[OR] [MBSB] [E3] [C1] Starting Your OR Implementation

eBook 3: Chapter 1

Setting the Context: From Planning to Execution

Operational resilience moves from concept to reality when an organisation begins applying its framework to the business services that matter most.

Understanding the organisation, establishing an Operational Resilience (OR) Planning Methodology, defining governance arrangements, and identifying Critical Business Services (CBSs) provide the foundation.

The next step is to translate that foundation into practical implementation.

This third and final eBook in the Operational Resilience in Action: The MBSB Approach series focuses on that transition.

Titled Starting Your OR Implementation, this eBook provides a structured approach for MBSB to commence the practical implementation of operational resilience across its identified Critical Business Services.

It brings together the implementation submissions prepared by the respective business units and provides a consistent basis for documenting, reviewing, challenging, and improving the resilience of these services.

The emphasis is practical. Rather than explaining operational resilience only as a concept, the eBook demonstrates how MBSB can progressively develop the information required to understand how its Critical Business Services are delivered, what they depend upon, how much disruption can be tolerated, what could seriously disrupt them, and whether existing resilience arrangements are capable of keeping disruption within acceptable limits.

Building on the Earlier eBooks

Starting Your OR Implementation should be read together with the two preceding eBooks in the series:

• Understanding Your Organisation — establishes the organisational, business, regulatory, governance, and operating context within which operational resilience is implemented at MBSB.

• Implementing OR Planning Methodology — guides applying the Operational Resilience Planning Methodology and establishing the structure required to implement and manage the OR programme.
  
  
• Starting Your OR Implementation — converts that understanding and methodology into practical implementation activities for MBSB's Critical Business Services.

The first two eBooks therefore serve as pre-reading and implementation guidance for this final eBook.

The progression can be viewed simply as:

Understand the Organisation → Establish the OR Methodology → Implement OR for Critical Business Services

This third eBook is where the outputs developed during the earlier stages begin to be translated into detailed, service-level resilience information.

Purpose of This eBook

The purpose of this eBook is to kick-start the structured submission of information required for MBSB's operational resilience implementation project.

Each Critical Business Service should be examined consistently so that MBSB can progressively develop an end-to-end understanding of how the service operates and how it could withstand disruption.

The eBook therefore provides a common implementation structure for business units to document their respective Critical Business Services and supporting arrangements.

The resulting submissions should enable MBSB to:

• develop greater visibility of how each Critical Business Service is delivered;
• identify the processes and activities necessary to maintain service delivery;
• understand internal and external interconnections and dependencies;
• establish appropriate impact tolerances;
• identify severe but plausible disruption scenarios;
• test whether services can remain within their established impact tolerances;
• identify vulnerabilities, weaknesses, and resilience gaps;
• establish improvement actions where existing capabilities are insufficient; and
• provide management with a more consistent view of operational resilience across the organisation.

The objective is not simply to produce documentation. The information generated should support decision-making, prioritisation, investment, scenario testing, remediation, and ongoing management of operational resilience.

MBSB Critical Business Services

For this implementation, the following Critical Business Services form the working CBS catalogue for MBSB:

These services provide the starting point for the detailed implementation activities covered in this eBook.

The catalogue should not be regarded as static.

As MBSB's products, delivery channels, technologies, outsourcing arrangements, customer expectations, and regulatory obligations evolve, the organisation should periodically review whether the services identified as critical remain appropriate.

The Five OR Implementation Stages

The implementation is organised around five sequential and interconnected stages.

Step 1 — Outline Detailed Processes for CBS [DP]

The first stage develops a detailed understanding of how each Critical Business Service is delivered end-to-end.

A Critical Business Service may appear straightforward when viewed from the customer's perspective, but its delivery can involve numerous processes, systems, business units, people, facilities, data flows, third parties, and supporting activities.

The Detailed Processes [DP] stage breaks the CBS into its constituent processes and activities.

