[OR] [MBT] [E2] [P2] [S3] [C11] Establishing Impact Tolerance

Establishing Impact Tolerance

(Stage of the “Implement” Phase – Operational Resilience Planning Methodology for Metrobank)

Introduction

In today’s rapidly evolving operating environment—characterised by digitalisation, increased outsourcing, and frequent natural hazards—Metrobank must ensure not only continuity of critical operations but also resilience in the face of disruption.

The “Establishing Impact Tolerance” stage is a key component of Metrobank’s Operational Resilience Planning Methodology's Implement phase.

In this chapter, we will describe how Metrobank can define its impact tolerance for each critical business service, implement steps to set and agree on thresholds, link with regulatory requirements (especially those from the Bangko Sentral ng Pilipinas [BSP]), and integrate this into its operational resilience framework.

Taking a forward-looking and encouraging tone, we will illustrate practical steps and examples that Metrobank can adopt to embed impact tolerance meaningfully across the organisation.

Implementation Steps for Establishing Impact Tolerance

Below are the key implementation steps Metrobank should follow in the “Establishing Impact Tolerance” stage, along with examples and linkages to compliance requirements.

Step 1: Confirm critical business services and associated impact types

Before setting tolerances, Metrobank must reaffirm and document its critical business services (CBS). For each service, determine the types of potential impacts that would arise if a disruption occurs.

This step ensures a common understanding of “what we must protect” and “what we are trying to tolerate”.

Example

• Service: Retail deposit acceptance (branches + online) – impact types might include: inability to accept new deposits, reputational damage, regulatory capital liquidity strain, customer loss.
• Service: Payment clearing & settlement – impact types: late settlement, operational loss, systemic risk, regulatory breach.
• Service: Credit underwriting and disbursement – impact types: delayed credit approval/disbursement, higher default risk, loss of competitive position.

Step 2: Define quantitative and qualitative impact tolerance thresholds

Once impact types are defined, Metrobank should establish, for each CBS, the level of disruption it can tolerate while continuing to deliver its obligations.

This involves setting thresholds for both duration (how long service can be degraded) and magnitude (how much degradation is acceptable), as well as tolerances for reputational, financial, regulatory, and customer-service impacts.

Example

For the payment clearing & settlement service, Metrobank may determine: “We will tolerate no more than 2 hours of full outage before activating contingency; and we will tolerate customer transaction failure rate up to 0.5% before escalation to senior management.”

Qualitative thresholds might include: “We will not accept any instance where regulatory capital or liquidity ratios are materially impacted, or where customer trust is irreversibly eroded.”

Step 3: Align tolerances with regulatory and supervisory requirements

In the Philippines, Metrobank, as a BSP-supervised financial institution, must align its tolerance definitions with the guidelines issued by the specifically the BSP Circular No. 1203 (Series of 2024) “Guidelines on Operational Resilience”.

These guidelines emphasise that banks must determine their tolerance for disruption and ensure they remain within their established limits.

Compliance examples include:

• Metrobank must prepare its operational resilience framework on a solo and group-wide basis as applicable.
• Metrobank must integrate its tolerance for disruption into its risk management and business continuity management.
• Metrobank must document its tolerances and ensure that, upon activation of its incident response plan for critical operations, it notifies the BSP within 24 hours, including whether the tolerance has been breached.

By explicitly aligning the thresholds set at Metrobank with these regulatory expectations, management ensures that tolerances are credible, auditable, and embedded in the broader resilience framework.

Step 4: Obtain stakeholder agreement and governance endorsement

The thresholds developed must be approved by appropriate governance bodies—ideally by Metrobank’s Board (or a Board Committee) and senior management.

They should reflect what the organisation is willing to live with, trade-off-wise, under disruption. After approval, they become part of policy, and dashboards or monitoring tools should be built to track adherence.

Example

Metrobank’s Risk Oversight Committee reviews the proposed tolerances for each critical service and endorses them to the Board. Senior management then budgets for the capability (people, technology, outsourcing) required to meet those tolerances.

