[OR] [MBSB] [E2] [P1] [C2] Five Stages of the "Plan" Phase

MBSB’s Plan Phase of the Operational Resilience Planning Methodology

Introduction

Operational resilience does not begin with scenario testing or the development of additional continuity plans.

It begins by establishing a clear organisational foundation for determining what MBSB seeks to make resilient, why resilience matters, what level of resilience is required, who is accountable, and how improvements will be prioritised.

This foundation is established through the Plan Phase of MBSB's Operational Resilience Planning Methodology.

For a financial institution such as MBSB, this planning foundation is increasingly important. Financial services have become more dependent on interconnected technology, digital channels, telecommunications infrastructure, external service providers and shared financial ecosystems.

Bank Negara Malaysia (BNM), in its 2025 Discussion Paper on Operational Resilience, observes that rapid digitalisation, cyber threats, deeper third-party dependencies and more frequent and severe disruptions are changing the resilience environment for Malaysian financial institutions.

BNM consequently points towards a more forward-looking, resilience-oriented approach focused on sustaining critical financial services under disruption.

The Plan Phase provides MBSB with a structured way of preparing for this transition. It builds upon capabilities that may already exist across Business Continuity Management (BCM), Operational Risk Management, Risk Management in Technology (RMiT), outsourcing and third-party risk management, corporate governance and related disciplines.

This is consistent with BNM's position that operational resilience should not displace existing requirements but should provide greater structure and coherence around the outcome of maintaining critical operations and services.

MBSB's Plan Phase consists of five stages:

Together, these stages establish the management foundation upon which the subsequent Implement and Sustain phases can operate.

The purpose of this chapter is to prepare the reader to understand how MBSB can establish the foundation for its operational resilience programme before proceeding to detailed implementation.

This distinction is important. An organisation may possess mature BCM plans, disaster recovery capabilities, operational risk controls and incident management arrangements without necessarily having an integrated operational resilience capability.

Operational resilience requires these existing capabilities to be viewed collectively from the perspective of maintaining critical business services and limiting the harm caused by disruption.

BNM reflects this broader perspective by describing operational resilience as the ability of critical operations and services to withstand disruption within acceptable and tolerable levels under severe but plausible scenarios.

BNM also identifies strong governance, effective operational risk management, robust business continuity arrangements and active management of internal and external dependencies as important foundations for achieving this outcome.

By the end of this chapter, the reader should be able to:

• explain the purpose of the Plan Phase;
• understand the five stages within the Plan Phase and how they are connected;
• determine how MBSB could assess its existing operational resilience capabilities;
• understand how identified weaknesses are converted into improvement priorities;
• recognise the role of strategy and roadmap development in implementing operational resilience;
• understand the relationship between risk appetite and operational resilience; and
• recognise the importance of governance, accountability and Senior Management oversight.

The intended outcome is that MBSB enters the Implement Phase with a clear understanding of its current position, target state, improvement priorities, risk boundaries and governance arrangements.

The Plan Phase

The Plan Phase establishes the organisational conditions necessary to implement operational resilience systematically.

The five stages should not be treated as five unrelated activities. Each stage produces information or decisions needed by the next.

• Stage 1 – Assess Capability and Maturity establishes where MBSB currently stands.

• Stage 2 – Analyse Gap determines what needs to improve.

• Stage 3 – Develop Strategy and Roadmap establishes how MBSB will close those gaps.

• Stage 4 – Confirm Risk Appetite establishes the boundaries within which resilience decisions should be made.

• Stage 5 – Develop and Embed Governance establishes accountability for implementing, overseeing and sustaining those decisions.

The relationship can therefore be expressed as:This progression is particularly relevant in the Malaysian regulatory environment because BNM notes that financial institutions already operate under complementary requirements covering BCM, RMiT, Outsourcing, Operational Risk, Responsibility Mapping, Risk Governance and Corporate Governance.

The operational resilience challenge is therefore not necessarily to build every capability from the beginning, but to determine whether existing capabilities collectively enable MBSB to withstand disruption to its critical services.

