[OR] [MBSB] [E1] [C8] Summary

Chapter 8

Summary for Understanding Your Organisation: MBSB Bank

This eBook, Understanding Your Organisation: MBSB Bank, establishes the foundation required before MBSB Bank can proceed with the detailed implementation of Operational Resilience.

Operational Resilience is not simply a collection of continuity plans, technology recovery arrangements or risk controls. It is an enterprise-wide capability focused on ensuring that the organisation can continue delivering its most important services during disruption, within acceptable levels of impact.

For MBSB, this requires more than understanding individual departments or systems. It requires a clear view of the organisation as a service ecosystem made up of customers, business services, processes, people, technology, information, facilities, third parties and external financial infrastructure.

The earlier chapters have therefore progressively built this picture by examining MBSB's organisational context, its operating environment, the governance structure required to manage resilience, the Critical Business Services that should receive priority, the characteristics that shape its resilience profile and the organisational goals that should guide implementation.

The purpose of this final chapter is to consolidate those findings into a coherent summary and show how the individual elements connect. The rationale for doing so is that Operational Resilience should not be implemented as a series of disconnected activities.

Understanding the organisation, defining Critical Business Services, establishing governance, analysing dependencies and setting resilience goals are interrelated steps that collectively establish the foundation for effective implementation.

By the end of this chapter, the reader should be able to explain the principal Operational Resilience considerations for MBSB Bank, understand how the findings from the preceding chapters fit together and recognise how this organisational foundation supports the next stages of the Operational Resilience journey.

The intended outcome is a clear transition from understanding MBSB to planning and implementing Operational Resilience in a structured and service-focused manner.

Understanding MBSB Bank

The starting point for Operational Resilience is understanding the organisation itself.

For MBSB, this means understanding:

• the customers and stakeholders it serves;
• the banking services it provides;
• the channels through which those services are delivered;
• the technologies and information required;
• the employees and specialist capabilities involved;
• the third parties and financial infrastructure on which it depends; and
• the regulatory environment within which it operates.

The key lesson is that MBSB should not be viewed solely through its organisational chart.

Instead, it should be viewed as an interconnected service ecosystem.

A customer-facing service may depend simultaneously on:

People

Processes

Technology

Information

Facilities

Third Parties

External Financial Infrastructure

Operational Resilience begins by understanding how these elements combine to deliver the service outcome experienced by the customer.

This service perspective provides the foundation for all subsequent resilience activities.

MBSB's Operating Environment

The second major consideration is the environment in which MBSB operates.

MBSB is part of an increasingly digital and interconnected Malaysian financial system. Its services may be affected by developments or disruptions originating within the bank or outside its direct control.

Important environmental factors include:

• increasing digitalisation;
• changing customer expectations;
• cyber threats;
• telecommunications dependencies;
• payment and settlement infrastructure;
• third-party service providers;
• technology concentration;
• data integrity risks;
• physical and climate-related disruptions;
• specialist workforce dependencies; and
• evolving regulatory expectations.

These factors influence both the likelihood and consequences of disruption.

For example:

External Telecommunications Failure

↓

Loss of Connectivity

↓

Digital Banking / ATM / Branch Connectivity Affected

↓

Critical Business Service Disrupted

↓

Customer Impact

The key lesson is that Operational Resilience must extend beyond organisational boundaries.

MBSB cannot evaluate the resilience of a service simply by confirming that internal systems are available. It must understand whether every material dependency required to deliver the service remains sufficiently resilient.

Composition of the Operational Resilience Team

Operational Resilience requires coordinated governance.

Because Critical Business Services depend on multiple organisational functions, no single department should own the entire Operational Resilience programme.

The proposed MBSB governance structure is:

Board / Board Risk Committee

↓

Senior Management / Management Risk Committee

↓

Senior Executive Accountable for Operational Resilience

↓

Operational Resilience Steering Committee

↓

Operational Resilience Programme Function

↓

Critical Business Service Owners

↓

Resource and Functional Owners

↓

Operational Resilience Working Groups

The Board provides oversight and challenge.

