[OR] [MAS] [E3] [C7] Continuous Improvement Framework

eBook 3: Chapter 7

Continuous Improvement Framework

Introduction

Operational resilience is not a static capability—it is a dynamic, evolving discipline that must continuously adapt to emerging risks, technological changes, and operational complexities. Testing, audits, and real incidents provide valuable insights, but their true value is realised only when organisations systematically capture, analyse, and act on these learnings.  

The Monetary Authority of Singapore emphasises that financial institutions must regularly review, update, and enhance their resilience frameworks following disruptions and testing outcomes.

Aligned with BCM Institute’s methodology, the “Improve and Communicate Lessons Learned” stage represents the final and most critical phase of the operational resilience lifecycle—ensuring that organisations not only recover from disruptions but emerge stronger and more resilient.

Lessons Learned from Incidents

Capturing Insights from Disruptions

Every disruption—whether a real incident, near miss, or scenario test—provides an opportunity to strengthen resilience. BCM Institute highlights that organisations must systematically capture and analyse lessons learned from disruptions, scenario testing, and operational events to enhance resilience capabilities.

Sources of Lessons Learned

Lessons should be derived from multiple sources, including:

• Operational incidents and outages
• Scenario testing and simulation exercises
• Audit findings and compliance reviews
• Industry events and peer experiences

Key Areas of Analysis

Post-incident reviews should focus on:

• Root cause analysis – What failed and why?
• Detection and response effectiveness – Was the issue identified and escalated promptly?
• Recovery performance – Were impact tolerances met?
• Coordination and communication – Were stakeholders aligned?

MAS Perspective

MAS expects financial institutions to review incidents and identify areas for improvement, ensuring that gaps are addressed and resilience measures are strengthened.

Common Challenges

• Superficial reviews focused only on immediate causes
• Failure to identify systemic or underlying issues
• Lack of accountability for implementing improvements

Feedback Loops and Enhancements

Establishing Continuous Feedback Mechanisms

A robust continuous improvement framework requires structured feedback loops that transform lessons learned into actionable improvements.

BCM Institute emphasises that organisations must:

• Analyse lessons learned
• Develop actionable improvement plans
• Assign ownership and timelines for implementation

Components of an Effective Feedback Loop

1. Analysis and Consolidation

• Identify patterns and recurring issues across incidents and tests
• Categorise lessons based on impact and urgency

2. Action Planning

• Translate insights into specific, measurable actions
• Prioritise improvements based on risk and business impact

3. Implementation

• Assign clear ownership to responsible teams
• Track progress against defined milestones

4. Monitoring and Validation

• Validate improvements through retesting and audits
• Measure effectiveness using resilience metrics and KPIs

Embedding Feedback into Governance

Feedback loops must be integrated into:

• Risk management frameworks
• Board and senior management reporting
• Operational resilience dashboards

This ensures that improvements are visible, measurable, and accountable.

Benefits of Strong Feedback Loops

• Continuous enhancement of resilience capabilities
• Faster and more effective incident response
• Reduction of recurring failures
• Alignment with regulatory expectations

Updating Plans and Strategies

Dynamic Nature of Resilience

Operational resilience plans must evolve in response to:

• Changing threat landscapes (e.g., cyber risks, third-party dependencies)
• Technological advancements (e.g., cloud adoption)
• Organisational changes (e.g., new products, mergers)

BCM Institute highlights that organisations must continually reassess threats, challenges, and impact tolerances, ensuring that resilience strategies remain relevant.

Key Areas for Updates

1. Business Continuity and Recovery Plans

• Update procedures based on testing outcomes and incident findings
• Enhance recovery strategies and failover mechanisms

2. Scenario Testing Frameworks

• Refine scenarios to reflect emerging risks
• Increase complexity (e.g., multi-event scenarios)

3. Dependency Mapping

• Update mappings to reflect changes in systems, processes, and vendors
• Address newly identified interdependencies

4. Impact Tolerances

• Adjust thresholds based on testing results and business requirements

5. Policies and Governance Structures

• Strengthen roles, responsibilities, and escalation frameworks

MAS Expectations

MAS requires financial institutions to ensure that resilience frameworks are regularly reviewed and updated, reflecting lessons learned and evolving risks.

Building a Culture of Continuous Improvement

Beyond Processes and Frameworks

Continuous improvement is not just about processes—it is about organisational culture. BCM Institute emphasises the importance of cultivating a culture that:

• Encourages learning from failures and near misses
• Promotes open communication and transparency
• Empowers employees to contribute to resilience improvements

Characteristics of a Resilient Organisation

• Proactive mindset – Anticipates risks rather than reacting to them
• Cross-functional collaboration – Breaks down silos
• Accountability and ownership – Ensures actions are implemented
• Continuous learning – Adapts to new challenges and environments

Leadership’s Role

Senior management and the Board play a critical role in:

• Driving resilience culture and priorities
• Ensuring resources and investment for improvement initiatives
• Monitoring progress and holding teams accountable

Integrating Continuous Improvement into the Resilience Lifecycle

Continuous improvement should be embedded across the operational resilience lifecycle:

• Test and Exercise – Identify gaps through scenario testing

• Review and Analyse – Conduct post-incident and post-test reviews

• Improve and Implement – Address identified weaknesses

• Monitor and Validate – Measure effectiveness of improvements

• Repeat – Continuously refine and enhance capabilities

This cyclical approach ensures that resilience remains adaptive, proactive, and sustainable.

A continuous improvement framework is essential for sustaining operational resilience. Guided by the expectations of the Monetary Authority of Singapore and aligned with BCM Institute’s methodology, financial institutions must systematically capture lessons learned, establish robust feedback loops, and continuously update their plans and strategies.

By embedding continuous improvement into governance, operations, and organisational culture, institutions can move beyond reactive recovery to proactive resilience maturity. Ultimately, resilience is not defined by the ability to withstand a single disruption—but by the organisation’s ability to learn, adapt, and improve continuously in an ever-changing risk landscape.