Stage 1: Assess Capability and Maturity

[Plan Phase – Stage 1]

Establishing MBSB's Current Position

The first stage is to determine MBSB's current level of operational resilience capability and maturity.

Before designing new controls, policies or organisational structures, MBSB should understand what already exists and how effectively existing capabilities contribute to operational resilience.

The assessment should consider capabilities across areas such as:

• Business Continuity Management;
• operational risk management;
• technology resilience and disaster recovery;
• cybersecurity;
• incident and crisis management;
• third-party and outsourcing risk;
• data management;
• facilities resilience;
• governance and accountability;
• scenario testing and exercising; and
• organisational culture and awareness.

The assessment should go beyond determining whether policies and procedures exist. MBSB should examine whether these capabilities are integrated, consistently implemented and capable of supporting the continuity of critical business services during severe disruption.

BNM's Discussion Paper reinforces this approach. It notes that Malaysia's existing regulatory framework already contains elements relevant to operational resilience, including requirements for critical business functions, recovery objectives, technology availability, dependency management, outsourcing controls and governance.

BNM suggests that financial institutions should assess the extent to which these elements have been implemented and strengthen practices where necessary.

Example for MBSB

MBSB may have established BCM programmes, Business Impact Analyses (BIAs), Recovery Time Objectives (RTOs), technology disaster-recovery arrangements, and outsourcing controls.

The maturity assessment could examine whether these capabilities provide management with an end-to-end service perspective.

For example, MBSB might determine that individual business units have well-developed continuity plans and technology teams maintain established recovery arrangements.

However, the organisation may have limited ability to aggregate this information to determine whether a complete customer banking service can remain available during simultaneous business, technology, and third-party disruptions.

The assessment may therefore conclude that MBSB possesses several mature resilience components but requires stronger integration between them.

This distinction prevents the organisation from unnecessarily rebuilding capabilities that already exist.

Stage 2: Analyse Gap

[Plan Phase – Stage 2]

Determining What Needs to Change

Once MBSB understands its current capability, it can determine the difference between its current state and its desired operational resilience state.

Gap analysis should be evidence-based and should build directly upon the capability and maturity assessment.

Potential gaps may include:

• critical business services have not been formally identified;
• resilience information remains organised primarily around departments or business functions;
• dependencies are documented separately across BCM, technology and outsourcing programmes;
• third-party dependencies are not sufficiently visible end-to-end;
• service-level impact tolerances have not been established;
• scenario testing focuses predominantly on isolated failures;
• governance responsibilities are fragmented;
• resilience information is not consolidated for Senior Management; or
• lessons from incidents and exercises are not consistently incorporated into improvement programmes.

BNM highlights many of these areas in its emerging direction on operational resilience.

In particular, it identifies the preservation of critical services, the mapping of internal and external interdependencies, the management of third-party dependencies, tolerance for disruption, and assessment against severe but plausible scenarios as foundational capabilities.

Example for MBSB

Suppose MBSB's maturity assessment identifies strong BCM and technology recovery arrangements.

However, the gap analysis determines that:

• RTOs are primarily established at individual application or business-function level;
• dependencies are recorded in separate repositories;
• customer impact is not consistently used to determine tolerable disruption; and
• scenario exercises generally test individual systems or business units rather than end-to-end critical business services.

MBSB should not interpret this as a failure of its existing BCM or technology resilience programmes.

Instead, the gap represents the additional integration required to move from function-based recovery towards service-based operational resilience.

The output of this stage should therefore be a prioritised register of resilience gaps, supported by their business significance, risk implications and proposed improvement actions.

Stage 3: Develop Strategy and Roadmap

[Plan Phase – Stage 3]

Moving from Gaps to Action

Identifying weaknesses does not by itself improve resilience. MBSB must determine how identified gaps will be addressed systematically.

The Operational Resilience Strategy should establish the organisation's intended resilience direction and desired outcomes.

The Operational Resilience Roadmap should translate that strategy into a sequenced set of implementation initiatives.

The strategy should address questions such as:

• What does operational resilience mean for MBSB?

• What outcomes does MBSB intend to achieve?

