[OR] [P2] [S1] [CBS] [C8] Practical Example (Illustrative Case Study)

[P2] [S1] Chapter 8

Practical Example (Illustrative Case Study)

Introduction

Identifying Critical Business Services (CBS) is a foundational step in operational resilience, yet organisations frequently encounter challenges that can undermine the effectiveness of this exercise.

These pitfalls often arise from entrenched organisational thinking, lack of clarity in definitions, or insufficient governance and collaboration.

Understanding these common issues is essential to avoid misalignment and ensure that CBS identification remains robust, defensible, and aligned with regulatory expectations.

To translate the concepts and methodology of identifying Critical Business Services (CBS) into practice, this section presents an illustrative case study of a mid-sized universal bank operating in a regulated financial environment. The example demonstrates how an organisation systematically applies the CBS identification methodology, from service inventory to final validation, while aligning with operational resilience expectations.

Overview of the Sample Organisation

The sample organisation, referred to as ABC Bank, provides a range of retail and corporate banking services, including deposits, payments, lending, and digital banking. The bank operates across multiple channels—branches, mobile applications, internet banking, and ATMs—and relies on both internal systems and third-party providers.

Given its role in financial intermediation and customer fund access, the bank is subject to regulatory expectations requiring it to identify, prioritise, and ensure the resilience of its most critical services.

Step 1: Identify All Business Services

ABC Bank begins by creating a comprehensive inventory of its business services, grouped by major business lines:

At this stage, the focus is on completeness rather than criticality, ensuring no significant service is omitted.

Step 2: Define Service Boundaries

Each service is then defined from an end-to-end perspective. For example:

• Service Name: Deposit and Account Services
• Start Point: Customer initiates account opening or transaction
• End Point: Successful account setup or completion of deposit/withdrawal transaction
• Channels Covered: Branch, ATM, mobile banking, internet banking
• Dependencies: Core banking system, customer identification systems, payment networks, third-party KYC providers

This step ensures that services are clearly distinguished from internal processes and are anchored on customer outcomes.

Step 3: Establish Criticality Criteria

ABC Bank defines a set of criticality criteria aligned with regulatory expectations and business priorities:

Each criterion is supported by defined thresholds (e.g., number of customers affected, duration of disruption, financial loss levels).

Step 4: Assess and Score Services

Using the defined criteria, services are assessed and scored. A simplified scoring example is shown below:

The scoring process highlights services that, if disrupted, would cause severe customer harm or regulatory consequences.

Step 5: Validate with Stakeholders

The preliminary results are reviewed through structured validation sessions involving:

• Business unit heads
• Risk and compliance teams
• IT and operations representatives
• Senior management

During these sessions:

• Assumptions are challenged
• Dependencies are clarified
• Edge cases and scenarios are discussed

For example, stakeholders may elevate the criticality of “Domestic Funds Transfer” due to its role in salary payments and business transactions.

Step 6: Finalise the List of CBS

Following validation and governance review, ABC Bank finalises its list of Critical Business Services:

These services are formally approved by the bank’s risk committee and documented with version control for audit and regulatory purposes.

Key Dependencies Identified

For each CBS, the bank identifies critical dependencies. For example, for Deposit and Account Services:

• People: Branch staff, operations teams, customer support
• Technology: Core banking system, authentication systems, mobile banking platform
• Third Parties: KYC verification providers, cloud service providers, payment networks
• Processes: Account opening, transaction processing, reconciliation

This forms the basis for subsequent activities such as dependency mapping and scenario testing.

Key Observations from the Case Study

The case study highlights several important lessons:

• A structured methodology ensures consistency and defensibility in CBS identification
• Stakeholder validation is critical to avoid blind spots and ensure alignment
• Not all high-revenue services are necessarily critical—customer impact is the primary driver
• Digital channels increasingly represent critical access points for customers

This illustrative case study demonstrates how an organisation can move from theory to practice in identifying Critical Business Services. By following a structured, criteria-driven, and collaborative approach, ABC Bank is able to clearly identify the services that are most vital to its customers and the broader financial system.

The outputs of this exercise—namely the defined CBS, supporting rationale, and identified dependencies—serve as the foundation for the next stages of operational resilience, including impact tolerance setting, mapping, and scenario testing.