Senior Management provides executive ownership and resources.

The accountable senior executive provides enterprise-wide coordination.

The Operational Resilience Steering Committee brings together business, risk, technology, cybersecurity, BCM, third-party management and other specialist capabilities.

Critical Business Service Owners remain accountable for the resilience of the service outcomes under their ownership.

The central principle is:

Operational Resilience should be centrally coordinated but collectively owned.

This prevents Operational Resilience from becoming a BCM-only, technology-only or risk-only programme.

Critical Business Services for MBSB

The identification of Critical Business Services provides the organising structure for the Operational Resilience programme.

A Critical Business Service should describe an important outcome delivered to customers or stakeholders rather than a department, system or process.

For this case study, the proposed MBSB CBS catalogue consists of:

These services are proposed for the purposes of the case study and should be formally assessed and validated before adoption.

Their importance should be considered using criteria such as:

• customer harm;
• financial impact;
• time sensitivity;
• transaction volume and value;
• substitutability;
• interdependency;
• financial-system impact; and
• regulatory consequences.

The key lesson is:

Critical Business Services define what MBSB must protect during disruption.

Once identified, each service can be mapped, assigned an Impact Tolerance and tested against severe but plausible scenarios.

Key Characteristics of MBSB

The design of MBSB's Operational Resilience programme should reflect its specific organisational characteristics.

Key characteristics identified in this eBook include:

Islamic Banking Model

MBSB's resilience arrangements must support accurate, reliable and compliant delivery of Islamic banking services.

Diverse Customer Segments

Retail, SME and corporate customers experience disruption differently and may have different tolerance levels.

Digital Dependency

Increasing reliance on digital channels creates greater dependence on technology, telecommunications, cybersecurity and data.

Customer Access to Funds

Services related to deposits, payments and cash access may become critical very quickly when disrupted.

Payment Interconnectivity

MBSB depends on external payment and settlement infrastructure, meaning service resilience extends beyond the bank itself.

Technology Concentration

Multiple CBSs may depend on common platforms, creating the potential for correlated failures.

Third-Party Dependency

External service providers may become critical links in the delivery of MBSB services.

Cyber Exposure

Operational Resilience must assume that preventive cyber controls may fail and determine whether critical services can still be delivered.

Data Dependence

The integrity and recoverability of banking information are as important as availability.

Multiple Delivery Channels

Alternative channels only provide genuine resilience if they do not rely on the same underlying point of failure.

Physical and Environmental Exposure

Floods, facility loss, utilities disruption and workforce displacement can affect multiple resources simultaneously.

Regulatory Environment

MBSB operates within a highly regulated sector in which resilience governance, technology, outsourcing, BCM and Operational Risk expectations continue to evolve.

Together, these characteristics determine where MBSB should focus its resilience efforts.

Organisational Goals for Operational Resilience

The final foundation developed in this eBook is the establishment of clear organisational goals.

A proposed overarching goal for MBSB is:

To strengthen MBSB Bank's ability to anticipate, withstand, respond to, recover from and learn from operational disruption while continuing to deliver its Critical Business Services within established Impact Tolerances, minimising harm to customers and supporting confidence in Malaysia's financial system.

This overarching goal can be supported by several specific objectives:

• protect Critical Business Services;
• minimise customer and stakeholder harm;
• understand end-to-end dependencies;
• establish Impact Tolerances;
• test severe but plausible scenarios;
• identify and reduce vulnerabilities;
• strengthen technology, cyber and data resilience;
• strengthen third-party resilience;
• establish clear governance and accountability;
• integrate existing resilience disciplines;
• develop organisational adaptability;
• build a resilience-supporting culture;
• embed resilience into change initiatives; and
• continuously learn and improve.