• How will operational resilience complement existing BCM, operational risk, technology risk and third-party risk arrangements?

• Which capabilities require priority improvement?

• What resources and governance arrangements will be required?

The roadmap should then define the implementation sequence, responsibilities, milestones, dependencies and expected deliverables.

Example for MBSB

Based on its gap analysis, MBSB could establish a phased roadmap.

An initial implementation period might focus on:

Foundation

• establishing governance;
• defining the operational resilience framework;
• identifying candidate critical business services; and
• assigning service ownership.

A subsequent period could focus on:

Implementation

• mapping processes and resources;
• identifying internal and external dependencies;
• establishing impact tolerances; and
• conducting severe-but-plausible scenario testing.

A later period could focus on:

Embedding and Improvement

• remediating identified vulnerabilities;
• integrating operational resilience into change management;
• strengthening training and awareness;
• implementing self-assessment; and
• introducing independent quality review.

This allows MBSB to progress systematically rather than attempting to implement all elements simultaneously.

The roadmap should also remain adaptable.

BNM stresses that operational resilience is a continuous journey requiring periodic review, updated testing, and improvements to processes, architecture, and governance as the operating and threat environments change.

Stage 4: Confirm Risk Appetite

[Plan Phase – Stage 4]

Establishing MBSB's Risk Boundaries

Operational resilience should be integrated with MBSB's wider risk management framework rather than operate independently from it.

Risk appetite establishes the nature and level of risk that MBSB is prepared to accept in pursuing its strategic and business objectives. For operational resilience, this provides an important management boundary for decisions concerning disruption, recovery, investment and remediation.

MBSB should therefore consider whether its existing risk appetite adequately addresses risks associated with the prolonged unavailability of critical business services.

This does not mean that risk appetite and impact tolerance are interchangeable.

Risk appetite expresses MBSB's broader willingness to accept operational risk.

Impact tolerance, developed during the Implement Phase, establishes the maximum disruption to a particular critical business service before the resulting harm becomes unacceptable.

Risk appetite therefore provides the strategic boundary within which service-level impact tolerances are subsequently established.

BNM notes that existing BCM requirements link business continuity objectives, such as Maximum Tolerable Downtime (MTD) and RTO, to financial institutions' risk appetite.

Its discussion of operational resilience extends the focus to the external consequences of disruption, particularly harm to customers and other stakeholders.

Example for MBSB

MBSB may determine that it has a very low appetite for prolonged disruption to services that enable customers to access funds or perform essential financial transactions.

This risk position could influence decisions concerning:

• system availability;
• infrastructure redundancy;
• cyber controls;
• disaster recovery capabilities;
• third-party arrangements;
• alternative processing capabilities; and
• investment priorities.

If scenario testing subsequently shows that a critical customer service could remain unavailable beyond the level MBSB considers acceptable, the issue should not be treated merely as a technical recovery deficiency.

It represents a resilience exposure that should be evaluated against MBSB's approved risk appetite and escalated through the appropriate governance structure.

Stage 5: Develop and Embed Governance

[Plan Phase – Stage 5]

Establishing Accountability for Operational Resilience

The final stage of the Plan Phase is to establish governance and embed operational resilience into MBSB's management arrangements.

Operational resilience crosses traditional organisational boundaries. A critical business service may depend simultaneously upon business operations, technology, cybersecurity, data, facilities, external providers, BCM and risk management.

Consequently, accountability cannot reside exclusively within one specialist function.

BNM places particular emphasis on this issue. Its Discussion Paper identifies strong Board oversight and timely decision-making, achieved through cross-functional and integrated arrangements, as important characteristics of resilient financial institutions.

It also states that Boards and Senior Management should take clear ownership by ensuring that critical operations and services are understood, adequately resourced and supported by robust oversight across technology, operations and risk functions.

MBSB's governance arrangements should therefore establish:

• Board and Senior Management oversight;
• executive accountability;
• ownership of critical business services;
• roles of business and support functions;
• responsibilities of Risk, BCM, Technology and other control functions;
• escalation thresholds;
• reporting requirements;
• approval authorities; and
• mechanisms for monitoring remediation.

