---
title: [OR] [P2] [S5] [LL] [C13] Regulatory Expectations and Compliance
description: [OR] [P2] [S5] [LL] [C13] Regulatory Expectations and Compliance
image: https://blog.bcm-institute.org/hubfs/OR%20Implement%20Mapping%20Graphic/OR%20Implement%20Series%20Lesson%20Learned%20Morepost/%5BOR%5D%20%5BP2%5D%20%5BS5%5D%20%5BLL%5D%20%5BC13%5D%20Regulatory%20Expectations%20and%20Compliance.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Improving Lessons Learned: Strengthening Operational Resilience Through Continuous Improvement
# \[OR\] \[P2\] \[S5\] \[LL\] \[C13\] Regulatory Expectations and Compliance
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b69ddd1-f01e-4fa9-a2e1-ffa60ba221fc)
Regulators globally have shifted their focus from **framework design and documentation** to **demonstrable resilience outcomes**. Organisations are no longer assessed solely on whether they have plans and policies, but on whether they can:
- Learn from disruptions
- Continuously improve resilience capabilities
- Maintain delivery of **Critical Business Services (CBS)** within impact tolerances
At the centre of this shift lies the **Lessons Learned capability**, which serves as evidence that an organisation can:
- Adapt to evolving risks
- Strengthen controls
- Enhance service resilience
This chapter outlines key regulatory expectations and how organisations can ensure compliance through effective lessons learned processes.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/2545ed73-a288-4ae5-9525-acc4b7887e4c)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 14, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c164f95-e606-4b33-8624-b491c3f0fa1a)
### \[P2\] \[S5\] Chapter 13
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/4b69ddd1-f01e-4fa9-a2e1-ffa60ba221fc)Regulatory Expectations and Compliance
#### **Introduction**
Regulators globally have shifted their focus from **framework design and documentation** to **demonstrable resilience outcomes**. Organisations are no longer assessed solely on whether they have plans and policies, but on whether they can:
- Learn from disruptions
- Continuously improve resilience capabilities
- Maintain delivery of **Critical Business Services (CBS)** within impact tolerances
At the centre of this shift lies the **Lessons Learned capability**, which serves as evidence that an organisation can:
- Adapt to evolving risks
- Strengthen controls
- Enhance service resilience
This chapter outlines key regulatory expectations and how organisations can ensure compliance through effective lessons learned processes.
#### **Purpose of the Chapter**
To provide a comprehensive understanding of **regulatory expectations related to Lessons Learned and continuous improvement** in operational resilience, and to guide organisations in aligning their frameworks, processes, and evidence with supervisory requirements across key jurisdictions.
#### **The Regulatory Shift: From Compliance to Resilience**
##### **Traditional Approach**
- Focus on:
- Limited emphasis on outcomes
##### **Modern Regulatory Expectations**
- Focus on:
- Evidence-based supervision
##### **Implications for Organisations**
Organisations must demonstrate:
- Real-world resilience
- Effective learning from disruptions
- Continuous enhancement of capabilities
#### **Core Regulatory Themes for Lessons Learned**
Across jurisdictions, regulators consistently emphasise:
##### **Continuous Improvement**
- Ongoing enhancement of resilience capabilities
- Integration of lessons learned into frameworks
##### **Scenario Testing and Learning**
- Use of testing outcomes to improve resilience
- Iterative refinement of scenarios
##### **Service-Centric Approach**
- Focus on CBS rather than individual components
##### **Governance and Accountability**
- Clear ownership of lessons learned
- Strong oversight mechanisms
##### **Evidence and Documentation**
- Demonstrable records of:
#### **Key Regulatory Frameworks and Expectations**
##### **Monetary Authority of Singapore (MAS)**
MAS expects financial institutions to:
- Identify Critical Business Services
- Conduct scenario testing
- Analyse outcomes and identify gaps
