Operational Resilience is not simply a collection of continuity plans, technology recovery arrangements or risk controls. It is an enterprise-wide capability focused on ensuring that the organisation can continue delivering its most important services during disruption, within acceptable levels of impact.
For MBSB, this requires more than understanding individual departments or systems. It requires a clear view of the organisation as a service ecosystem made up of customers, business services, processes, people, technology, information, facilities, third parties and external financial infrastructure.
The earlier chapters have therefore progressively built this picture by examining MBSB's organisational context, its operating environment, the governance structure required to manage resilience, the Critical Business Services that should receive priority, the characteristics that shape its resilience profile and the organisational goals that should guide implementation.
The purpose of this final chapter is to consolidate those findings into a coherent summary and show how the individual elements connect. The rationale for doing so is that Operational Resilience should not be implemented as a series of disconnected activities.
Understanding the organisation, defining Critical Business Services, establishing governance, analysing dependencies and setting resilience goals are interrelated steps that collectively establish the foundation for effective implementation.
By the end of this chapter, the reader should be able to explain the principal Operational Resilience considerations for MBSB Bank, understand how the findings from the preceding chapters fit together and recognise how this organisational foundation supports the next stages of the Operational Resilience journey.
The intended outcome is a clear transition from understanding MBSB to planning and implementing Operational Resilience in a structured and service-focused manner.
The starting point for Operational Resilience is understanding the organisation itself.
For MBSB, this means understanding:
The key lesson is that MBSB should not be viewed solely through its organisational chart.
Instead, it should be viewed as an interconnected service ecosystem.
A customer-facing service may depend simultaneously on:
People
Processes
Technology
Information
Facilities
Third Parties
External Financial Infrastructure
Operational Resilience begins by understanding how these elements combine to deliver the service outcome experienced by the customer.
This service perspective provides the foundation for all subsequent resilience activities.
The second major consideration is the environment in which MBSB operates.
MBSB is part of an increasingly digital and interconnected Malaysian financial system. Its services may be affected by developments or disruptions originating within the bank or outside its direct control.
Important environmental factors include:
These factors influence both the likelihood and consequences of disruption.
For example:
External Telecommunications Failure
↓
Loss of Connectivity
↓
Digital Banking / ATM / Branch Connectivity Affected
↓
Critical Business Service Disrupted
↓
Customer Impact
The key lesson is that Operational Resilience must extend beyond organisational boundaries.
MBSB cannot evaluate the resilience of a service simply by confirming that internal systems are available. It must understand whether every material dependency required to deliver the service remains sufficiently resilient.
Operational Resilience requires coordinated governance.
Because Critical Business Services depend on multiple organisational functions, no single department should own the entire Operational Resilience programme.
The proposed MBSB governance structure is:
Board / Board Risk Committee
↓
Senior Management / Management Risk Committee
↓
Senior Executive Accountable for Operational Resilience
↓
Operational Resilience Steering Committee
↓
Operational Resilience Programme Function
↓
Critical Business Service Owners
↓
Resource and Functional Owners
↓
Operational Resilience Working Groups
The Board provides oversight and challenge.
Senior Management provides executive ownership and resources.
The accountable senior executive provides enterprise-wide coordination.
The Operational Resilience Steering Committee brings together business, risk, technology, cybersecurity, BCM, third-party management and other specialist capabilities.
Critical Business Service Owners remain accountable for the resilience of the service outcomes under their ownership.
The central principle is:
Operational Resilience should be centrally coordinated but collectively owned.
This prevents Operational Resilience from becoming a BCM-only, technology-only or risk-only programme.
The identification of Critical Business Services provides the organising structure for the Operational Resilience programme.
A Critical Business Service should describe an important outcome delivered to customers or stakeholders rather than a department, system or process.
For this case study, the proposed MBSB CBS catalogue consists of:
|
Code |
Critical Business Service |
|
CBS-1 |
Customer Deposit and Account Access Services |
|
CBS-2 |
Domestic Funds Transfer and Payment Services |
|
CBS-3 |
Digital Banking Services |
|
CBS-4 |
Cash Access and Cash Transaction Services |
|
CBS-5 |
Financing Account Servicing and Repayment Services |
|
CBS-6 |
Corporate Payment and Bulk Transaction Services |
|
CBS-7 |
High-Value and Interbank Payment Services |
|
CBS-8 |
Customer Transaction Authentication and Authorisation Services |
|
CBS-9 |
Customer Support and Assistance During Banking Disruptions |
These services are proposed for the purposes of the case study and should be formally assessed and validated before adoption.
Their importance should be considered using criteria such as:
The key lesson is:
Critical Business Services define what MBSB must protect during disruption.
Once identified, each service can be mapped, assigned an Impact Tolerance and tested against severe but plausible scenarios.
The design of MBSB's Operational Resilience programme should reflect its specific organisational characteristics.
Key characteristics identified in this eBook include:
MBSB's resilience arrangements must support accurate, reliable and compliant delivery of Islamic banking services.