Example for MBSB

MBSB could establish governance in which each identified critical business service has a designated senior owner.

The service owner would not necessarily control every resource supporting the service. Instead, the owner would be accountable for ensuring that the service's resilience position is understood across all relevant dependencies.

For example, a critical banking service might depend upon:

The service owner would work across these areas to ensure that vulnerabilities, impact tolerances, testing outcomes and remediation actions are appropriately managed.

Senior Management could receive an operational resilience dashboard covering matters such as:

• status of critical business services;
• significant resilience vulnerabilities;
• breaches or near-breaches of tolerance;
• scenario-testing results;
• major third-party dependencies;
• overdue remediation actions; and
• emerging resilience risks.

The Board or relevant Board committee would then have sufficient information to provide effective oversight and challenge.

Governance is therefore not simply the final administrative step in the Plan Phase. It is the mechanism that ensures that all subsequent operational resilience activities have clear ownership and accountability.

How the Five Plan Stages Work Together

The effectiveness of the Plan Phase stems from the relationships among its five stages.

The stages should therefore operate as a logical sequence.

Assessment without gap analysis identifies maturity but does not establish what should change.

Gap analysis without a roadmap identifies weaknesses but does not create an implementation path.

A roadmap without risk appetite may result in investment priorities that are disconnected from MBSB's risk position.

Risk appetite without governance establishes boundaries without ensuring that anyone is accountable for operating within them.

Together, the five stages translate operational resilience from a broad organisational objective into a structured, governable programme.

Preparing MBSB for the Implement Phase

Completion of the Plan Phase should leave MBSB with more than a policy statement.

Before proceeding to implementation, MBSB should have sufficient clarity concerning:

• Current capability – the organisation understands the maturity of its existing resilience arrangements.

• Capability gaps – weaknesses and areas requiring integration or enhancement have been identified and prioritised.

• Strategic direction – MBSB has established what operational resilience should achieve.

• Implementation roadmap – initiatives, milestones, responsibilities and dependencies have been defined.

• Risk boundaries – resilience decisions can be considered within MBSB's established risk appetite.

• Governance – ownership, oversight, challenge and escalation arrangements have been established.

These foundations position MBSB to move into the Implement Phase, where the emphasis shifts from organisational preparation towards the resilience of individual critical business services.

The subsequent activities will require MBSB to identify those services, understand their end-to-end dependencies, establish impact tolerances, test them against severe but plausible scenarios and address weaknesses revealed through testing.

This progression reflects BNM's emerging direction.

The Discussion Paper identifies the preservation of critical services, mapping of interdependencies, management of third-party dependencies, establishment of disruption tolerances and assessment under severe-but-plausible scenarios as central operational resilience capabilities.

The Plan Phase establishes the foundation for MBSB's operational resilience capability.

Through Assess Capability and Maturity, MBSB determines the strength of its existing arrangements.

Analyse Gap identifies where additional capability or integration is required. Develop Strategy and Roadmap converts those gaps into an organised improvement programme.

Confirm Risk Appetite ensures that resilience decisions remain aligned with MBSB's broader approach to risk. Finally, Develop and Embed Governance establishes the accountability, oversight and decision-making arrangements required to drive implementation.

The significance of this phase is that MBSB need not approach operational resilience as an entirely separate management discipline.

BNM's 2025 Discussion Paper recognises that Malaysian financial institutions already possess important foundations in BCM, technology risk management, operational risk, outsourcing, third-party management, and established governance requirements.

The emerging challenge is to organise and strengthen these capabilities to maintain critical services during disruptions.

For MBSB, the Plan Phase therefore provides the bridge between existing resilience capabilities and an integrated operational resilience framework.

With that foundation established, MBSB can progress to the Implement Phase with a clearer understanding of what needs to be protected, what improvements are required, what risks are acceptable, and who is accountable for achieving resilience.

Blogs marked [x] are under construction

C1	C2	C8	C14

"Plan" Phase of the Operational Resilience Planning Methodology
C2 [x]	C3 [x]	C4 [x]	C5 [x]	C6 [x]	C7 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.