangements.

Operational disruption can therefore originate within GCash or outside its organisational boundaries.

• A telecommunications outage may affect customer access.

• A cyber incident may disrupt transaction processing.

• A technology failure may affect the availability of payments.

• A third-party outage may interrupt a supporting service.

• A failure at an interconnected financial institution may prevent customers from completing particular transactions.

• A major natural hazard may simultaneously affect telecommunications, electricity, personnel and suppliers.

These examples demonstrate why Operational Resilience cannot be built around individual systems or Business Continuity Plans alone.

It must consider the end-to-end delivery of the operations that customers and other stakeholders depend on.

The purpose of this eBook has therefore been to establish the organisational understanding needed to begin that journey.

Understanding Your Organisation: GCash

The starting point was to understand GCash as an organisation.

This includes understanding:

• what GCash does;
• the products and services it facilitates;
• who its customers and stakeholders are;
• how its services are delivered;
• its role within the financial ecosystem;
• the resources required to operate;
• its regulatory environment; and
• the potential consequences of disruption.

This organisational understanding provides the context for all subsequent resilience decisions.

Operational Resilience should not begin by asking:

Which systems should we recover first?

It should first ask:

Which outcomes are most important to GCash's customers and stakeholders, and which operations must continue to deliver them?

This shifts the resilience perspective from individual resources to customer and business outcomes.

Understanding GCash's Operating Environment

The next stage examined the environment within which GCash operates.

The operating environment can be considered from two perspectives:

Internal Environment

The internal environment includes:

• governance;
• business operations;
• people;
• technology;
• cybersecurity;
• information and data;
• Operational Risk;
• Business Continuity;
• Crisis Management;
• financial resources;
• facilities; and
• organisational culture.

External Environment

The external environment includes:

• customers;
• merchants;
• banks;
• other financial institutions;
• telecommunications providers;
• technology providers;
• third-party suppliers;
• payment infrastructure;
• regulators;
• public infrastructure;
• cyber threats;
• natural hazards; and
• changing economic and technological conditions.

Understanding both environments enables GCash to recognise that resilience does not stop at its organisational boundary.

The resilience of a GCash operation may depend upon the resilience of several external organisations.

This leads to an important principle:

An organisation must understand the complete ecosystem supporting its Critical Operations if it is to manage Operational Resilience effectively.

Composition of an Operational Resilience Team for GCash

Operational Resilience requires coordinated governance.

It cannot be assigned exclusively to:

• Business Continuity;
• Operational Risk;
• Technology;
• Cybersecurity;
• Compliance; or
• any other individual function.

Each provides important capabilities, but none independently controls the complete end-to-end delivery of a Critical Operation.

The proposed governance structure therefore brings together:

Board / Board-Level Oversight

↓

Executive Management

↓

Operational Resilience Steering Committee

↓

Operational Resilience Programme Leadership

↓

Critical Operation Owners

↓

Cross-Functional Operational Resilience Working Group

The supporting functions may include:

• Business Operations;
• Operational Risk;
• Business Continuity;
• Crisis Management;
• Technology;
• ICT Risk;
• Cybersecurity;
• Third-Party Risk;
• Compliance;
• Legal;
• Finance;
• Customer Operations;
• Human Resources;
• Data Management; and
• Corporate Communications.

Internal Audit provides independent assurance through the third line of defence.

The important principle is that:

Operational Resilience should be governed centrally but implemented collectively.

Critical Business Services and Critical Operations

The eBook also considers the services and operations that may require the greatest level of resilience.

In broader international Operational Resilience frameworks, the term Critical Business Services is frequently used.

In the BSP regulatory context, the term "Critical Operations" should be used when aligning implementation with BSP requirements.

For GCash, potential operations requiring formal criticality assessment may include those associated with:

• digital wallet services;
• payment transaction processing;
• funds transfer;
• wallet funding;
• merchant payments;
• customer account access;
• customer authentication;
• transaction authorisation;
• financial reconciliation; and
• service recovery.

These examples should not automatically be classified as Critical Operations.