- Implement improvements to maintain service continuity
##### **Relevance to Lessons Learned:**
- Lessons learned must feed into:
- Evidence of continuous improvement is required
##### **Bangko Sentral ng Pilipinas (BSP Circular 1203)**
BSP requires institutions to:
- Conduct post-incident reviews
- Analyse disruptions and their causes
- Continuously improve operational resilience
##### **Relevance to Lessons Learned:**
- Mandatory capture and analysis of lessons
- Integration into resilience frameworks
- Demonstration of improvement over time
##### **Bank Negara Malaysia (BNM)**
BNM emphasises:
- Ongoing monitoring and review
- Continuous enhancement of resilience capabilities
- Integration with risk management
##### **Relevance to Lessons Learned:**
- Lessons must inform:
- Strong governance and oversight required
##### **UK PRA and FCA**
UK regulators require firms to:
- Remain within impact tolerances
- Conduct regular scenario testing
- Continuously improve resilience
##### **Relevance to Lessons Learned:**
- Lessons learned must:
- Evidence of learning from testing outcomes
#### **Alignment with International Standards**
##### **ISO 22301 (Business Continuity Management)**
ISO 22301 requires organisations to:
- Monitor and review performance
- Conduct internal audits
- Implement corrective actions
- Ensure continual improvement
##### **Lessons Learned Role:**
- Identify non-conformities
- Drive corrective actions
- Enhance BCMS effectiveness
##### **ISO 22361 (Crisis Management)**
ISO 22361 emphasises:
- Post-crisis reviews
- Learning from crisis events
- Improving response capabilities
##### **Lessons Learned Role:**
- Capture insights from crisis management
- Improve decision-making processes
#### **Evidence Required by Regulators**
Regulators expect organisations to provide **clear and auditable evidence** of lessons learned processes.
**13.6.1 Key Evidence Components**
| **Evidence Type** | **Description** |
| --- | --- |
| Lessons Learned Register | Record of identified lessons |
| Root Cause Analysis Reports | Detailed analysis of incidents |
| Action Tracking Logs | Status of improvement actions |
| Scenario Testing Reports | Outcomes and improvements |
| Management Reports | Oversight and governance evidence |
##### **Demonstrating Effectiveness**
Organisations must show:
- Actions are implemented
- Improvements are effective
- Risks are reduced
#### **Regulatory Audit and Assessment**
##### **Key Audit Questions**
- Are lessons learned systematically captured?
- Is root cause analysis conducted effectively?
- Are improvement actions implemented and tracked?
- Are lessons integrated into resilience frameworks?
- Is there evidence of continuous improvement?
##### **Scoring Criteria**
| Rating | Description |
| --- | --- |
| Fully Demonstrated | Comprehensive and effective implementation |
| Partially Demonstrated | Some gaps in process or execution |
| Not Demonstrated | Lack of evidence or ineffective implementation |
#### **Integration with Risk and Compliance Frameworks**
##### **Operational Risk Management (ORM)**
- Lessons feed into risk identification
- Strengthen controls
##### **Compliance**
- Ensure adherence to regulatory requirements
- Support regulatory reporting
##### **Internal Audit**
- Validate effectiveness of lessons learned processes
- Provide independent assurance
#### **Challenges in Meeting Regulatory Expectations**
##### **Lack of Structured Framework**
- Inconsistent processes
##### **Weak Governance**
- Poor accountability
##### **Insufficient Evidence**
- Lack of documentation
##### **Limited Integration**
- Lessons not embedded across functions
#### **Best Practices for Compliance**
##### **Establish a Formal Framework**
- Define processes and governance
##### **Maintain Comprehensive Documentation**
- Ensure auditability
##### **Integrate Lessons Across Functions**
- Align with risk, BCM, and crisis management
##### **Conduct Regular Reviews**
- Ensure continuous improvement
##### **Engage with Regulators**
- Demonstrate transparency
#### **Case Example: Regulatory Compliance in Banking**
**Scenario**
A bank undergoes regulatory review for operational resilience.