These goals give direction to the subsequent Operational Resilience programme.

They ensure that the programme remains outcome-focused rather than activity-focused.

Connecting the Chapters

The six substantive chapters in this eBook should be viewed as a connected sequence.

The progression is:

Understanding MBSB Bank

↓

Examining MBSB's Operating Environment

↓

Composing the Operational Resilience Team

↓

Identifying Critical Business Services

↓

Understanding MBSB's Key Characteristics

↓

Establishing Organisational Operational Resilience Goals

Each step answers a different question.

Understanding the Organisation

Who is MBSB and how does it deliver value?

Examining the Operating Environment

What internal and external conditions could affect the delivery of those services?

Composing the Operational Resilience Team

Who should govern, coordinate and own resilience?

Identifying Critical Business Services

Which services must receive priority?

Understanding Key Characteristics

What is distinctive about MBSB's business and operating model that affects resilience?

Establishing Organisational Goals

What resilience outcomes should MBSB seek to achieve?

Together, the answers provide a coherent foundation for implementation.

The MBSB Operational Resilience Foundation

The results of this eBook can be consolidated into a high-level Operational Resilience foundation.

This represents the starting architecture for MBSB's Operational Resilience programme.

Integrating Existing Management Disciplines

One of the most important conclusions from this eBook is that MBSB should not create Operational Resilience as a completely separate management discipline.

Instead, existing capabilities should be integrated around the Critical Business Service.

A practical model is:

Operational Risk Management

Business Continuity Management

IT Disaster Recovery

Cybersecurity

Crisis Management

Incident Management

Third-Party Risk Management

Data Management

↓

Critical Business Service Resilience

Each discipline provides a different part of the resilience capability.

BCM may provide continuity arrangements.

Technology provides recovery and availability.

Cybersecurity provides protection and response.

Third-Party Risk manages external dependencies.

Operational Risk provides risk oversight.

Crisis Management provides command and decision-making.

Operational Resilience connects these capabilities around the service outcome experienced by the customer.

From Traditional Recovery to Operational Resilience

A useful way of summarising the shift introduced throughout this eBook is to compare traditional recovery thinking with Operational Resilience thinking.

Traditional BCM remains important.

The change is one of perspective.

Operational Resilience asks not simply:

How quickly can the failed component recover?

but:

Can the Critical Business Service remain within acceptable limits while disruption is occurring?

The Questions MBSB Should Now Be Able to Answer

At the conclusion of this eBook, MBSB should be positioned to address fundamental questions such as:

• What outcomes does MBSB deliver to its customers?
• Which services are potentially critical?
• Who owns those services?
• Which customers could suffer significant harm if the services are disrupted?
• Which internal and external resources support them?
• Which technologies are common to several services?
• Where do significant third-party dependencies exist?
• Which alternative arrangements are genuinely independent?
• Which scenarios could cause multiple failures simultaneously?
• What governance structure should oversee resilience?
• What level of disruption should MBSB ultimately be prepared to tolerate?
• How will resilience performance be tested?
• How will vulnerabilities be prioritised?
• How will lessons from incidents and testing be converted into improvements?

These questions represent the bridge between organisational understanding and Operational Resilience implementation.

Moving from Understanding to Implementation

This eBook has deliberately focused on understanding MBSB before detailed implementation begins.

The next stage should move from understanding to structured execution.

A practical pathway is:

Understand the Organisation

↓

Establish Operational Resilience Direction

↓

Plan

↓

Implement

↓

Sustain

Within the Plan phase, MBSB can assess its current capability and maturity, analyse gaps, develop the Operational Resilience strategy and roadmap, confirm risk appetite and embed governance.

Within the Implement phase, MBSB can formally identify Critical Business Services, map interconnections and interdependencies, establish Impact Tolerances, conduct severe but plausible scenario testing and improve resilience from lessons learned.

