[OR] [MBT] [E2] [P3] [S2] [C16] Developing a Communication Strategy

Introduction

In the Sustain phase of the Operational Resilience Planning Methodology, communication becomes not just an adjunct activity but a strategic pillar.

For Metrobank, effective communication ensures that the resilience capabilities built earlier are embedded, understood, and actionable across the organisation — among the board, senior management, business units, and external stakeholders (customers, regulators, service providers).

The goal of this chapter is to elaborate on a communication strategy tailored to Metrobank’s context, aligned with regulatory expectations (notably the Bangko Sentral ng Pilipinas (“BSP”) guidelines on operational resilience) and designed to support the continuity of critical operations, stakeholder confidence, and regulatory compliance.

The strategy will be broken down into implementation steps, with concrete examples aligned with Metrobank’s Philippine operations and references to key compliance requirements under the BSP’s operational resilience framework.

Communication Strategy Implementation Steps

This is the outline, step-by-step, of how Metrobank should implement its communication strategy within the Sustain phase, each step illustrated with examples relevant to Metrobank and the BSP regulatory context.

Define the Communication Objectives and Stakeholder Map

Implementation:

• Metrobank must begin by clearly defining what the communication strategy seeks to achieve during the Sustain phase. Typical objectives:

• • Ensure all relevant personnel understand the bank’s operational resilience framework (critical operations, tolerance for disruption, incident response)
  • Embed a culture of readiness and awareness across business units, IT/ cyber, third-party/outsourcing, and customer-facing teams
  • Create transparency with external stakeholders (customers, regulators, service providers) regarding Metrobank’s resilience posture
  • Facilitate timely escalation and notification during disruptions (in line with BSP requirements)

• Simultaneously, compile a stakeholder map: internal stakeholders (Board, senior management, business line heads, operational risk/BCM/ICT teams, internal audit) and external stakeholders (BSP-supervising department, large third-party service providers, customers, perhaps media).

Example for Metrobank

• Internal Board Risk & Audit Committee receives a quarterly resilience status update; business line heads receive awareness sessions.
• External: Metrobank sends an annual resilience summary to BSP, and in the event of a major disruption, triggers the 24-hour notification to BSP (as required under BSP Circular No. 1203) that includes nature, duration, root cause, affected critical operations, status of tolerance breach, and actions taken.
• Key Objective: ensure business units recognise that their processes may have to operate under “severe but plausible scenario” conditions, and understand their roles in communication and continuity.

Map the Key Messages, Channels, and Frequency

Implementation

• Identify key messages that need to be communicated. For Metrobank, messages may include:
  • “Metrobank identifies its critical operations (e.g., deposit taking, payments settlement, treasury operations, digital banking platform) and has defined tolerances for disruption.”
  • “We have updated our incident escalation matrix and communication plan — you must know your role when the incident response plan is triggered.”
  • “Third-party service providers must align with our operational resilience expectations.”

• Select appropriate channels and frequency:
  • Board/resilience oversight committee: quarterly report + ad-hoc incident briefing
  • Senior management/ business units: monthly bulletins, resilience-awareness workshops, tabletop drills, communications
  • All staff: intranet posts, e-learning modules, scenario-based emails, posters in branches/offices, awareness weeks
  • External: regulatory disclosures (in annual report: information on operational resilience approach per BSP requirement)

• Frequency:
  • Routine monthly communications for awareness
  • Incident-triggered communications as per the incident response plan (immediate, 24-hour, after-action).

Example for Metrobank

• Metrobank issues a monthly internal “Operational Resilience Newsletter” highlighting new scenario tests, lessons learned, and key metrics (e.g., number of service disruptions, percentage of recovery within tolerance).
• At year-end, Metrobank publishes in its annual report a section on its operational resilience framework and its compliance with BSP’s Section 146/146-Q (MORB/MORNBFI) disclosure requirements.
• In the case of a significant third-party outage affecting payments, Metrobank uses SMS/email to notify affected customers, publishes a public notice, and simultaneously escalates internally and to BSP (within 24h).

Develop the Communication Plan and Governance

Implementation:

• Create a detailed communication plan, aligned with the resilience governance structure. The plan should specify: roles and responsibilities (who prepares messages, who approves, who issues), triggers (what events trigger which communications), timeline (when messages go out), formats/templates, and audience segmentation.
• Integrate the communication plan into Metrobank’s incident management and business continuity management (BCM) frameworks.
• Ensure governance: Board (or Board committee) approves the communication plan; senior management owns the execution; first/second/third lines of defence align. Under BSP guidelines, governance of operational resilience must leverage existing structures.

Example for Metrobank

• The Board of Metrobank formalises an “Operational Resilience Communications Charter” that assigns:
  • Head of BCM / COO: drafts external and internal communication templates.
  • Chief Risk Officer: approves messages for senior management and regulates external disclosures.
  • Head of Corporate Communications: issues customer- and public-facing notices.

• Triggers in the plan: when a critical operation’s disruption exceeds the tolerance threshold (e.g., payment system down > tolerance time), internal escalation occurs within 1h; external notification (to BSP) within 24h; customer notification within 2h.
• The communication plan is stored within Metrobank’s incident response repository and is exercised during scenario-based drills.

Tailor Content for Key Stakeholders and Scenarios

Implementation:

• For each stakeholder group and scenario, tailor the content of communication: simple, actionable for front-line staff; detailed and strategic for senior management; transparent yet controlled for regulators/customers.
• Use scenario-based messaging: e.g., for a cyber-attack, a natural disaster (e.g., typhoon affecting branch network), third-party provider outage. Each scenario may require a different tone, channels, and level of detail.