For example, the delivery of a payment service may involve customer initiation, authentication, transaction validation, processing, fraud screening, payment routing, settlement, confirmation, exception handling, and customer support.

Documenting these processes establishes the foundation for the subsequent resilience analysis.

Key question:

What processes and activities must operate for this Critical Business Service to be delivered successfully?

Step 2 — Map Interconnections and Interdependencies [MII]

Once the detailed processes are understood, MBSB needs to identify the resources, relationships, and dependencies supporting them.

The Map Interconnections and Interdependencies [MII] stage develops an end-to-end view of the people, processes, technology, information, facilities, third parties, infrastructure, and other resources that the Critical Business Service depends on.

This stage should also consider dependencies between Critical Business Services.

For example, Digital Banking Services may depend upon Customer Transaction Authentication and Authorisation Services. Payment services may rely on common technology platforms, telecommunications infrastructure, external payment networks, data centres, cloud services, or third-party providers.

Understanding these relationships helps identify:

• single points of failure;
• concentrations of dependency;
• common resources supporting multiple CBSs;
• critical third parties;
• technology dependencies;
• upstream and downstream dependencies; and
• potential vulnerabilities that may disrupt and propagate across services.

Key question:

What does this Critical Business Service depend upon, and what depends upon it?

Step 3 — Establish Impact Tolerances [iTo]

Operational resilience recognises that disruptions cannot always be prevented.

The organisation must therefore determine the maximum level of disruption it can tolerate before the consequences become unacceptable.

The Establish Impact Tolerances [iTo] stage defines this boundary for each Critical Business Service.

Impact tolerances should be informed by the potential consequences of disruption, including impacts on customers, financial position, operations, regulatory obligations, reputation, counterparties, and the broader financial ecosystem where relevant.

Depending upon the service, an impact tolerance may incorporate measures such as:

• maximum duration of disruption;
• number or proportion of customers affected;
• transaction volumes or values affected;
• financial exposure;
• backlog levels;
• service availability; or
• other service-specific thresholds.

The impact tolerance subsequently becomes an important reference point for scenario design and testing.

Key question:

How much disruption can MBSB tolerate before the impact becomes unacceptable?

Step 4 — Identify Severe but Plausible Scenarios [SbPS]

Once dependencies and impact tolerances have been established, MBSB can consider the circumstances that could severely disrupt each Critical Business Service.

The Identify Severe but Plausible Scenarios [SbPS] stage focuses on credible events that are sufficiently severe to challenge existing resilience arrangements.

These scenarios should not be limited to historical incidents. They should consider circumstances that could reasonably occur even if MBSB has not previously experienced them.

Examples may include:

• prolonged technology outages;
• cyber incidents;
• telecommunications failures;
• disruption to critical third parties;
• loss or corruption of critical data;
• simultaneous failure of primary and recovery arrangements;
• unavailability of key operational locations;
• significant workforce disruption;
• payment infrastructure disruption; and
• combinations of events that create cascading impacts.

Scenario selection should be informed by the characteristics and dependencies of the CBS rather than applying identical scenarios to every service.

Key question:

What severe but credible events could cause this Critical Business Service to approach or exceed its impact tolerance?

Step 5 — Perform Scenario Testing [ST]

The final stage converts the preceding analysis into practical resilience validation.

Scenario Testing [ST] evaluates whether MBSB can continue delivering, recover, or otherwise manage a Critical Business Service during a severe but plausible disruption without exceeding its established impact tolerance.

Testing should examine more than whether an existing continuity or recovery plan can be activated. It should evaluate the service from an end-to-end operational resilience perspective.

This may include assessing:

• detection and escalation;
• incident and crisis management;
• business continuity arrangements;
• technology recovery;
• alternative operating procedures;
• third-party response;
• customer communications;
• management decision-making;
• workarounds;
• recovery priorities;
• cross-functional coordination; and
• the ability to remain within the impact tolerance.

The outcome should identify both demonstrated resilience capabilities and areas requiring improvement.

