[OR] [MBSB] [E2] [P1] [C2] Five Stages of the "Plan" Phase

eBook 2: Chapter 2

MBSB’s Plan Phase of the Operational Resilience Planning Methodology

Introduction

Operational resilience does not begin with scenario testing or developing additional continuity plans.

It begins by establishing a clear organisational foundation for determining what MBSB seeks to make resilient, why resilience matters, what level of resilience is required, who is accountable, and how improvements will be prioritised.

MBSB establishes this foundation through the Plan Phase of its Operational Resilience Planning Methodology.

For a financial institution such as MBSB, this planning foundation is increasingly important. Financial services have become more dependent on interconnected technology, digital channels, telecommunications infrastructure, external service providers and shared financial ecosystems.

Bank Negara Malaysia (BNM), in its 2025 Discussion Paper on Operational Resilience, observes that rapid digitalisation, cyber threats, deeper third-party dependencies and more frequent and severe disruptions are changing the resilience environment for Malaysian financial institutions.

BNM therefore points to a more forward-looking, resilience-oriented approach focused on sustaining critical financial services during disruption.

The Plan Phase gives MBSB a structured way to prepare for this transition. It builds upon capabilities that may already exist across Business Continuity Management (BCM), Operational Risk Management, Risk Management in Technology (RMiT), outsourcing and third-party risk management, corporate governance and related disciplines.

This aligns with BNM's position that operational resilience should not replace existing requirements but should provide greater structure and coherence around maintaining critical operations and services.

MBSB's Plan Phase consists of five stages:

Together, these stages establish the management foundation upon which the subsequent Implement and Sustain phases can operate.

This chapter prepares the reader to understand how MBSB can build the foundation for its operational resilience programme before moving into detailed implementation.

This distinction is important. An organisation may possess mature BCM plans, disaster recovery capabilities, operational risk controls and incident management arrangements without necessarily having an integrated operational resilience capability.

Operational resilience requires viewing these capabilities collectively to maintain critical business services and limit disruption-related harm.

BNM reflects this broader perspective by describing operational resilience as the ability of critical operations and services to withstand disruption within acceptable and tolerable levels under severe but plausible scenarios.

BNM also identifies strong governance, effective operational risk management, robust business continuity arrangements and active management of internal and external dependencies as important foundations for achieving this outcome.

By the end of this chapter, the reader should be able to:

• explain the purpose of the Plan Phase;
• understand the five stages within the Plan Phase and how they are connected;
• determine how MBSB could assess its existing operational resilience capabilities;
• understand how identified weaknesses are converted into improvement priorities;
• recognise the role of strategy and roadmap development in implementing operational resilience;
• understand the relationship between risk appetite and operational resilience; and
• recognise the importance of governance, accountability and Senior Management oversight.

The intended outcome is that MBSB enters the Implement Phase with a clear understanding of its current position, target state, improvement priorities, risk boundaries and governance arrangements.

The Plan Phase

The Plan Phase establishes the organisational conditions necessary to implement operational resilience systematically.

Do not treat the five stages as five unrelated activities. Each stage produces the information or decisions the next stage needs.

• Stage 1 – Assess Capability and Maturity establishes where MBSB currently stands.

• Stage 2 – Analyse Gap determines what needs to improve.

• Stage 3 – Develop Strategy and Roadmap establishes how MBSB will close those gaps.

• Stage 4 – Confirm Risk Appetite establishes the boundaries within which MBSB should make resilience decisions.

• Stage 5 – Develop and Embed Governance establishes accountability for implementing, overseeing and sustaining those decisions.

The relationship can therefore be expressed as: This progression is particularly relevant in the Malaysian regulatory environment because BNM notes that financial institutions already operate under complementary requirements covering BCM, RMiT, Outsourcing, Operational Risk, Responsibility Mapping, Risk Governance and Corporate Governance.

The operational resilience challenge is therefore not necessarily to build every capability from scratch, but to determine whether existing capabilities collectively enable MBSB to withstand disruptions to its critical services.