Step 5: Communicate, embed, and monitor tolerances

Once defined and approved, Metrobank must communicate the tolerances throughout the organisation (business units, IT, operations, third parties).

They must be embedded into key processes: for example, business continuity plans reference the tolerance thresholds; service agreements with outsourcers reflect both acceptable downtime and breach escalation; IT incident management uses the thresholds to trigger escalation.

Then Metrobank must monitor performance against the tolerances and track when tolerances are breached, trigger remedial plans, lessons learned, and refine tolerances if required.

Example

If Metrobank’s online retail deposit service experiences a performance degradation lasting 3 hours (exceeding the tolerance of 2 hours), an automatic escalation to senior management occurs, root cause analysis is carried out, customer communications are executed, and the tolerance is reviewed to determine if it remains appropriate.

Step 6: Review and refine tolerances based on scenario testing and outcomes

Tolerance levels should not be static. As Metrobank conducts scenario testing (e.g., cyber-attack simulation, branch network outage due to typhoon), the outcomes may show that the service impact was larger than envisaged.

Metrobank should refine its tolerances based on learnings, changes in the business environment, regulatory evolution (e.g., new BSP guidelines), and the evolving risk profile.

Example

A scenario test reveals that the bank’s branch network backup capabilities take 4 hours to restore (versus a tolerance of 2 hours).

Metrobank may revise the tolerance for branch service or invest in improved backup, or split the tolerance between branches and digital channels with weighted tolerances.

Table: Critical Business Services, Impact Types & Example Impact Tolerances

Below is a sample table Metrobank can adopt and adapt, showing key critical business services, associated impact types (i.e., different adverse consequences of disruption), and example tolerance thresholds (duration and magnitude).

Note: the tolerance numbers should be calibrated by Metrobank’s own analysis of risk appetite, business model, regulatory context, and cost-benefit.

* The example tolerances are illustrative and must be adapted by Metrobank according to its context.

Regulatory & Compliance Considerations for Metrobank

While setting and embedding impact tolerances, Metrobank must actively reference the regulatory environment overseen by the BSP:

• The BSP’s Guidelines on Operational Resilience (Circular No. 1203) require BSFIs to determine critical operations, set tolerance for disruption, and ensure they remain within those limits.
• The guidelines require integration of the operational resilience framework with existing governance structures, such as operational risk management, business continuity management, cyber resilience, and outsourcing risk
• Reporting and notification: If the incident response plan for critical operations is activated, banks must notify the BSP (within 24 hours) with information such as nature, duration, root cause, affected CBS, and whether tolerance was breached.
• Metrobank must prepare its operational resilience framework on a solo and group-wide basis (as applicable). For group entities/subsidiaries, the same tolerance framework must apply.
• Metrobank must disclose in its Annual Report the overarching approach to operational resilience, including information on tolerance thresholds and performance (where applicable).

By embedding these regulatory requirements into Metrobank’s tolerance-setting process, the bank ensures that its resilience posture not only supports business continuity but also meets supervisory expectations — thereby enhancing organisational credibility and stakeholder confidence.

Establishing impact tolerance is a proactive and strategic step for Metrobank in the journey of operational resilience. It translates abstract notions of “we must keep going” into concrete thresholds, governance decisions, monitoring metrics, and escalation triggers.

By defining the critical business services, identifying the types of disruptions, setting realistic yet robust tolerance thresholds, aligning with BSP guidelines, engaging governance, embedding monitoring, and reviewing the tolerances over time, Metrobank ensures that it is not only prepared for disruption but also confident in how much disruption it can tolerate while remaining viable, credible, and compliant.

By doing so, Metrobank positions itself as a forward-thinking institution that embraces resilience as a strategic enabler — ensuring that its commitment to operational continuity supports its role in the real economy, honours regulatory expectations, protects its customers, and maintains competitiveness even in the face of uncertainty.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.