---
title: "[OR] [MM] [BSP] Regulatory Audit Checklist: BSP Circular 1203 (Operational Resilience)"
description: "[OR] [MM] [MAS] Regulatory Audit Checklist: MAS BCM, TRM, ORM"
image: https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20OR/Operational%20Resilience%20Morepost/OR%20Blog%20New%20Morepost/OR_Blog_Maturity-level%20Model%20for%20Focus%20Areas.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience eBook Series: Regulatory Audit Checklist
# \[OR\] \[MM\] \[BSP\] Regulatory Audit Checklist: BSP Circular 1203 (Operational Resilience)
This chapter contains a Regulatory Audit Checklist aligned to Bangko Sentral ng Pilipinas (BSP) Circular No. 1203 (Series of 2024) — Guidelines on Operational Resilience for BSP-Supervised Financial Institutions (BSFIs).
This checklist is structured to support internal audit, regulatory review, and supervisory readiness, aligned to BSP 1203’s emphasis on:
• Critical Operations \[Critical Business Services (CBS)\]
• Tolerance for Disruption \[Impact Tolerance\]
• End-to-End Mapping
• Scenario Testing (Severe but Plausible Scenarios)
• Governance and Accountability
• Continuous Improvement
It follows your Plan → Implement → Test → Improve lifecycle and is compatible with BCM Institute's OR Planning methodology (DP, MD, MPR, iTo, SuPS, ST).
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 26, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### Regulatory Audit Checklist
#### BSP Circular 1203 (Operational Resilience)
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a5acb961-f2ec-4567-b636-874e365c892e)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/bcfa64a1-a7e4-4548-a927-2b17c34f8671)
This chapter contains a Regulatory Audit Checklist aligned to Bangko Sentral ng Pilipinas (BSP) Circular No. 1203 (Series of 2024) — Guidelines on Operational Resilience for BSP-Supervised Financial Institutions (BSFIs).
This checklist is structured to support internal audit, regulatory review, and supervisory readiness, aligned to BSP 1203’s emphasis on:
- [![\[OR\]\[BSP Guidelines\] Key Implementation and Components](https://no-cache.hubspot.com/cta/default/3893111/cceda0e6-1ccc-48c6-8ecc-682910430f1a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/cceda0e6-1ccc-48c6-8ecc-682910430f1a)Critical Operations \[Critical Business Services (CBS)\]
- Tolerance for Disruption \[Impact Tolerance\]
- End-to-End Mapping
- Scenario Testing (Severe but Plausible Scenarios)
- Governance and Accountability
- Continuous Improvement
It follows your Plan → Implement → Test → Improve lifecycle and is compatible with BCM Institute's OR Planning methodology
#### **Section** **1. Governance, Oversight, and Accountability**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Board Oversight | Has the Board approved the Operational Resilience framework? | Governance | Board minutes, OR policy | |
| Senior Management Accountability | Is senior management accountable for the resilience of critical operations? | Governance | Job descriptions, governance papers | |
| Resilience Strategy | Is there a documented OR strategy aligned to business objectives? | Governance | Strategy documents | |
| Three Lines of Defence | Are roles clearly defined across 3LOD? | Governance | Org charts, RACI | |
| Integration | Is OR integrated with ORM, BCM, IT, and TPRM? | Governance | Framework documents | |
#### **Section** **2. Identification of Critical Operations**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Identification | Has the institution identified its Critical Operations / CBS? | Critical Operations | CBS inventory | |
| Criteria | Are the criteria defined (customer impact, systemic importance, regulatory obligations)? | Critical Operations | Methodology documents | |
| Customer Perspective | Are services defined from an external (customer outcome) perspective? | Critical Operations | CBS definitions | |
| Approval | Are CBS approved by senior management/Board? | Governance | Approval records | |
| Review | Are CBS periodically reviewed and updated? | Governance | Review logs | |
#### **Section 3. Mapping of Interconnections and Dependencies**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| End-to-End Mapping | Are CBS mapped end-to-end (processes, systems, people)? | Mapping | Process maps | |
| Dependency Identification | Are dependencies (people, process, technology, third parties) identified? | Mapping | Dependency tables | |