[Plan Phase – Stage 1]

Establishing MBSB's Current Position

The first stage is to determine MBSB's current level of operational resilience capability and maturity.

Before designing new controls, policies or organisational structures, MBSB should understand what already exists and how effectively existing capabilities contribute to operational resilience.

The assessment should consider capabilities across areas such as:

• Business Continuity Management;
• operational risk management;
• technology resilience and disaster recovery;
• cybersecurity;
• incident and crisis management;
• third-party and outsourcing risk;
• data management;
• facilities resilience;
• governance and accountability;
• scenario testing and exercising; and
• organisational culture and awareness.

The assessment should go beyond determining whether policies and procedures exist. MBSB should examine whether these capabilities are integrated, consistently implemented, and able to support the continuity of critical business services during severe disruption.

BNM's Discussion Paper reinforces this approach. It notes that Malaysia's existing regulatory framework already contains elements relevant to operational resilience, including requirements for critical business functions, recovery objectives, technology availability, dependency management, outsourcing controls and governance.

BNM suggests that financial institutions assess how far they have implemented these elements and strengthen practices where needed.

Example for MBSB

MBSB may have established BCM programmes, Business Impact Analyses (BIAs), Recovery Time Objectives (RTOs), technology disaster-recovery arrangements, and outsourcing controls.

The maturity assessment could examine whether these capabilities provide management with an end-to-end service perspective.

For example, MBSB might determine that individual business units have well-developed continuity plans and technology teams maintain established recovery arrangements.

However, the organisation may have limited ability to aggregate this information to determine whether a complete customer banking service can remain available during simultaneous business, technology, and third-party disruptions.

The assessment may therefore conclude that MBSB possesses several mature resilience components but requires stronger integration between them.

This distinction prevents the organisation from unnecessarily rebuilding capabilities that already exist.

[Plan Phase – Stage 2]

Determining What Needs to Change

Once MBSB understands its current capability, it can determine the difference between its current state and its desired operational resilience state.

Gap analysis should be evidence-based and should build directly upon the capability and maturity assessment.

Potential gaps may include:

• critical business services have not been formally identified;
• resilience information remains organised primarily around departments or business functions;
• dependencies are documented separately across BCM, technology and outsourcing programmes;
• third-party dependencies are not sufficiently visible end-to-end;
• service-level impact tolerances have not been established;
• scenario testing focuses predominantly on isolated failures;
• governance responsibilities are fragmented;
• resilience information is not consolidated for Senior Management; or
• lessons from incidents and exercises are not consistently incorporated into improvement programmes.

BNM highlights many of these areas in its emerging direction on operational resilience.

In particular, it identifies preserving critical services, mapping internal and external interdependencies, managing third-party dependencies, tolerating disruption, and assessing against severe but plausible scenarios as foundational capabilities.

Example for MBSB

Suppose MBSB's maturity assessment identifies strong BCM and technology recovery arrangements.

However, the gap analysis determines that:

• RTOs are primarily established at individual application or business-function level;
• dependencies are recorded in separate repositories;
• customer impact is not consistently used to determine tolerable disruption; and
• scenario exercises generally test individual systems or business units rather than end-to-end critical business services.

MBSB should not interpret this as a failure of its existing BCM or technology resilience programmes.

Instead, the gap reflects the additional integration needed to move from function-based recovery to service-based operational resilience.

The output of this stage should therefore be a prioritised register of resilience gaps, supported by their business significance, risk implications and proposed improvement actions.

[Plan Phase – Stage 3]

Moving from Gaps to Action

Identifying weaknesses alone does not improve resilience.

MBSB must determine how it will address identified gaps systematically.

The Operational Resilience Strategy should establish the organisation's intended resilience direction and desired outcomes.

The Operational Resilience Roadmap should translate that strategy into a sequenced set of implementation initiatives.

The strategy should address questions such as:

• What does operational resilience mean for MBSB?