Example for Metrobank

• Scenario: Ransomware attack hits Metrobank’s core banking data centre and causes branch transaction delays.

• • Internal (business units): Memo: “Transaction delays expected until systems are restored — follow manual fallback process; maintain customer communication via branch scripts.”
  • Senior management: Briefing: “Impact on critical operations: branch deposits, ATM, online banking. Tolerance time defined as 4 hours; currently at hour 3; mitigation plan: switch to DR site; customer impact moderate.”
  • External (customers): SMS/email: “Due to systems disruption, certain branches and digital services are temporarily slowed. Our teams are working to restore full service by [time]. We apologise for the inconvenience.”
  • Regulator: Notification to BSP within 24h, including nature, duration, root cause, affected critical operations, status of tolerance breach, and actions taken.

• Tailoring content ensures the right level of detail and appropriate channel for each audience.

Execute, Monitor, and Feedback

Implementation:

• The communication plan must be executed in live operations and during testing (table-top drills, exercises). Monitor delivery (who received it, acknowledged — for key internal messages) and monitor effectiveness (did staff act appropriately, were stakeholders satisfied, did external messages reach customers).
• Collect feedback: after each incident or exercise, hold a debrief and survey stakeholder satisfaction and comprehension. Use feedback to refine the message content, channels, and templates.

Example for Metrobank

• After Metrobank’s business continuity exercise simulating a major branch network outage, the communications team distributes a post-exercise survey: “Did you receive the message within the expected time? Was the instruction clear? Did you know what to do next?”
• Metrics tracked: time to first internal message, percentage of staff acknowledging, customer enquiries to call-centre (as proxy for clarity of external message).
• Example feedback: “Front-line staff wanted more simple talking-points for customers” → update template branch scripts accordingly.

Review, Refine, and Sustain the Communication Strategy

Implementation:

• According to the BSP guidelines, operational resilience is a continuous, dynamic process. The communication strategy must likewise be reviewed periodically (at least annually or after major incidents) and refined based on lessons learned, changing business models, new threats, or regulatory changes.
• Update governance, stakeholder mapping, key messages, channels, and templates accordingly. Incorporate evolving issues: e.g., increased digital banking, cyber threats, and more outsourcing/third parties.

Example for Metrobank

• Metrobank’s annual review in Q4: communication strategy updated to include new channel “WhatsApp Business broadcast” for large-ticket customers, updated message templates to reflect remote-working risks (post-COVID), and inclusion of third-party service provider communication obligations (e.g., joint messaging with major processor).
• The Board reviews and approves the updated communication strategy and confirms that it aligns with the bank’s risk appetite and tolerance for disruption.

Compliance Requirements and Examples for Metrobank

As Metrobank operates in the Philippines, it must comply with several regulatory requirements under the BSP’s operational resilience guidelines. The communication strategy must reflect these. Some key compliance points:

• Under BSP Circular No. 1203 Series of 2024, banks (and non-bank financial institutions) must integrate operational resilience into their governance and risk frameworks.
• The guidelines require disclosure in the Annual Report of the overarching operational resilience approach and key components (including communication plans) under Section 146/146-Q of the MORB/MORNBFI.
• Notification to BSP: Upon activation of the incident response plan for critical operations, banks must notify within 24 hours, providing the nature, duration, root cause, affected critical operations, status of tolerance, and actions taken.
• Governance: The Board of Directors must oversee the operational resilience framework; first/second/third lines of defence must be clearly established. The communication strategy should operate within this governance.
• Phased implementation: the Circular requires submission of a self-assessment questionnaire (SAQ) within one year, full implementation of the framework in a defined period (e.g., two to three years, depending on size/complexity). The communication strategy must be aligned with this timeline.

Example for Metrobank in the compliance context:

• Metrobank includes in its Annual Report a dedicated section: “Operational Resilience and Communication Strategy” – outlining how the bank identifies its critical operations and how it ensures timely stakeholder communication in disruptions.
• Metrobank’s incident response plan triggers an automatic message flow: internal escalation, regulator notification (within 24h), customer/public advisory. Templates referenced in the communication plan.
• Metrobank completes the SAQ and submits it to BSP, documenting its communication governance, stakeholder mapping, and strategy, as required under Phase 1 of BSP Circular.
• Metrobank’s Board Risk Committee receives quarterly reports on actual breaches of tolerance, communication outcomes, and lessons learned from drills – satisfying the governance oversight requirement.

For Metrobank, the communication strategy within the Sustain phase of operational resilience is a critical enabler — it transforms policies and frameworks into action, embeds understanding and readiness across stakeholders, sustains resilience momentum, and ensures regulatory alignment.

By systematically defining objectives and stakeholders, mapping messages and channels, integrating the plan into governance, tailoring content for scenarios, executing and monitoring, and regularly reviewing and refining, Metrobank will enhance its ability to withstand and recover from disruptions while maintaining stakeholder trust and regulatory compliance.

Aligning with Bangko Sentral ng Pilipinas’ operational resilience guidelines ensures that Metrobank not only safeguards its own critical operations but also contributes to the stability of the wider Philippine financial system. This chapter charts the path from strategy to sustainable resilience through effective communication.

Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide
"Sustain" Phase of the Operational Resilience Planning Methodology
C14	C15	C16	C17	C18	C19

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.