Operational resilience does not begin with scenario testing or the development of additional continuity plans.
It begins by establishing a clear organisational foundation for determining what MBSB seeks to make resilient, why resilience matters, what level of resilience is required, who is accountable, and how improvements will be prioritised.
This foundation is established through the Plan Phase of MBSB's Operational Resilience Planning Methodology.
For a financial institution such as MBSB, this planning foundation is increasingly important. Financial services have become more dependent on interconnected technology, digital channels, telecommunications infrastructure, external service providers and shared financial ecosystems.
Bank Negara Malaysia (BNM), in its 2025 Discussion Paper on Operational Resilience, observes that rapid digitalisation, cyber threats, deeper third-party dependencies and more frequent and severe disruptions are changing the resilience environment for Malaysian financial institutions.
BNM consequently points towards a more forward-looking, resilience-oriented approach focused on sustaining critical financial services under disruption.
The Plan Phase provides MBSB with a structured way of preparing for this transition. It builds upon capabilities that may already exist across Business Continuity Management (BCM), Operational Risk Management, Risk Management in Technology (RMiT), outsourcing and third-party risk management, corporate governance and related disciplines.
This is consistent with BNM's position that operational resilience should not displace existing requirements but should provide greater structure and coherence around the outcome of maintaining critical operations and services.
MBSB's Plan Phase consists of five stages:
Together, these stages establish the management foundation upon which the subsequent Implement and Sustain phases can operate.
The purpose of this chapter is to prepare the reader to understand how MBSB can establish the foundation for its operational resilience programme before proceeding to detailed implementation.
This distinction is important. An organisation may possess mature BCM plans, disaster recovery capabilities, operational risk controls and incident management arrangements without necessarily having an integrated operational resilience capability.
Operational resilience requires these existing capabilities to be viewed collectively from the perspective of maintaining critical business services and limiting the harm caused by disruption.
BNM reflects this broader perspective by describing operational resilience as the ability of critical operations and services to withstand disruption within acceptable and tolerable levels under severe but plausible scenarios.
BNM also identifies strong governance, effective operational risk management, robust business continuity arrangements and active management of internal and external dependencies as important foundations for achieving this outcome.
By the end of this chapter, the reader should be able to:
The intended outcome is that MBSB enters the Implement Phase with a clear understanding of its current position, target state, improvement priorities, risk boundaries and governance arrangements.
The Plan Phase establishes the organisational conditions necessary to implement operational resilience systematically.
The five stages should not be treated as five unrelated activities. Each stage produces information or decisions needed by the next.
Stage 1 – Assess Capability and Maturity establishes where MBSB currently stands.
Stage 2 – Analyse Gap determines what needs to improve.
Stage 3 – Develop Strategy and Roadmap establishes how MBSB will close those gaps.
Stage 4 – Confirm Risk Appetite establishes the boundaries within which resilience decisions should be made.
Stage 5 – Develop and Embed Governance establishes accountability for implementing, overseeing and sustaining those decisions.
The relationship can therefore be expressed as:
The operational resilience challenge is therefore not necessarily to build every capability from the beginning, but to determine whether existing capabilities collectively enable MBSB to withstand disruption to its critical services.
The first stage is to determine MBSB's current level of operational resilience capability and maturity.
Before designing new controls, policies or organisational structures, MBSB should understand what already exists and how effectively existing capabilities contribute to operational resilience.
The assessment should consider capabilities across areas such as:
The assessment should go beyond determining whether policies and procedures exist. MBSB should examine whether these capabilities are integrated, consistently implemented and capable of supporting the continuity of critical business services during severe disruption.
BNM's Discussion Paper reinforces this approach. It notes that Malaysia's existing regulatory framework already contains elements relevant to operational resilience, including requirements for critical business functions, recovery objectives, technology availability, dependency management, outsourcing controls and governance.
BNM suggests that financial institutions should assess the extent to which these elements have been implemented and strengthen practices where necessary.
MBSB may have established BCM programmes, Business Impact Analyses (BIAs), Recovery Time Objectives (RTOs), technology disaster-recovery arrangements, and outsourcing controls.
The maturity assessment could examine whether these capabilities provide management with an end-to-end service perspective.
For example, MBSB might determine that individual business units have well-developed continuity plans and technology teams maintain established recovery arrangements.
However, the organisation may have limited ability to aggregate this information to determine whether a complete customer banking service can remain available during simultaneous business, technology, and third-party disruptions.