GCash should formally assess them using approved criteria.

The assessment should consider whether disruption could materially affect:

• Customers

• GCash's continuing operations or viability

• GCash's role within the financial system

The resulting Critical Operation inventory becomes one of the central foundations of the Operational Resilience programme.

Understanding End-to-End Delivery

A recurring theme throughout this eBook has been the importance of examining services end-to-end.

Consider a simplified GCash payment:

Customer

↓

Mobile Device

↓

Telecommunications

↓

GCash Application

↓

Authentication

↓

Transaction Processing

↓

Data / Ledger

↓

External Financial or Payment Infrastructure

↓

Merchant / Recipient

↓

Reconciliation

↓

Customer Confirmation

The customer experiences this as one service.

Internally, however, its delivery may involve many teams, technologies and external organisations.

Traditional risk management may assess these components individually.

Operational Resilience must also determine whether the entire chain can continue to deliver the required outcome during disruption.

This represents one of the most important conceptual shifts established by this eBook.

Key Characteristics of GCash

The organisational characteristics of GCash help determine its resilience priorities.

Important characteristics identified include:

These characteristics demonstrate why a generic resilience programme would be insufficient.

GCash's Operational Resilience Framework should reflect its actual operating model, customer dependency, technology architecture, financial interconnections and risk environment.

Organisational Goals for Operational Resilience

The organisational analysis was then translated into proposed resilience goals.

The principal goals are to:

1. Maintain Critical Operations through significant disruption.
2. Protect customers from material harm.
3. Establish measurable Tolerance for Disruption.
4. Understand end-to-end interconnections and interdependencies.
5. Strengthen technology resilience.
6. Strengthen cyber resilience.
7. Manage critical third-party resilience.
8. Integrate BCM with Operational Resilience.
9. Strengthen incident and crisis response.
10. Maintain transaction and data integrity.
11. Test against Severe but Plausible Scenarios.
12. Identify and remediate resilience vulnerabilities.
13. Maintain effective governance and accountability.
14. Build an organisational resilience culture.
15. Maintain effective stakeholder communication.
16. Meet applicable regulatory obligations.
17. Monitor emerging threats and organisational change.
18. Continuously improve Operational Resilience.

These goals provide direction for the next stage of implementation.

They also allow Operational Resilience to be measured by outcomes rather than simply by the completion of activities.

Connecting the Chapters

The six major areas covered in this eBook are interconnected.

They can be represented as a progressive sequence:

1. Understand GCash

What does the organisation do and whom does it serve?

↓

2. Examine the Operating Environment

What internal and external conditions influence service delivery?

↓

3. Establish the Operational Resilience Team

Who governs, owns, supports and independently reviews resilience?

↓

4. Identify Critical Business Services / Critical Operations

What must receive the highest resilience priority?

↓

5. Understand Key Organisational Characteristics

What aspects of GCash's operating model shape its resilience requirements?

↓

6. Establish Organisational Goals

What resilience outcomes should GCash achieve?

↓

Operational Resilience Implementation

This sequence provides the logical foundation for moving from organisational understanding to implementation.

From Organisational Understanding to Operational Resilience

The completion of this eBook should not be viewed as the completion of the Operational Resilience programme.

Instead, it represents completion of an important foundation stage.

The knowledge developed should now be converted into more detailed implementation activities.

A practical implementation sequence is:

Understand the Organisation

↓

Confirm Critical Operations

↓

Map Processes and Resources

↓

Map Interconnections and Interdependencies

↓

Establish Tolerance for Disruption

↓

Identify Severe but Plausible Scenarios

↓

Assess Existing Resilience Capabilities

↓

Conduct Scenario Testing

↓

Identify Vulnerabilities

↓

Develop Resilience Strategies

↓

Implement Remediation

↓

Strengthen Response and Recovery

↓

Retest

↓

Review and Improve

This transforms organisational knowledge into demonstrable resilience capability.

The Role of Business Continuity Management

Business Continuity Management remains a core component of this approach.