Within the Sustain phase, MBSB can embed resilience within organisational culture, communications, training and awareness, self-assessment and independent quality review.

The foundations developed in this eBook should therefore inform every subsequent phase.

Key Takeaways from the eBook

The principal conclusions from Understanding Your Organisation: MBSB Bank can be summarised as follows.

First, Operational Resilience must begin with a clear understanding of the organisation and the outcomes it delivers to customers.

Second, MBSB's resilience depends on an ecosystem extending beyond the organisational boundary to include technology providers, telecommunications, payment infrastructure and other financial institutions.

Third, Operational Resilience requires cross-functional governance and cannot be assigned solely to BCM, Technology or Risk.

Fourth, Critical Business Services provide the principal unit around which resilience should be organised.

Fifth, MBSB's organisational characteristics—including its Islamic banking model, customer profile, digital dependency, payment connectivity and third-party environment—must influence the design of its resilience programme.

Sixth, Operational Resilience goals should focus on continued service delivery, customer protection, Impact Tolerance, end-to-end dependency visibility, severe but plausible scenario testing and continuous improvement.

Most importantly:

Operational Resilience should be understood as an organisational capability to continue delivering what matters most when disruption occurs.

This eBook has established the organisational foundation for applying Operational Resilience to MBSB Bank. It began by examining MBSB as an organisation and then progressively considered the operating environment, the governance and team structure required to manage resilience, the proposed Critical Business Services that should receive priority, the characteristics shaping MBSB's resilience profile and the organisational goals that should guide implementation.

Taken together, these elements establish a service-oriented view of MBSB.

The organisation is no longer viewed simply as a collection of departments, systems and recovery plans. Instead, it is viewed as an interconnected network of capabilities that collectively deliver important outcomes to customers and other stakeholders.

That distinction is fundamental.

A service may depend simultaneously on people, processes, technology, data, facilities, telecommunications, third parties and financial infrastructure. A disruption affecting any one of these resources can potentially interrupt the customer outcome. Operational Resilience therefore requires MBSB to understand these interconnections and design resilience around the end-to-end service.

The proposed Critical Business Services developed within this eBook provide the practical focal point for that work:

CBS-1 Customer Deposit and Account Access Services

CBS-2 Domestic Funds Transfer and Payment Services

CBS-3 Digital Banking Services

CBS-4 Cash Access and Cash Transaction Services

CBS-5 Financing Account Servicing and Repayment Services

CBS-6 Corporate Payment and Bulk Transaction Services

CBS-7 High-Value and Interbank Payment Services

CBS-8 Customer Transaction Authentication and Authorisation Services

CBS-9 Customer Support and Assistance During Banking Disruptions

These services establish what MBSB should seek to protect.

The organisational structure establishes who should be accountable.

The operating-environment assessment establishes what could disrupt those services.

The characteristics of MBSB establish where vulnerabilities and dependencies are likely to arise.

The organisational goals establish what resilience outcomes MBSB should seek to achieve.

Together, they form the foundation for the next stage of the Operational Resilience journey.

The most important transition now is from understanding to implementation.

MBSB should move from asking:

What does the organisation look like and what matters most?

to asking:

How resilient is MBSB today, where are the gaps, and what must be done to ensure its Critical Business Services remain within acceptable levels of disruption?

Those questions lead directly into the structured Operational Resilience Planning Methodology.

The next eBook in the Operational Resilience in Action: The MBSB Approach series can therefore build upon this foundation by moving into the Plan phase—assessing MBSB's Operational Resilience capability and maturity, analysing gaps, establishing strategic direction, confirming risk boundaries and embedding governance and accountability.

The foundation established in this first eBook should remain the reference point throughout that journey:

Understand the organisation first. Identify what matters. Understand what it depends upon. Then build the resilience required to protect it.

 

eBook 1: Understanding Your Organisation: MBSB Bank
C1	C2	C3	C4
C5	C6	C7	C8

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.