| Interconnections | Are internal and external interconnections clearly documented? | Mapping | Architecture diagrams | |
| Third-Party Mapping | Are third parties mapped to specific CBS? | Third-Party Risk | Vendor mapping | |
| Concentration Risk | Are concentration risks and single points of failure identified? | Risk Management | Risk assessments | |
| Updates | Are mappings updated after changes (outsourcing, system changes)? | Governance | Change logs | |
#### **Section 4. Tolerance for Disruption \[Impact Tolerance\]**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Definition | Has impact tolerance been defined for each CBS? | Impact Tolerance | Impact tolerance statements | |
| Metrics | Are tolerances defined using measurable metrics (e.g., time, data loss)? | Impact Tolerance | BIA outputs | |
| Impact Dimensions | Are tolerances based on customer harm, financial loss, or regulatory breach? | Impact Tolerance | Impact analysis | |
| Approval | Are tolerances approved by senior management/Board? | Governance | Approval records | |
| Alignment | Are tolerances aligned with risk appetite? | Risk Management | Risk appetite statements | |
#### **Section 5. Risk Identification, Assessment, and Control (ORM Integration)**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Risk Framework | Is there an operational risk management framework supporting OR? | Risk Management | ORM policy | |
| Risk Identification | Are risks identified across CBS and dependencies? | Risk Management | Risk registers | |
| Risk Assessment | Are risks assessed for likelihood and impact? | Risk Management | Risk assessment reports | |
| Controls | Are controls implemented to mitigate risks? | Risk Management | Control matrices | |
| Residual Risk | Are residual risks monitored against risk appetite? | Risk Management | Risk dashboards | |
#### **Section 6. Scenario Testing – Severe but Plausible Scenarios**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Testing Programme | Is there a structured scenario testing programme? | Scenario Testing | Testing plan/ calendar | |
| Scenario Design | Are scenarios severe but plausible? | Scenario Testing | Scenario library | |
| Coverage | Do scenarios cover cyber, third-party, and operational disruptions? | Scenario Testing | Scenario documentation | |
| End-to-End Testing | Are CBS tested end-to-end against impact tolerances? | Scenario Testing | Test reports | |
| Third-Party Inclusion | Are third parties included in tests? | Third-Party Risk | Participation records | |
| Outcome Analysis | Are results analysed against impact tolerances? | Scenario Testing | Test evaluation reports | |
| Remediation | Are gaps identified and remediation tracked? | Improvement | Action logs | |
#### **Section 7. Business Continuity and Recovery Capabilities**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| BCM Framework | Is there a BCM framework aligned to OR? | BCM | BCM policy | |
| Recovery Strategies | Are recovery strategies defined for CBS? | BCM | Strategy documents | |
| Recovery Plans | Are plans documented and maintained? | BCM | BCPs, DRPs | |
| Resource Availability | Are recovery resources (people, systems, sites) available? | BCM | Resource inventories | |
| Testing | Are recovery plans regularly tested? | BCM | Test reports | |
#### **Section 8. Technology and Cyber Resilience**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| System Resilience | Are systems designed for resilience (redundancy, failover)? | Technology Risk | Architecture diagrams | |
| Cyber Resilience | Are cyber risks integrated into the OR framework? | Technology Risk | Cyber frameworks | |
| Incident Response | Is there a cyber incident response capability? | Technology Risk | IR plans | |
| Monitoring | Are systems monitored for disruptions and threats? | Technology Risk | Monitoring dashboards | |
| Data Protection | Are data backup and recovery mechanisms implemented? | Technology Risk | Backup logs | |
#### **Section 9. Third-Party Risk Management**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Identification | Are critical third parties identified? | Third-Party Risk | Vendor inventory | |
| Due Diligence | Are risk assessments conducted before onboarding? | Third-Party Risk | DD reports | |
| Contractual Controls | Are resilience clauses included in contracts? | Third-Party Risk | Contracts | |