Retail, SME and corporate customers experience disruption differently and may have different tolerance levels.
Increasing reliance on digital channels creates greater dependence on technology, telecommunications, cybersecurity and data.
Services related to deposits, payments and cash access may become critical very quickly when disrupted.
MBSB depends on external payment and settlement infrastructure, meaning service resilience extends beyond the bank itself.
Multiple CBSs may depend on common platforms, creating the potential for correlated failures.
External service providers may become critical links in the delivery of MBSB services.
Operational Resilience must assume that preventive cyber controls may fail and determine whether critical services can still be delivered.
The integrity and recoverability of banking information are as important as availability.
Alternative channels only provide genuine resilience if they do not rely on the same underlying point of failure.
Floods, facility loss, utilities disruption and workforce displacement can affect multiple resources simultaneously.
MBSB operates within a highly regulated sector in which resilience governance, technology, outsourcing, BCM and Operational Risk expectations continue to evolve.
Together, these characteristics determine where MBSB should focus its resilience efforts.
The final foundation developed in this eBook is the establishment of clear organisational goals.
A proposed overarching goal for MBSB is:
To strengthen MBSB Bank's ability to anticipate, withstand, respond to, recover from and learn from operational disruption while continuing to deliver its Critical Business Services within established Impact Tolerances, minimising harm to customers and supporting confidence in Malaysia's financial system.
This overarching goal can be supported by several specific objectives:
These goals give direction to the subsequent Operational Resilience programme.
They ensure that the programme remains outcome-focused rather than activity-focused.
The six substantive chapters in this eBook should be viewed as a connected sequence.
The progression is:
Understanding MBSB Bank
↓
Examining MBSB's Operating Environment
↓
Composing the Operational Resilience Team
↓
Identifying Critical Business Services
↓
Understanding MBSB's Key Characteristics
↓
Establishing Organisational Operational Resilience Goals
Each step answers a different question.
Understanding the Organisation
Who is MBSB and how does it deliver value?
Examining the Operating Environment
What internal and external conditions could affect the delivery of those services?
Composing the Operational Resilience Team
Who should govern, coordinate and own resilience?
Identifying Critical Business Services
Which services must receive priority?
Understanding Key Characteristics
What is distinctive about MBSB's business and operating model that affects resilience?
Establishing Organisational Goals
What resilience outcomes should MBSB seek to achieve?
Together, the answers provide a coherent foundation for implementation.
The results of this eBook can be consolidated into a high-level Operational Resilience foundation.
|
Foundation Element |
MBSB Case Study Position |
|
Organisation |
MBSB Bank |
|
Jurisdiction |
Malaysia |
|
Sector |
Financial Services Institution / Islamic Banking |
|
Primary Regulator |
Bank Negara Malaysia |
|
Primary Resilience Objective |
Continued delivery of Critical Business Services |
|
Principal Stakeholders |
Retail, SME and corporate customers, counterparties, regulators and financial-market participants |
|
Primary Resource Categories |
People, processes, technology, information, facilities and third parties |
|
Key External Dependencies |
Telecommunications, technology providers, payment infrastructure and other financial institutions |
|
Primary Resilience Risks |
Cyberattack, technology failure, third-party failure, data compromise, communications failure and physical disruption |
|
Governance Model |
Board oversight, Senior Management accountability and cross-functional coordination |
|
Core Unit of OR Analysis |
Critical Business Service |
|
Resilience Boundary |
Impact Tolerance |
|
Primary Validation Method |
Severe but plausible scenario testing |
|
Continuous Improvement Mechanism |
Incident learning, testing findings and vulnerability remediation |
|
Desired Outcome |
CBSs remain deliverable within acceptable levels of disruption |
This represents the starting architecture for MBSB's Operational Resilience programme.
One of the most important conclusions from this eBook is that MBSB should not create Operational Resilience as a completely separate management discipline.
Instead, existing capabilities should be integrated around the Critical Business Service.
A practical model is:
Operational Risk Management
Business Continuity Management
IT Disaster Recovery
Cybersecurity
Crisis Management
Incident Management
Third-Party Risk Management
Data Management
↓
Critical Business Service Resilience
Each discipline provides a different part of the resilience capability.
BCM may provide continuity arrangements.
Technology provides recovery and availability.
Cybersecurity provides protection and response.
Third-Party Risk manages external dependencies.
Operational Risk provides risk oversight.
Crisis Management provides command and decision-making.
Operational Resilience connects these capabilities around the service outcome experienced by the customer.
A useful way of summarising the shift introduced throughout this eBook is to compare traditional recovery thinking with Operational Resilience thinking.
|
Traditional Perspective |
Operational Resilience Perspective |
|
Critical business function |
Critical Business Service |
|
Department-focused |
Customer- and outcome-focused |
|
Individual system recovery |
End-to-end service continuity |
|
Recovery Time Objective |
Impact Tolerance |
|
Individual resource failure |
Severe but plausible service disruption |
|
Recovery plan testing |
End-to-end scenario testing |
|
Internal dependencies |
Internal and external interdependencies |
|
Return to normal |
Maintain acceptable service and adapt |
|
Incident closure |
Lessons learned and resilience improvement |
Traditional BCM remains important.