Key question:

Can MBSB withstand and recover from the scenario without exceeding the established impact tolerance?

The Implementation Flow

The five stages are deliberately connected:

Each stage provides information required by the next.

Detailed process information enables the identification of dependencies. Dependency mapping reveals potential vulnerabilities and informs the setting of meaningful impact tolerances.

Impact tolerances establish the boundary against which severe but plausible scenarios can be considered. Those scenarios then provide the basis for scenario testing.

The result is an implementation process that moves from understanding the service to demonstrating its resilience.

Business Unit Participation

Operational resilience cannot be implemented effectively by a central OR, BCM, or Risk function acting alone.

Business units responsible for Critical Business Services play an important role because they possess the operational knowledge needed to explain how those services function.

Their submissions should therefore reflect practical operating knowledge rather than merely reproduce policies, procedures, or existing continuity documentation.

Business units should be able to explain:

How the service operates → What supports it → What could disrupt it → How much disruption is tolerable → Whether MBSB can remain within that tolerance

Central OR, BCM, Risk, Technology, Cybersecurity, Third-Party Risk, and other relevant functions can provide methodology, facilitation, review, challenge, and specialist input.

This combination of business ownership and specialist challenge is important for developing credible operational resilience assessments.

Alignment with Bank Negara Malaysia Expectations

As a Malaysian financial services institution, MBSB operates within the regulatory environment established by Bank Negara Malaysia (BNM).

Accordingly, the implementation approach should be considered alongside applicable BNM requirements and supervisory expectations relating to areas such as business continuity, technology risk, operational risk, outsourcing and third-party arrangements, cyber resilience, incident management, and broader operational resilience.

The implementation should not be treated as an isolated compliance exercise.

Instead, operational resilience should bring together relevant capabilities across MBSB, enabling the organisation to develop a service-centred understanding of its ability to withstand disruption.

This eBook therefore provides an implementation structure through which MBSB's existing risk management and resilience capabilities can be connected around the continued delivery of its Critical Business Services.

Training-Led Implementation Approach

This eBook forms part of the value-added implementation support provided to organisations undertaking BCM Institute's training-led operational resilience implementation approach.

Under this approach, participants not only learn the OR methodology during certification or competency-based training. They progressively apply the methodology to their own organisation.

Training provides knowledge and implementation guidance, while project submissions offer the opportunity to apply that knowledge to real-world Critical Business Services.

The approach can be summarised as:

This helps bridge the gap between professional education and organisational implementation.

For MBSB, the submissions developed through the five stages can progressively contribute to a practical body of operational resilience information that can be reviewed, challenged, updated, and used as the OR programme matures.

What a Completed CBS Submission Should Demonstrate

After the five stages, the submission for each Critical Business Service should provide a coherent resilience story.

It should enable management and reviewers to understand:

This creates traceability from service delivery through to resilience validation and improvement.

Moving from Planning to Implementation

Operational resilience becomes meaningful when an organisation can demonstrate that it understands its critical services and has taken practical steps to ensure they can withstand disruption.

For MBSB, the nine identified Critical Business Services provide the focal point for this implementation.

The work begins by understanding each service in detail. It then progressively examines dependencies, tolerance for disruption, credible threats to service delivery, and the effectiveness of MBSB's existing resilience arrangements.

The implementation journey can therefore be expressed as:

Understand the CBS → Map the CBS → Set the Tolerance → Challenge the CBS → Test the CBS → Improve Resilience

The chapters that follow compile and structure the submissions from the respective business units across the five implementation stages.

Together, these submissions provide the basis for moving MBSB's Operational Resilience programme from methodology and planning into practical implementation, validation, and continuous improvement.

The ultimate objective is not to demonstrate that disruption will never occur.

It is to develop sufficient understanding, preparedness, and resilience so that, when disruption occurs, MBSB is better positioned to protect the continued delivery of the Critical Business Services that matter to its customers, stakeholders, and the wider financial system.

Blogs marked [x] are under construction