[OR] [MAS] [E1] [C7] Challenges in Understanding and Defining Resilience

eBook 1: Chapter 7

 Monetary Authority of Singapore's (MAS) Challenges in Understanding and Defining Resilience

Purpose of the Chapter

While operational resilience has become a central regulatory expectation under the Monetary Authority of Singapore (MAS), many financial institutions continue to face practical challenges in understanding and defining what resilience truly means in implementation terms.

Drawing from MAS guidance such as “Achieving Operational Resilience for Financial Institutions in Singapore” and the BCM Guidelines (2022), this chapter highlights four key challenges:

• Ambiguity between Business Continuity Management (BCM) and operational resilience
• Difficulty in defining Critical Business Services (CBS)
• Organisational silos
• Regulatory interpretation challenges

These challenges must be addressed to move from conceptual understanding to effective execution.

Ambiguity Between BCM and Operational Resilience

Overlapping Concepts

One of the most common challenges is the confusion between BCM and operational resilience.

MAS guidelines build on BCM but extend beyond it. BCM traditionally focuses on:

• Recovery planning
• Business continuity plans
• Meeting Recovery Time Objectives (RTOs)

Operational resilience, however, emphasises:

• Continuous delivery of critical services
• End-to-end service integrity
• Adaptability under disruption

MAS explicitly requires institutions to adopt a service-centric, end-to-end approach, rather than a purely plan-based recovery mindset .

Practical Confusion in Implementation

Financial institutions often struggle because:

• BCM teams continue to operate in a plan-centric mindset
• Operational resilience is perceived as “BCM plus additional requirements”
• There is no clear distinction in roles, ownership, and scope

This ambiguity leads to:

• Duplication of effort
• Misaligned priorities
• Inconsistent implementation across business units

Bridging the Gap

To overcome this challenge, institutions must:

• Reframe BCM as a component of operational resilience, not the whole
• Shift focus from process recovery to service continuity
• Align BCM outputs (e.g., RTOs, plans) with service-level resilience outcomes

Difficulty in Defining Critical Business Services (CBS)

Conceptual Complexity

MAS requires financial institutions to identify Critical Business Services (CBS) that are essential to customers and financial stability.

However, defining CBS is challenging because:

• Services are often interlinked and overlapping
• Organisations are structured around products or functions, not services
• The concept of a “service” may differ across departments

MAS emphasises that CBS must be identified based on its impact on customers, safety and soundness, and systemic risk.

Practical Challenges

Common issues include:

• Confusing products, processes, and services
• Over-identifying (too many CBS) or under-identifying (missing critical ones)
• Difficulty in defining service boundaries and scope
• Lack of consensus across business units

Impact on Resilience Implementation

Poor CBS definition leads to:

• Misaligned recovery priorities
• Ineffective resource allocation
• Incomplete dependency mapping

Since CBS is the foundation of the operational resilience framework, any weakness here cascades across the entire implementation.

Addressing the Challenge

Institutions should:

• Adopt a customer-centric perspective
• Focus on end-to-end service delivery outcomes
• Conduct cross-functional workshops to validate CBS definitions
• Regularly review and refine CBS as operations evolve

Organisational Silos

Structural Fragmentation

Financial institutions are typically organised into:

• Business units
• Technology functions
• Risk and compliance teams
• Operations and support functions

Each operates with different objectives, metrics, and reporting lines.

Impact on Operational Resilience

Operational resilience requires end-to-end coordination, but silos create:

• Fragmented risk visibility
• Inconsistent data and reporting
• Gaps in dependency mapping
• Delays in incident response and escalation

MAS guidelines stress the need for end-to-end dependency mapping across people, processes, technology, and third parties, highlighting the importance of breaking down silos .

Cultural and Governance Barriers

Silos are often reinforced by:

• Lack of shared accountability
• Competing business priorities
• Limited cross-functional collaboration

This results in resilience being treated as a compliance exercise, rather than an enterprise-wide capability.

Overcoming Silos

To address this challenge, institutions must:

• Establish cross-functional governance structures
• Assign clear ownership of CBS across departments
• Promote collaboration between business, technology, and risk teams
• Embed resilience into business-as-usual operations

Regulatory Interpretation Challenges

Principles-Based Regulation

MAS adopts a principles-based approach, providing flexibility in how institutions implement operational resilience.

While beneficial, this creates challenges:

• Lack of prescriptive guidance
• Need for interpretation and judgement
• Variability in implementation across institutions

Uncertainty in Application

Financial institutions often struggle with:

• Determining the appropriate number of CBS
• Setting realistic and justifiable recovery objectives
• Defining acceptable levels of disruption (impact tolerance)
• Aligning global frameworks with Singapore-specific requirements

MAS expects institutions to adopt a risk-proportionate approach, tailoring implementation to their size, complexity, and risk profile.

Supervisory Expectations

Despite flexibility, MAS expects:

• Clear documentation and justification of decisions
• Demonstrable effectiveness of resilience measures
• Evidence of continuous testing and improvement

Institutions must therefore balance:

• Flexibility in design
• Accountability in outcomes

Managing Interpretation Risks

To address regulatory interpretation challenges, institutions should:

• Develop internal standards and frameworks aligned with MAS guidance
• Engage in industry benchmarking and regulatory dialogue
• Maintain strong documentation and audit trails
• Continuously refine practices based on regulatory feedback

Integrated View of Key Challenges

The challenges in defining operational resilience are interconnected:

These challenges highlight that operational resilience is not just a technical exercise, but a strategic, organisational, and cultural transformation.

Understanding and defining operational resilience remain among the most significant challenges for financial institutions in Singapore.

While the Monetary Authority of Singapore provides a robust framework through its BCM and related guidelines, the principles-based nature of regulation requires institutions to exercise sound judgement and organisational alignment.

Ambiguity between BCM and resilience, difficulties in defining critical business services, organisational silos, and challenges in regulatory interpretation all contribute to the complexity of implementation.

Addressing these challenges requires a shift from compliance-driven thinking to a holistic, service-centric, and enterprise-wide approach, enabling financial institutions to build resilience that is both effective and sustainable in an increasingly complex operating environment.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.