• What outcomes does MBSB intend to achieve?

• How will operational resilience complement existing BCM, operational risk, technology risk and third-party risk arrangements?

• Which capabilities require priority improvement?

• What resources and governance arrangements will be required?

The roadmap should then define the implementation sequence, responsibilities, milestones, dependencies and expected deliverables.

Example for MBSB

Based on its gap analysis, MBSB could establish a phased roadmap.

An initial implementation period might focus on:

Foundation

• establishing governance;
• defining the operational resilience framework;
• identifying candidate critical business services; and
• assigning service ownership.

A subsequent period could focus on:

Implementation

• mapping processes and resources;
• identifying internal and external dependencies;
• establishing impact tolerances; and
• conducting severe-but-plausible scenario testing.

A later period could focus on:

Embedding and Improvement

• remediating identified vulnerabilities;
• integrating operational resilience into change management;
• strengthening training and awareness;
• implementing self-assessment; and
• introducing independent quality review.

This allows MBSB to progress systematically rather than trying to implement all elements at once.

The roadmap should also remain adaptable.

BNM stresses that operational resilience is a continuous journey that requires periodic review, updated testing, and improvements to processes, architecture, and governance as operating and threat environments change.

[Plan Phase – Stage 4]

Establishing MBSB's Risk Boundaries

Operational resilience should integrate with MBSB's wider risk management framework rather than operate independently.

Risk appetite establishes the nature and level of risk that MBSB is prepared to accept in pursuing its strategic and business objectives. For operational resilience, this provides an important management boundary for decisions concerning disruption, recovery, investment and remediation.

MBSB should therefore consider whether its existing risk appetite adequately addresses risks associated with the prolonged unavailability of critical business services.

This does not mean that risk appetite and impact tolerance are interchangeable.

Risk appetite expresses MBSB's broader willingness to accept operational risk.

Impact tolerance, developed during the Implement Phase, establishes the maximum disruption to a particular critical business service before the resulting harm becomes unacceptable.

Risk appetite therefore provides the strategic boundary within which service-level impact tolerances are subsequently established.

BNM notes that existing BCM requirements link business continuity objectives, such as Maximum Tolerable Downtime (MTD) and RTO, to financial institutions' risk appetite.

Its discussion of operational resilience extends the focus to the external consequences of disruption, particularly harm to customers and other stakeholders.

Example for MBSB

MBSB may determine that it has a very low appetite for prolonged disruption to services that enable customers to access funds or perform essential financial transactions.

This risk position could influence decisions concerning:

• system availability;
• infrastructure redundancy;
• cyber controls;
• disaster recovery capabilities;
• third-party arrangements;
• alternative processing capabilities; and
• investment priorities.

If scenario testing shows that a critical customer service could remain unavailable beyond the level MBSB considers acceptable, do not treat the issue merely as a technical recovery deficiency.

It represents a resilience exposure that should be evaluated against MBSB's approved risk appetite and escalated through the appropriate governance structure.

[Plan Phase – Stage 5]

Establishing Accountability for Operational Resilience

The final stage of the Plan Phase establishes governance and embeds operational resilience into MBSB's management arrangements.

Operational resilience crosses traditional organisational boundaries. A critical business service may depend simultaneously upon business operations, technology, cybersecurity, data, facilities, external providers, BCM and risk management.

Consequently, accountability cannot rest with a single specialist function.

BNM places particular emphasis on this issue.

Its Discussion Paper identifies strong Board oversight and timely decision-making, achieved through cross-functional, integrated arrangements, as key characteristics of resilient financial institutions.

It also states that Boards and Senior Management should take clear ownership by ensuring critical operations and services are understood, adequately resourced, and supported by robust oversight across technology, operations, and risk functions.

MBSB's governance arrangements should therefore establish:

• Board and Senior Management oversight;
• executive accountability;
• ownership of critical business services;
• roles of business and support functions;
• responsibilities of Risk, BCM, Technology and other control functions;
• escalation thresholds;
• reporting requirements;
• approval authorities; and
• mechanisms for monitoring remediation.

