[OR] [MBT] [E2] [P3] [S3] C17] Implementing Training and Awareness

Introduction

In today’s environment of rapidly evolving threats—ranging from cyber-attacks and IT outages to natural disasters and supply-chain disruptions—financial institutions must not only plan for resilience but embed it deeply within their culture and operations.

For Metrobank, as a major banking institution in the Philippines, developing a robust operational resilience framework is only part of the journey.

To sustain resilience over time, the bank must ensure that its people, processes, and third parties remain aware, trained, and prepared. The “Implement Training and Awareness” stage of the Sustain phase is where the bank translates strategy into capability, behaviour and readiness.

In this chapter, we explore how Metrobank can structure, deploy, and embed training and awareness programmes aligned with the requirements of the Bangko Sentral ng Pilipinas (BSP) Guidelines on Operational Resilience and the bank’s own operational resilience planning methodology.

We present detailed implementation steps, illustrative examples, and practical best practices to make training and awareness work operationally and culturally.

Implementation Steps

Below are the key implementation steps that Metrobank should follow in this stage, along with relevant examples and tips:

Conduct a Training Needs Assessment

Objective: Identify the training requirements across different roles, functions, and third parties relative to operational resilience.

Actions:

• • Map out all business units, support functions, outsourced service providers, and critical operations stakeholders.
  • Link the training requirements to the resilience framework: critical operations identified, tolerance for disruption, interdependencies mapped, scenario-testing results, and governance structure. For example, under the BSP guidelines, BSFIs must integrate awareness and training programmes within their Business Continuity Management (BCM) and operational resilience frameworks.
  • Identify gaps: e.g., some front-line branch staff may not fully understand what “critical operations” means or how to respond in a disruption; IT staff may need refresher training on cyber-incident response with reference to resilience rather than just compliance.

Metrobank Example

• Metrobank’s risk management team collaborates with HR and business units to survey primary and secondary resilience tasks: e.g., branch operations during power outages, ATM network continuity, and mobile-banking service recovery. The output is a matrix of role vs. training need: e.g., branch teller (awareness of service-continuity plan), operations manager (incident escalation process), outsourced ATM maintenance provider (interface with Metrobank’s crisis communications).
• Tip: Use a “three-lines of defence” lens (business units / internal control, risk & compliance, internal audit) to ensure each line has appropriate awareness/training obligations, consistent with BSP’s expectations. 

Develop a Training and Awareness Strategy

Objective:

• Define how training and awareness will be delivered, monitored, and sustained.

Actions:

• Set training objectives aligned with Metrobank’s operational resilience goals (e.g., “All branch managers will be able to execute the critical-operation alternate process within X hours of activation.”)
• Determine delivery methods: e-learning modules, classroom sessions, tabletop exercises, simulations, role-play, third-party provider training.
• Define awareness tools: posters, email newsletters, resilience-flash bulletins, “resilience week” campaigns, and internal portal resources.
• Specify metrics and KPIs: e.g., completion rates, assessment scores, simulation-participation rates, and change in incident response time post-training.
• Define refresher intervals and continuous awareness mechanisms: periodic drills, newsletters, updates after lessons learned from incidents.

Metrobank Example

Metrobank’s operational resilience office partners with the learning & development unit to launch a “Resilience First” campaign. The awareness component includes monthly short videos for all staff explaining the bank’s tolerance-for-disruption concept (a core requirement under BSP guidelines)

 A classroom course is developed for key roles (branch managers, IT incident leads, third-party providers) and a companion e-learning module for general staff.

Tip

•  Make the training interactive and scenario-based rather than purely didactic. Engaging employees with realistic “what-if” exercises (e.g., a cyber-attack simultaneous with a power grid failure) helps embed resilience thinking.

Integrate Training with Real-Life Scenario Exercises

• Reinforce training through periodic exercises that simulate disruptions and test awareness and response capability.

• Use severe but plausible scenarios consistent with Metrobank’s risk profile (e.g., major earthquake in Metro Manila, ransomware attack on the digital banking platform, prolonged branch network outage). Under the BSP guidelines, scenario testing is a key element of the operational resilience framework.
• Integrate training participants into these exercises: e.g., after completing a module, branch staff participate in a branch network failover simulation.
• Review the outcomes of the exercise for training gaps, behavioural issues, communication weaknesses, and third-party coordination.
• Feed lessons learned back into training content and awareness campaigns.

• Metrobank conducts an annual “Bank Resilience Simulation Day”, involving headquarters, branch operations, IT, contact centre, and a major outsourcing provider.
• A scenario: “major power grid failure affecting a cluster of branches and ATMs during peak hours.”
• After the exercise, a debrief highlights weaknesses in communication flows, and the training module is updated accordingly.

• Record and track “time to restore” and “customer impact” metrics in the simulation, aligning with Metrobank’s tolerance for disruption and helping maintain awareness of those targets.

Roll-out Training and Awareness Programmes

• Launch the training and awareness initiatives across the organisation and third-party providers.

• Communicate the purpose, scope, expectations, and timelines to all stakeholders – staff, business units, support functions, outsourced providers.
• Assign responsibilities: e.g., resilience office manages content; HR/training team handles logistics and LMS (learning management system); business units track completion and apply on-the-job reinforcement.
• Deploy training modules as per priority: high-risk/critical operations roles first, then all staff.
• Launch awareness campaign simultaneously: e.g., signage in branches, internal newsletter items, short videos on resilience, quick reference guides for staff.
• Engage service providers: ensure their relevant staff are trained, and awareness is extended to them so that the critical-operation delivery chain is resilient. Under the BSP guidelines, outsourcing arrangements that support critical operations must be aligned with the institution’s resilience framework.