BCM provides established capabilities for:

• Business Impact Analysis;
• risk assessment;
• continuity strategies;
• Business Continuity Plans;
• recovery procedures;
• alternate arrangements;
• crisis management;
• training;
• testing; and
• continuous improvement.

Operational Resilience builds upon these capabilities but applies them to the end-to-end delivery of Critical Operations.

The relationship can therefore be represented as:

Operational Resilience

supported by:

BCM + Operational Risk + ICT Resilience + Cybersecurity + Third-Party Risk + Crisis Management

This integration is important.

Separate programmes may individually work well but still leave vulnerabilities where dependencies cross organisational boundaries.

The Role of Technology and Cyber Resilience

GCash's digital operating model makes technology and cybersecurity particularly important.

Technology teams need to ensure that systems supporting Critical Operations can:

• withstand disruption;
• fail over where appropriate;
• recover rapidly;
• maintain sufficient capacity;
• preserve data integrity; and
• support the required service level during recovery.

Cybersecurity teams need to ensure that GCash can:

• prevent;
• detect;
• contain;
• respond to;
• recover from; and
• learn from

significant cyber incidents.

Operational Resilience connects these technical capabilities to the business outcome.

The test is not merely:

Was the application successfully restored?

The stronger question is:

Was the Critical Operation maintained or restored before its Tolerance for Disruption was exceeded?

The Role of Third Parties

Third-party dependency represents another major consideration.

For every Critical Operation, GCash should determine:

• which third parties support it;
• what services they provide;
• how quickly their failure would affect the operation;
• whether concentration risks exist;
• whether alternatives are available;
• whether contractual resilience provisions are sufficient;
• whether recovery arrangements have been tested; and
• whether provider failure could cause GCash to exceed its Tolerance for Disruption.

This creates an important Operational Resilience principle:

Third-party risk should be evaluated from the perspective of the Critical Operation and customer outcome, not only from the perspective of the supplier contract.

Scenario Testing as Evidence of Resilience

A documented framework alone cannot demonstrate Operational Resilience.

GCash must test its assumptions.

Severe but Plausible Scenarios could challenge combinations of:

• technology;
• cybersecurity;
• telecommunications;
• workforce;
• third parties;
• data;
• financial counterparties; and
• public infrastructure.

For example:

Cyberattack

Transaction Processing Disruption

Third-Party Degradation

High Customer Demand

↓

Can the Critical Operation remain within Tolerance for Disruption?

Testing provides evidence of whether the resilience arrangements actually work.

When the answer is no, the result becomes input for remediation.

Operational Resilience as a Continuous Cycle

Operational Resilience is not a one-time implementation exercise.

GCash's environment will continue to change.

New:

• technologies;
• products;
• customer expectations;
• service providers;
• cyber threats;
• regulations;
• partnerships; and
• operational dependencies

will emerge.

The resilience lifecycle should therefore operate continuously:

Understand

↓

Identify

↓

Map

↓

Assess

↓

Prepare

↓

Test

↓

Respond

↓

Recover

↓

Learn

↓

Improve

↓

Reassess

This continuous cycle reflects the adaptive nature of organisational resilience.

What the Reader Should Take Away

After this eBook, the reader should be able to understand the following key principles:

1. Operational Resilience begins with understanding the organisation.

2. GCash should focus resilience resources on operations whose disruption could have the greatest customer, organisational, or financial-system consequences.

3. Critical Operations must be understood end-to-end.

4. Resilience depends on people, processes, technology, information, facilities and third parties working together.

5. Governance and accountability must extend from the Board to Critical Operations owners and supporting functions.

6. BCM is an essential foundation but should be integrated with Operational Risk, ICT resilience, cybersecurity, third-party risk and Crisis Management.

7. Tolerance for Disruption should provide a measurable boundary for resilience.

8. Severe but Plausible Scenario testing should provide evidence that resilience arrangements actually work.

9. Vulnerabilities identified through testing and actual incidents must result in improvement.

Finally, Operational Resilience is an ongoing organisational capability rather than a one-time regulatory project.