Example for MBSB

MBSB could establish governance in which each identified critical business service has a designated senior owner.

The service owner would not necessarily control every resource supporting the service. Instead, the owner would be accountable for ensuring that the service's resilience position is understood across all relevant dependencies.

For example, a critical banking service might depend upon:

The service owner would work across these areas to ensure vulnerabilities, impact tolerances, testing outcomes, and remediation actions are managed appropriately.

Senior Management could receive an operational resilience dashboard covering matters such as:

• status of critical business services;
• significant resilience vulnerabilities;
• breaches or near-breaches of tolerance;
• scenario-testing results;
• major third-party dependencies;
• overdue remediation actions; and
• emerging resilience risks.

The Board or relevant Board committee would then have sufficient information to provide effective oversight and challenge.

Governance is therefore not simply the final administrative step in the Plan Phase.

It ensures all subsequent operational resilience activities have clear ownership and accountability.

How the Five Plan Stages Work Together

The Plan Phase's effectiveness stems from the relationships among its five stages.

The stages should therefore operate as a logical sequence.

Assessment without gap analysis identifies maturity but does not establish what should change.

Gap analysis without a roadmap identifies weaknesses but does not create an implementation path.

A roadmap without risk appetite may produce investment priorities disconnected from MBSB's risk position.

Risk appetite without governance sets boundaries but doesn't ensure anyone is accountable for operating within them.

Together, the five stages translate operational resilience from a broad organisational objective into a structured, governable programme.

Preparing MBSB for the Implement Phase

Completion of the Plan Phase should leave MBSB with more than a policy statement.

Before proceeding to implementation, MBSB should have sufficient clarity concerning:

• Current capability – the organisation understands the maturity of its existing resilience arrangements.

• Capability gaps – the organisation has identified and prioritised weaknesses and areas requiring integration or enhancement.

• Strategic direction – MBSB has established what operational resilience should achieve.

• Implementation roadmap – MBSB has defined initiatives, milestones, responsibilities, and dependencies.

• Risk boundaries – MBSB can consider resilience decisions within its established risk appetite.

• Governance – MBSB has established ownership, oversight, challenge, and escalation arrangements.

These foundations position MBSB to move into the Implement Phase, where the emphasis shifts from organisational preparation towards the resilience of individual critical business services.

The subsequent activities will require MBSB to identify those services, understand their end-to-end dependencies, establish impact tolerances, test them against severe but plausible scenarios and address weaknesses revealed through testing.

This progression reflects BNM's emerging direction.

The Discussion Paper identifies preserving critical services, mapping interdependencies, managing third-party dependencies, establishing disruption tolerances, and assessing severe-but-plausible scenarios as central operational resilience capabilities.

The Plan Phase establishes the foundation for MBSB's operational resilience capability.

Through Assess Capability and Maturity, MBSB determines the strength of its existing arrangements.

Analyse Gap identifies where additional capability or integration is required. Develop Strategy and Roadmap converts those gaps into an organised improvement programme.

Confirm Risk Appetite ensures that resilience decisions remain aligned with MBSB's broader approach to risk. Finally, Develop and Embed Governance establishes the accountability, oversight and decision-making arrangements required to drive implementation.

This phase matters because MBSB need not treat operational resilience as an entirely separate management discipline.

BNM's 2025 Discussion Paper recognises that Malaysian financial institutions already possess important foundations in BCM, technology risk management, operational risk, outsourcing, third-party management, and established governance requirements.

The emerging challenge is to organise and strengthen these capabilities to maintain critical services during disruptions.

For MBSB, the Plan Phase therefore bridges existing resilience capabilities and an integrated operational resilience framework.

With that foundation in place, MBSB can move into the Implement Phase with a clearer understanding of what to protect, what improvements are needed, what risks are acceptable, and who is accountable for achieving resilience.

Blogs marked [x] are under construction

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.