| Monitoring | Are third-party risks continuously monitored? | Third-Party Risk | Performance reports | |
| Exit Strategy | Are exit/contingency plans defined? | Third-Party Risk | Exit plans | |
| Subcontracting Risk | Are subcontractor risks assessed? | Third-Party Risk | Vendor disclosures | |
#### **Section 10. Incident and Crisis Management**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Incident Framework | Is there a formal incident management framework? | Incident Management | Incident procedures | |
| Escalation | Are escalation thresholds defined? | Incident Management | Escalation matrix | |
| Crisis Structure | Is there a crisis management team and structure? | Crisis Management | Org charts | |
| Communication | Are communication protocols defined (internal/external)? | Crisis Management | Communication plans | |
| Regulatory Reporting | Are BSP notification requirements defined? | Governance | Reporting procedures | |
| Lessons Learned | Are post-incident reviews conducted? | Improvement | Review reports | |
#### **Section 11. Continuous Improvement and Assurance**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Improvement Framework | Is there a structured improvement process? | Continuous Improvement | Improvement logs | |
| Audit and Assurance | Is OR subject to an independent audit? | Assurance | Audit reports | |
| Metrics | Are resilience metrics (KPIs/KRIs) tracked? | Monitoring | Dashboards | |
| Issue Tracking | Are issues tracked to closure? | Monitoring | Issue logs | |
| Regulatory Alignment | Are frameworks reviewed against BSP updates? | Governance | Gap analysis | |
#### **Section 12. Change Management and Forward-Looking Resilience**
| Audit Area | Audit Checklist Questions | BSP 1203 Focus | Evidence Required | Rating |
| --- | --- | --- | --- | --- |
| Change Management | Is there a formal change management process? | Governance | Change policies | |
| Risk Assessment | Are changes assessed for resilience impact? | Risk Management | Change risk assessments | |
| New Initiatives | Are resilience considerations embedded in new products/services? | Governance | Product approval docs | |
| Emerging Risks | Are emerging risks (cyber, fintech, geopolitical) assessed? | Risk Management | Risk reports | |
| Resilience Roadmap | Is there a forward-looking OR roadmap? | Strategy | Roadmap documents | |
#### **Scoring and Audit Interpretation**
##### **Rating Scale**
For each question, assign:
- **[](https://cta-redirect.hubspot.com/cta/redirect/3893111/0af71759-22de-47bb-91cb-25955fdc310e)Level 0: Ad-hoc:** Reactive, unstructured processes. **Non-Compliant**
- **Level 1: Reactive:** Basic frameworks with sporadic execution. **(Documented but inconsistent)**
- **Level 2: Proactive:** Formal policies and dedicated teams. **(Documented)**
- **Level 3: Mature:** Anticipatory risk management. **(Consistent execution)**
- **Level 4: Advanced**: Integrated, data-driven strategies. **(Measured and monitored)**
- **Level 5: Leading**: Predictive analytics and automation. **(Continuous improvement and leading practice)**
- **Level 6: Excellence**: Industry leadership through innovation.
##### **Audit Outcome Categories**
- **Regulatory Gap (L0–L2):** Immediate remediation required
- **Compliant (L3-L4):** Meets MAS minimum expectations
- **Mature (L5–L6):** Demonstrates strong resilience capability
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/5404effa-ac11-44ba-a782-31a19cc7ef69)
### **Key Takeaways (Aligned to BSP Direction)**
This BSP 1203-aligned checklist enables BSFIs to:
- Demonstrate **compliance with BSP operational resilience expectations**
- Validate **end-to-end resilience of Critical Operations**
- Strengthen **scenario testing and tolerance for disruption alignment**
- Transition from **traditional BCM → integrated operational resilience capability**
#### More Information About Blended Learning OR-5000 \[BL-OR-5\] or OR-300 \[BL-OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-04-26T14:11:26.675Z",
"datePublished" : "2026-04-26T11:49:52.000Z",
"headline" : "[OR] [MM] [BSP] Regulatory Audit Checklist: BSP Circular 1203 (Operational Resilience)",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-mm-bsp-regulatory-audit-checklist-bsp-circular-1203-operational-resilience",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```