The assessment may therefore conclude that MBSB possesses several mature resilience components but requires stronger integration between them.
This distinction prevents the organisation from unnecessarily rebuilding capabilities that already exist.
Once MBSB understands its current capability, it can determine the difference between its current state and its desired operational resilience state.
Gap analysis should be evidence-based and should build directly upon the capability and maturity assessment.
Potential gaps may include:
BNM highlights many of these areas in its emerging direction on operational resilience.
In particular, it identifies the preservation of critical services, the mapping of internal and external interdependencies, the management of third-party dependencies, tolerance for disruption, and assessment against severe but plausible scenarios as foundational capabilities.
Suppose MBSB's maturity assessment identifies strong BCM and technology recovery arrangements.
However, the gap analysis determines that:
MBSB should not interpret this as a failure of its existing BCM or technology resilience programmes.
Instead, the gap represents the additional integration required to move from function-based recovery towards service-based operational resilience.
The output of this stage should therefore be a prioritised register of resilience gaps, supported by their business significance, risk implications and proposed improvement actions.
Identifying weaknesses does not by itself improve resilience. MBSB must determine how identified gaps will be addressed systematically.
The Operational Resilience Strategy should establish the organisation's intended resilience direction and desired outcomes.
The Operational Resilience Roadmap should translate that strategy into a sequenced set of implementation initiatives.
The strategy should address questions such as:
What does operational resilience mean for MBSB?
What outcomes does MBSB intend to achieve?
How will operational resilience complement existing BCM, operational risk, technology risk and third-party risk arrangements?
Which capabilities require priority improvement?
What resources and governance arrangements will be required?
The roadmap should then define the implementation sequence, responsibilities, milestones, dependencies and expected deliverables.
Based on its gap analysis, MBSB could establish a phased roadmap.
An initial implementation period might focus on:
A subsequent period could focus on:
A later period could focus on:
This allows MBSB to progress systematically rather than attempting to implement all elements simultaneously.
The roadmap should also remain adaptable.
BNM stresses that operational resilience is a continuous journey requiring periodic review, updated testing, and improvements to processes, architecture, and governance as the operating and threat environments change.
Operational resilience should be integrated with MBSB's wider risk management framework rather than operate independently from it.
Risk appetite establishes the nature and level of risk that MBSB is prepared to accept in pursuing its strategic and business objectives. For operational resilience, this provides an important management boundary for decisions concerning disruption, recovery, investment and remediation.
MBSB should therefore consider whether its existing risk appetite adequately addresses risks associated with the prolonged unavailability of critical business services.
This does not mean that risk appetite and impact tolerance are interchangeable.
Risk appetite expresses MBSB's broader willingness to accept operational risk.
Impact tolerance, developed during the Implement Phase, establishes the maximum disruption to a particular critical business service before the resulting harm becomes unacceptable.
Risk appetite therefore provides the strategic boundary within which service-level impact tolerances are subsequently established.
BNM notes that existing BCM requirements link business continuity objectives, such as Maximum Tolerable Downtime (MTD) and RTO, to financial institutions' risk appetite.
Its discussion of operational resilience extends the focus to the external consequences of disruption, particularly harm to customers and other stakeholders.
MBSB may determine that it has a very low appetite for prolonged disruption to services that enable customers to access funds or perform essential financial transactions.
This risk position could influence decisions concerning:
If scenario testing subsequently shows that a critical customer service could remain unavailable beyond the level MBSB considers acceptable, the issue should not be treated merely as a technical recovery deficiency.
It represents a resilience exposure that should be evaluated against MBSB's approved risk appetite and escalated through the appropriate governance structure.
The final stage of the Plan Phase is to establish governance and embed operational resilience into MBSB's management arrangements.
Operational resilience crosses traditional organisational boundaries. A critical business service may depend simultaneously upon business operations, technology, cybersecurity, data, facilities, external providers, BCM and risk management.
Consequently, accountability cannot reside exclusively within one specialist function.
BNM places particular emphasis on this issue. Its Discussion Paper identifies strong Board oversight and timely decision-making, achieved through cross-functional and integrated arrangements, as important characteristics of resilient financial institutions.
It also states that Boards and Senior Management should take clear ownership by ensuring that critical operations and services are understood, adequately resourced and supported by robust oversight across technology, operations and risk functions.
