[OR] [MAS] [E1] [C1] Operational Resilience in the Context of Singapore's Financial Sector

eBook 1: Chapter 1

Introduction to Operational Resilience in the Context of Singapore's Financial Sector

Purpose of the Chapter

This chapter introduces the concept of operational resilience in the context of Singapore’s financial sector, guided by the Monetary Authority of Singapore's (MAS) expectations.

It establishes a foundational understanding of how financial institutions must evolve from traditional business continuity management (BCM) practices towards a broader, more integrated resilience framework.

The chapter also clarifies the distinctions between Business Continuity Management (BCM), Operational Risk Management (ORM), and Operational Resilience, while emphasising the critical importance of maintaining customer-centric service continuity in an increasingly complex and interconnected operating environment.

Definition of Operational Resilience (MAS Perspective)

Operational resilience refers to an institution’s ability to deliver critical business services continuously, even in the face of disruptions, by preventing, adapting to, responding to, and recovering from operational incidents.

From the MAS perspective, operational resilience is not limited to recovery after a disruption. Instead, it encompasses the organisation’s ability to:

• Anticipate and prevent disruptions through robust risk management practices
• Absorb and adapt to shocks without significant service degradation
• Recover within acceptable timeframes aligned to defined recovery objectives
• Learn and improve continuously based on past incidents and testing outcomes

MAS places strong emphasis on ensuring that financial institutions maintain financial system stability by safeguarding the continuous delivery of services critical to customers, markets, and the broader economy.

This shifts the focus from “recovering systems” to maintaining services.

Evolution from BCM to Resilience Thinking

Traditional BCM Approach

Historically, organisations relied on BCM frameworks that focused on:

• Identifying critical business functions
• Establishing recovery strategies and plans
• Conducting periodic testing and exercising
• Ensuring recovery within defined Recovery Time Objectives (RTOs)

While effective, this approach was often:

• Plan-centric
• Focused on post-disruption recovery
• Limited to internal organisational boundaries

Drivers for Change

The evolution towards operational resilience has been driven by:

• Increasing digitalisation and cyber threats
• Greater reliance on third-party providers and cloud services
• Complex interdependencies across financial ecosystems
• Rising expectations from regulators, customers, and stakeholders

These factors exposed the limitations of traditional BCM, particularly its inability to address end-to-end service continuity.

Resilience Thinking

Operational resilience introduces a paradigm shift:

Resilience thinking requires organisations to design systems and processes that can withstand disruption, rather than relying solely on recovery mechanisms.

Difference Between BCM, ORM, and Operational Resilience

Operational resilience integrates multiple disciplines. Understanding their distinctions is critical.

Business Continuity Management (BCM)

BCM focuses on:

• Developing plans and procedures to recover operations
• Ensuring the availability of alternate sites, systems, and resources
• Achieving recovery within defined RTOs and RPOs

Key Limitation:

BCM is primarily concerned with how to recover, not whether the service can be continuously delivered.

Operational Risk Management (ORM)

ORM focuses on:

• Identifying and assessing operational risks
• Implementing controls and mitigation measures
• Monitoring risk exposure and incidents

Key Limitation:

ORM emphasises risk prevention, but does not fully address service continuity during disruptions.

Operational Resilience

Operational resilience brings BCM and ORM together, while extending beyond them:

• Focuses on critical business services (CBS) rather than functions
• Integrates risk management, continuity planning, crisis management, and technology resilience
• Addresses end-to-end dependencies, including third parties
• Defines impact tolerances (acceptable levels of disruption)
• Requires scenario testing and continuous improvement

Integrated View

Operational resilience is therefore not a replacement, but an integration and evolution of BCM and ORM.

Importance of Customer-Centric Service Continuity

At the core of MAS expectations is a customer-centric approach to resilience.

From Internal Processes to Customer Outcomes

Traditional approaches focused on:

• Internal processes
• System recovery

Operational resilience shifts the focus to:

• Customer outcomes
• Service availability
• User experience during disruptions

A service is considered resilient only if customers can continue to access it within acceptable limits, even during adverse events.

Critical Business Services (CBS)

Financial institutions must identify services that are critical based on:

• Customer impact (e.g., inability to access funds)
• Financial impact (e.g., loss of revenue or liquidity)
• Systemic impact (e.g., disruption to payment systems)
• Regulatory obligations

Examples include:

• Digital banking access
• Payment and funds transfer services
• ATM and cash withdrawal services

Impact Tolerance and Service Continuity

MAS expects institutions to define:

• Maximum tolerable disruption levels
• Acceptable downtime thresholds
• Limits on data loss or service degradation

This ensures that organisations prioritise:

• Maintaining essential services
• Protecting customer trust
• Preserving financial system stability

Trust and Reputation

In Singapore’s highly competitive financial sector, resilience directly impacts:

• Customer confidence
• Brand reputation
• Regulatory standing

Failure to maintain service continuity can result in:

• Regulatory penalties
• Loss of customer trust
• Systemic consequences

Operational resilience represents a fundamental shift in how financial institutions prepare for and respond to disruptions.

Under the guidance of the Monetary Authority of Singapore, institutions are expected to move beyond traditional recovery-focused approaches towards a service-centric, integrated, and adaptive resilience model.

By understanding the evolution from BCM to operational resilience, and recognising the complementary roles of BCM and ORM, organisations can begin to develop a framework that ensures the continuous delivery of critical services under all conditions.

Ultimately, operational resilience is not merely about compliance—it is about protecting customers, sustaining trust, and ensuring the stability of Singapore’s financial system.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.