• Metrobank schedules the training in waves—first wave for IT disaster recovery, operations, and branch network management staff; second wave for all branches; third wave for third-party ATM/IT vendors. Parallel to training, a “Resilience Month” awareness campaign is launched, with posters in branches, resilience-tip e-mails, short quizzes, and recognition for teams with the highest completion rates.
• Tip: Monitor completion rates and assessment results. Follow up on non-compliance or low-score individuals with refresher training or targeted coaching. Consider gamification or incentives for fostering engagement.

Monitor, Measure, and Report Effectiveness

• Ensure the training and awareness programme remains relevant, effective, and aligned with Metrobank’s resilience objectives and regulatory obligations.

• Define KPIs: e.g., % of staff trained, % of key functions that passed simulation exercise, reduction in incident-response time, audit findings related to awareness/training.
• Report results to senior management and the board: include training completion, assessment scores, exercise outcomes, outstanding gaps, and improvement actions. This aligns with the BSP’s expectation for board oversight of operational resilience.
• Use findings from incident/near-miss events, simulation exercises, and audit reports to update training content and awareness campaigns.
• Maintain records of training, assessments, and certifications for audit/regulatory review.

• Metrobank’s resilience office provides a quarterly dashboard to the Risk Committee of the Board summarising training status: e-learning completion 95 %, classroom course pass rate 88 %, simulation exercise full participation 100 % of targeted roles, and incident average restoration time improved by 18 %.
• The board asks management for a plan to address the 12 % of participants who failed the classroom course, and for targeted refresher training on the identified communication breakdown.

• Tie the training and awareness KPI results with business-unit performance and with operational-resilience maturity metrics. Use the data to justify further investment and continuous improvement.

Sustain and Embed a Resilient Culture

•  Move beyond one-off training to a culture where operational resilience awareness is embedded in daily operations, decision-making, and employee mindset.

• Refresh training periodically (at least annually) and whenever there are material changes (new business channels, outsourcing, major system upgrades, regulatory changes). The BSP guidelines anticipate continuous review and updating of resilience frameworks.
• Embed resilience awareness in onboarding for new hires, supplier onboarding, and third-party provider contracts.
• Recognise and reward “resilience champions” or teams that demonstrate high awareness and readiness.
• Promote leadership engagement: senior management and the board should periodically lead “town-hall” sessions or “challenge” exercises to reinforce the message – “we expect you to deliver critical operations through disruptions.”
• Use awareness-refresh tools: newsletters, intranet articles, pop-up reminders, scenario videos, “what would you do” quizzes.

• Metrobank introduces an “Operational Resilience Day” every year where leadership addresses all staff, shares the latest threat landscape (e.g., cyber-ransomware trends, major earthquake risk scenario for Metro Manila), and invites branch teams to present “lessons learned” from recent audits or drills.
• New employees must complete a resilience induction module. Third-party vendors are required to complete a resilience awareness module as part of their contract renewal.

• Make resilience part of everyday language: e.g., branch staff talk in terms of “Our branch is a critical operation — our target is to be back within X hours” rather than “That is a BCM backup plan”. Embedding in language helps shift the mindset.

Examples of Compliance Requirements

For Metrobank, operating in the Philippines under BSP supervision, the following compliance requirements from the BSP’s Guidelines on Operational Resilience are particularly relevant to training and awareness:

• The guidelines apply to all BSP-supervised financial institutions (BSFIs), both at solo and group levels, and require a framework commensurate with the size, nature, and complexity of operations.
• Among the key elements is the integration of training, awareness, and testing programmes within the business continuity management function: “The BCM … should cover… testing, awareness and training programmes.”
• The board and senior management must oversee and approve the operational resilience framework; training and awareness fall under the remit of senior management.
• Institutions must be able to respond and recover from disruption and must regularly review, refine, and update their frameworks—including via lessons learned from tests and exercises. Training programmes are inputs into this ongoing review.
• Reporting and notification requirements: in an incident or when a plan for critical operations is triggered, the BSFI must notify the BSP within 24 hours and disclose key information, including the nature, duration, and root cause of the disruption. Knowledge of this requirement must be embedded in training and awareness efforts.

For Metrobank, the “Implement Training and Awareness” stage is not a one-time checklist item; it is the vital turning point where operational resilience concepts move from frameworks and plans into the hands and minds of people who will live it in real-time.

By systematically assessing needs, developing a strategy, integrating training with realistic exercises, rolling out programmes, monitoring effectiveness, and embedding a culture of resilience, the bank will strengthen its ability to deliver critical operations through disruption.

Through compliance with the BSP’s Guidelines on Operational Resilience and by applying best-practice training and awareness design, Metrobank can embed resilience as a living capability—not just a regulatory requirement, but a competitive differentiator and a source of confidence for customers, stakeholders, and regulators alike.

As the bank continues to navigate change, prepare for shocks, and maintain continuity of service, this stage ensures that people are ready, aware, and aligned with the resilience journey.

Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide
"Sustain" Phase of the Operational Resilience Planning Methodology
C14	C15	C16	C17	C18	C19

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.