MBSB's governance arrangements should therefore establish:
MBSB could establish governance in which each identified critical business service has a designated senior owner.
The service owner would not necessarily control every resource supporting the service. Instead, the owner would be accountable for ensuring that the service's resilience position is understood across all relevant dependencies.
For example, a critical banking service might depend upon:
The service owner would work across these areas to ensure that vulnerabilities, impact tolerances, testing outcomes and remediation actions are appropriately managed.
Senior Management could receive an operational resilience dashboard covering matters such as:
The Board or relevant Board committee would then have sufficient information to provide effective oversight and challenge.
Governance is therefore not simply the final administrative step in the Plan Phase. It is the mechanism that ensures that all subsequent operational resilience activities have clear ownership and accountability.
The effectiveness of the Plan Phase stems from the relationships among its five stages.
|
Plan Stage |
Key Question for MBSB |
Principal Outcome |
|
1. Assess Capability and Maturity |
Where are we now? |
Current-state maturity |
|
2. Analyse Gap |
What is missing or inadequate? |
Prioritised resilience gaps |
|
3. Develop Strategy and Roadmap |
How will we improve? |
Strategic direction and implementation roadmap |
|
4. Confirm Risk Appetite |
What level of risk are we prepared to accept? |
Resilience risk boundaries |
|
5. Develop and Embed Governance |
Who owns, oversees and challenges resilience? |
Accountability and oversight |
The stages should therefore operate as a logical sequence.
Assessment without gap analysis identifies maturity but does not establish what should change.
Gap analysis without a roadmap identifies weaknesses but does not create an implementation path.
A roadmap without risk appetite may result in investment priorities that are disconnected from MBSB's risk position.
Risk appetite without governance establishes boundaries without ensuring that anyone is accountable for operating within them.
Together, the five stages translate operational resilience from a broad organisational objective into a structured, governable programme.
Completion of the Plan Phase should leave MBSB with more than a policy statement.
Before proceeding to implementation, MBSB should have sufficient clarity concerning:
Current capability – the organisation understands the maturity of its existing resilience arrangements.
Capability gaps – weaknesses and areas requiring integration or enhancement have been identified and prioritised.
Strategic direction – MBSB has established what operational resilience should achieve.
Implementation roadmap – initiatives, milestones, responsibilities and dependencies have been defined.
Risk boundaries – resilience decisions can be considered within MBSB's established risk appetite.
Governance – ownership, oversight, challenge and escalation arrangements have been established.
These foundations position MBSB to move into the Implement Phase, where the emphasis shifts from organisational preparation towards the resilience of individual critical business services.
The subsequent activities will require MBSB to identify those services, understand their end-to-end dependencies, establish impact tolerances, test them against severe but plausible scenarios and address weaknesses revealed through testing.
This progression reflects BNM's emerging direction.
The Discussion Paper identifies the preservation of critical services, mapping of interdependencies, management of third-party dependencies, establishment of disruption tolerances and assessment under severe-but-plausible scenarios as central operational resilience capabilities.
The Plan Phase establishes the foundation for MBSB's operational resilience capability.
Through Assess Capability and Maturity, MBSB determines the strength of its existing arrangements.
Analyse Gap identifies where additional capability or integration is required. Develop Strategy and Roadmap converts those gaps into an organised improvement programme.
Confirm Risk Appetite ensures that resilience decisions remain aligned with MBSB's broader approach to risk. Finally, Develop and Embed Governance establishes the accountability, oversight and decision-making arrangements required to drive implementation.
The significance of this phase is that MBSB need not approach operational resilience as an entirely separate management discipline.
BNM's 2025 Discussion Paper recognises that Malaysian financial institutions already possess important foundations in BCM, technology risk management, operational risk, outsourcing, third-party management, and established governance requirements.
The emerging challenge is to organise and strengthen these capabilities to maintain critical services during disruptions.
For MBSB, the Plan Phase therefore provides the bridge between existing resilience capabilities and an integrated operational resilience framework.
With that foundation established, MBSB can progress to the Implement Phase with a clearer understanding of what needs to be protected, what improvements are required, what risks are acceptable, and who is accountable for achieving resilience.
Blogs marked [x] are under construction
| C1 | C2 | C8 | C14 | |||
| "Plan" Phase of the Operational Resilience Planning Methodology | |||||
| C2 [x] | C3 [x] | C4 [x] | C5 [x] | C6 [x] | C7 [x] |
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|