The change is one of perspective.
Operational Resilience asks not simply:
How quickly can the failed component recover?
but:
Can the Critical Business Service remain within acceptable limits while disruption is occurring?
At the conclusion of this eBook, MBSB should be positioned to address fundamental questions such as:
These questions represent the bridge between organisational understanding and Operational Resilience implementation.
This eBook has deliberately focused on understanding MBSB before detailed implementation begins.
The next stage should move from understanding to structured execution.
A practical pathway is:
Understand the Organisation
↓
Establish Operational Resilience Direction
↓
Plan
↓
Implement
↓
Sustain
Within the Plan phase, MBSB can assess its current capability and maturity, analyse gaps, develop the Operational Resilience strategy and roadmap, confirm risk appetite and embed governance.
Within the Implement phase, MBSB can formally identify Critical Business Services, map interconnections and interdependencies, establish Impact Tolerances, conduct severe but plausible scenario testing and improve resilience from lessons learned.
Within the Sustain phase, MBSB can embed resilience within organisational culture, communications, training and awareness, self-assessment and independent quality review.
The foundations developed in this eBook should therefore inform every subsequent phase.
The principal conclusions from Understanding Your Organisation: MBSB Bank can be summarised as follows.
First, Operational Resilience must begin with a clear understanding of the organisation and the outcomes it delivers to customers.
Second, MBSB's resilience depends on an ecosystem extending beyond the organisational boundary to include technology providers, telecommunications, payment infrastructure and other financial institutions.
Third, Operational Resilience requires cross-functional governance and cannot be assigned solely to BCM, Technology or Risk.
Fourth, Critical Business Services provide the principal unit around which resilience should be organised.
Fifth, MBSB's organisational characteristics—including its Islamic banking model, customer profile, digital dependency, payment connectivity and third-party environment—must influence the design of its resilience programme.
Sixth, Operational Resilience goals should focus on continued service delivery, customer protection, Impact Tolerance, end-to-end dependency visibility, severe but plausible scenario testing and continuous improvement.
Most importantly:
Operational Resilience should be understood as an organisational capability to continue delivering what matters most when disruption occurs.
This eBook has established the organisational foundation for applying Operational Resilience to MBSB Bank. It began by examining MBSB as an organisation and then progressively considered the operating environment, the governance and team structure required to manage resilience, the proposed Critical Business Services that should receive priority, the characteristics shaping MBSB's resilience profile and the organisational goals that should guide implementation.
Taken together, these elements establish a service-oriented view of MBSB.
The organisation is no longer viewed simply as a collection of departments, systems and recovery plans. Instead, it is viewed as an interconnected network of capabilities that collectively deliver important outcomes to customers and other stakeholders.
That distinction is fundamental.
A service may depend simultaneously on people, processes, technology, data, facilities, telecommunications, third parties and financial infrastructure. A disruption affecting any one of these resources can potentially interrupt the customer outcome. Operational Resilience therefore requires MBSB to understand these interconnections and design resilience around the end-to-end service.
The proposed Critical Business Services developed within this eBook provide the practical focal point for that work:
CBS-1 Customer Deposit and Account Access Services
CBS-2 Domestic Funds Transfer and Payment Services
CBS-3 Digital Banking Services
CBS-4 Cash Access and Cash Transaction Services
CBS-5 Financing Account Servicing and Repayment Services
CBS-6 Corporate Payment and Bulk Transaction Services
CBS-7 High-Value and Interbank Payment Services
CBS-8 Customer Transaction Authentication and Authorisation Services
CBS-9 Customer Support and Assistance During Banking Disruptions
These services establish what MBSB should seek to protect.
The organisational structure establishes who should be accountable.
The operating-environment assessment establishes what could disrupt those services.
The characteristics of MBSB establish where vulnerabilities and dependencies are likely to arise.
The organisational goals establish what resilience outcomes MBSB should seek to achieve.
Together, they form the foundation for the next stage of the Operational Resilience journey.
The most important transition now is from understanding to implementation.
MBSB should move from asking:
What does the organisation look like and what matters most?
to asking:
How resilient is MBSB today, where are the gaps, and what must be done to ensure its Critical Business Services remain within acceptable levels of disruption?
Those questions lead directly into the structured Operational Resilience Planning Methodology.
The next eBook in the Operational Resilience in Action: The MBSB Approach series can therefore build upon this foundation by moving into the Plan phase—assessing MBSB's Operational Resilience capability and maturity, analysing gaps, establishing strategic direction, confirming risk boundaries and embedding governance and accountability.
The foundation established in this first eBook should remain the reference point throughout that journey:
Understand the organisation first. Identify what matters. Understand what it depends upon. Then build the resilience required to protect it.
| eBook 1: Understanding Your Organisation: MBSB Bank | |||
| C1 | C2 | C3 | C4 |
| C5 | C6 | C7 | C8 |
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|