Looking Ahead

The completion of Understanding Your Organisation: GCash establishes the context needed for the next stage of the enterprise implementation journey.

The next stage should move from:

"Understanding GCash"

to:

"Implementing Operational Resilience at GCash."

The organisational foundation developed in this eBook should be used to support detailed activities involving:

• Critical Operation identification;
• Critical Operation ownership;
• process and resource mapping;
• interconnection and interdependency mapping;
• Tolerance for Disruption;
• Severe but Plausible Scenario development;
• resilience gap assessment;
• scenario testing;
• resilience strategies;
• remediation;
• response and recovery; and
• continuous improvement.

Each subsequent resilience decision should be traceable back to the organisational understanding established here.

Understanding Your Organisation: GCash lays the foundation for a practical and sustainable Operational Resilience programme.

Throughout this eBook, the reader has progressed from understanding GCash and its operating environment to examining how resilience should be governed, what services and operations may require priority protection, which organisational characteristics influence resilience requirements, and what organisational goals should guide implementation.

Together, these elements provide the organisational context required to make informed resilience decisions.

They help GCash understand not simply what could go wrong, but what matters most, who could be affected, what the organisation depends upon, where vulnerabilities may exist and what outcomes must be maintained when disruption occurs.

The analysis also demonstrates that GCash's resilience cannot be understood within its organisational boundary alone.

Its Critical Operations may depend upon technology platforms, telecommunications networks, data, employees, financial institutions, merchants, payment infrastructure and third-party service providers.

These dependencies create pathways through which disruption can propagate.

Effective Operational Resilience, therefore, requires GCash to understand the end-to-end chain supporting each Critical Operation and determine whether that chain can continue to function under severe but plausible conditions.

Business Continuity Management remains an essential part of this capability, but BCM should operate alongside Operational Risk, Technology Resilience, Cybersecurity, Crisis Management, Third-Party Risk and other relevant disciplines.

The objective is not to replace these established programmes with Operational Resilience. Instead, Operational Resilience provides the enterprise perspective that connects them around a common outcome: the continued delivery of Critical Operations within acceptable levels of disruption.

The organisational goals established in this eBook provide the direction for achieving that outcome. GCash should seek to protect customers, maintain Critical Operations, preserve transaction and data integrity, understand dependencies, strengthen technology and cyber resilience, manage critical third parties, maintain effective response and recovery capabilities, test resilience through Severe but Plausible Scenarios, remediate vulnerabilities and continuously adapt to changes in its operating environment.

These goals convert resilience from an abstract concept into an enterprise management responsibility.

The completion of this eBook therefore marks an important transition. The question is no longer simply:

"Do we understand GCash?"

The next question becomes:

"Based on what we now understand about GCash, how do we design, implement, test and continuously improve the resilience of its Critical Operations?"

Answering that question requires the organisation to move into detailed implementation:

• identifying and confirming Critical Operations;

• mapping supporting processes and resources;

• establishing Tolerance for Disruption;

• mapping interconnections and interdependencies;

• developing Severe but Plausible Scenarios;

• conducting scenario testing; identifying vulnerabilities; 

• implementing appropriate resilience strategies and remediation.

Ultimately, the effectiveness of Operational Resilience at GCash should not be judged by the volume of policies, continuity plans, risk registers or testing reports produced.

Its effectiveness should be demonstrated by whether GCash can continue to deliver the financial operations on which its customers and stakeholders depend when significant disruption occurs.

That is the desired outcome of the journey begun in this eBook:

• Understand what matters.

• Understand what it depends upon.

• Prepare for disruption.

• Protect the customer.

• Maintain Critical Operations.

• Recover within Tolerance for Disruption.

• Learn from experience.

• Adapt and continuously strengthen resilience.

With this organisational foundation established, GCash is positioned to progress from understanding the organisation to the systematic implementation and strengthening of enterprise Operational Resilience.

Understanding Your Organisation
C1	C2	C3	C4	C5
C6	C7	C8	C9	eBook Cover

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.