[OR] [MBT] [E1] [C7] Establishing Organisational Goals for Operational Resilience

Chapter 7

What Organisational Goals Should Metrobank Establish to Implement its Operational Resilience Program?

Introduction

This chapter outlines the process of establishing organisational goals for operational resilience, aligning Metrobank's objectives with ISO 22316 standards and the operational resilience requirements of the Bangko Sentral ng Pilipinas (BSP).

In the context of operational resilience, an organisation's goals should focus on risk mitigation and ensuring that critical services are maintained during disruptive events.

Establishing clear, measurable goals for resilience is essential to enhancing the bank’s ability to withstand and recover from disruptions, whether they stem from cyber threats, natural disasters, or other external shocks.

Purpose of the Chapter

This chapter will examine the steps involved in formulating operational resilience goals tailored to Metrobank's specific needs, taking into account the unique challenges faced by the bank.

The objective is to provide readers with a comprehensive framework for defining resilience goals, ensuring that these goals align with both internal operational priorities and external regulatory requirements.

By the end of the chapter, readers will understand how to:

• Establish clear and measurable goals for operational resilience within Metrobank.
• Align these goals with ISO 22316 and BSP requirements.
• Ensure that resilience goals are integrated into Metrobank's broader strategic objectives.
• Foster a culture of resilience that supports business continuity and operational agility.

Aligning Resilience Goals with Strategic Objectives

Before setting specific goals for operational resilience, Metrobank must assess its broader strategic objectives.

These goals should support Metrobank’s vision of being the Philippines' most trusted and innovative financial institution.

The bank’s operational resilience strategy must align with this vision, ensuring that resilience objectives contribute to the long-term stability and profitability of the organisation.

At the core, Metrobank's resilience goals should aim to:

• Minimise Disruptions: Ensure that critical banking operations are less susceptible to disruptions, whether they result from technological failures, natural disasters, or human error.
• Enhance Recovery Capabilities: Develop a robust disaster recovery strategy to ensure that the bank can quickly recover from any operational disruptions.
• Maintain Customer Confidence: By prioritising resilience, Metrobank can demonstrate to its customers that their financial services will remain uninterrupted, even during times of crisis.

By aligning operational resilience goals with the bank's strategic objectives, Metrobank can build a more responsive, adaptable, and sustainable banking environment.

Understanding Regulatory Requirements for Operational Resilience

The regulatory environment plays a crucial role in shaping operational resilience goals. In the Philippines, the Bangko Sentral ng Pilipinas (BSP) has established clear guidelines to ensure the resilience of financial institutions.

BSP Circular No. 1108, which outlines banks' minimum operational resilience standards, mandates that financial institutions adopt comprehensive resilience frameworks that focus on business continuity, crisis management, and risk mitigation.

Metrobank’s operational resilience goals must, therefore, be closely aligned with BSP's regulations. The key areas of focus for compliance include:

• Business Continuity Planning: Ensuring that Metrobank’s critical functions can continue during disruptions, with predefined recovery strategies in place.
• Crisis Management Framework: Establishing a crisis management structure with clear roles and responsibilities to manage and respond to emergencies.
• Risk Assessment and Mitigation: Regularly assessing risks to operational resilience and implementing mitigation strategies to address vulnerabilities.

Meeting these regulatory requirements ensures that Metrobank remains in good standing with the BSP and safeguards its operations against unforeseen events.

Setting Specific, Measurable, Achievable, Relevant, and Time-bound (SMART) Goals

Metrobank should adopt the SMART framework when establishing resilience goals to ensure that they are specific, measurable, achievable, relevant, and time-bound.

This ensures that goals are not only strategic but also practical and measurable.

This is how Metrobank can apply the SMART criteria to operational resilience:

• Specific: Clearly define what resilience means for Metrobank. For example, "Ensure that all core banking services are operational within 24 hours after a cyber-attack."
• Measurable: Identify quantifiable outcomes. For instance, "Reduce downtime during system failures by 30% within the next two years."
• Achievable: Given the bank's resources, set challenging yet realistic goals. For example, "Develop and implement a comprehensive incident response plan by Q3 2026."
• Relevant: Ensure that each goal directly supports Metrobank’s broader resilience strategy. For example, "Improve resilience in online banking services to minimise service interruptions during high-demand periods."
• Time-bound: Set deadlines for achieving each goal. For instance, "Conduct a full operational resilience audit by the end of FY 2025."

By following the SMART framework, Metrobank can ensure that each goal is not only attainable but also effective in enhancing the bank's operational resilience.

Incorporating a Risk-Based Approach to Resilience

An effective operational resilience strategy is deeply rooted in a sound understanding of the risks the organisation faces.

For Metrobank, this means conducting a thorough risk assessment to identify potential vulnerabilities within its operations. Key areas to focus on include:

• Cybersecurity Threats: Given the increasing frequency of cyber-attacks on financial institutions, ensuring that Metrobank’s digital platforms are secure is essential to resilience.
• Natural Disasters: Assessing the risk of earthquakes, typhoons, and floods and ensuring that Metrobank’s physical infrastructure can withstand such events.
• Operational Dependencies: Identifying critical third-party vendors and service providers whose failure could disrupt banking operations.

Once these risks are identified, Metrobank can set goals to mitigate them, such as strengthening cybersecurity measures, enhancing the physical resilience of branch locations, or building redundancy into critical vendor relationships.

Fostering a Resilience Culture Across the Organisation

Operational resilience isn’t just about having the right strategies in place—it’s about creating a culture that values and prioritises resilience at all levels of the organisation. Metrobank should aim to:

• Educate and Train Staff: Provide regular training programs for all employees on operational resilience, business continuity, and crisis management.
• Leadership Commitment: Ensure that senior leaders actively champion resilience efforts and integrate them into the bank’s core operations.
• Continuous Improvement: Foster a mindset of continuous improvement, where resilience is not seen as a one-time initiative, but as an ongoing effort to adapt to new challenges.

By embedding resilience into the bank’s culture, Metrobank can build a workforce that is both prepared and motivated to respond effectively to disruptions.

Establishing organisational goals for operational resilience is a critical step for Metrobank as it strengthens its ability to withstand and recover from disruptions.

By aligning these goals with ISO 22316 standards and BSP regulatory requirements, applying the SMART framework, taking a risk-based approach, and fostering a resilience-driven culture, Metrobank can ensure that it not only complies with industry standards but also builds a sustainable and resilient operational foundation for the future.

The next step in this process will be translating these goals into actionable plans that drive continuous improvement and ensure long-term operational continuity.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.