**Findings**
- Weak lessons learned process
- Incomplete action tracking
**Actions Taken**
- Implemented structured framework
- Enhanced governance and reporting
**Outcome**
- Improved regulatory compliance
- Strengthened resilience capabilities
#### [![\[Banner\] \[Summing\] \[OR\] \[E2\] \[C13\] Improving Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/71190ffb-94e6-4ae9-b40a-8f29585ab4ec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/71190ffb-94e6-4ae9-b40a-8f29585ab4ec)
Regulatory expectations for operational resilience are increasingly focused on **continuous improvement and demonstrable outcomes**. Lessons learned play a central role in meeting these expectations by providing evidence that organisations can:
- Learn from disruptions
- Improve resilience capabilities
- Protect Critical Business Services
By aligning lessons learned processes with regulatory requirements, organisations can:
- Enhance compliance
- Strengthen governance
- Achieve resilience maturity
##### **Transition to Next Chapter**
With regulatory expectations clearly defined, the next chapter will explore **common challenges and pitfalls in implementing lessons learned**, providing practical insights into how organisations can overcome barriers and improve effectiveness.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/49818a85-5555-4d5b-a3ca-28d5300db18b)
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** |
| --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[P2\] \[S5\] \[LL\] \[C1\] Introduction to Lessons Learned in OR](https://no-cache.hubspot.com/cta/default/3893111/b76a622a-f295-4503-87fa-4c58f5f087a8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b76a622a-f295-4503-87fa-4c58f5f087a8) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C2\] The Role of Lessons Learned in the OR Lifecycle](https://no-cache.hubspot.com/cta/default/3893111/b9f0d952-dfd0-400d-b37f-24d9c59f2baa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b9f0d952-dfd0-400d-b37f-24d9c59f2baa) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C3\] Governance and Ownership of Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/8e352c01-ff6a-4ff6-b81b-90ad0ad15f46.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8e352c01-ff6a-4ff6-b81b-90ad0ad15f46) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C4\] Sources and Triggers for Capturing Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/856c1acb-96c5-49ed-afa3-ffbb8e61d9e6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/856c1acb-96c5-49ed-afa3-ffbb8e61d9e6) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C5\] Lessons Learned Framework and Methodology](https://no-cache.hubspot.com/cta/default/3893111/c86a2b1e-05a8-44b9-a74f-730d85b6d046.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c86a2b1e-05a8-44b9-a74f-730d85b6d046) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C6\] Root Cause Analysis (RCA) Techniques](https://no-cache.hubspot.com/cta/default/3893111/b3d2f707-1f82-4f0a-8d51-f3451c78c337.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3d2f707-1f82-4f0a-8d51-f3451c78c337) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12 ** |
| [![\[OR\] \[P2\] \[S5\] \[LL\] \[C7\] Linking Lessons Learned to CBS](https://no-cache.hubspot.com/cta/default/3893111/f484c1bf-992a-4298-8752-6fec87c33912.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f484c1bf-992a-4298-8752-6fec87c33912) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C8\] Integration with Scenario Testing and Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5eaa1a40-8d88-414b-8f38-9db2edd6ca0b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5eaa1a40-8d88-414b-8f38-9db2edd6ca0b) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C9\] Developing and Prioritising Improvement Actions](https://no-cache.hubspot.com/cta/default/3893111/af3c93f2-7736-4431-84d3-664e4bc9e425.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/af3c93f2-7736-4431-84d3-664e4bc9e425) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C10\] Embedding Continuous Improvement](https://no-cache.hubspot.com/cta/default/3893111/505103ad-4012-41a7-9fb9-afda3baeb58d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/505103ad-4012-41a7-9fb9-afda3baeb58d) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C11\] Communication of Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/fba3d8cc-8854-4f13-9408-37d1ebc49091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fba3d8cc-8854-4f13-9408-37d1ebc49091) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C12\] Technology and Tools for Lessons Learned Management](https://no-cache.hubspot.com/cta/default/3893111/2b75ccca-cdc3-4327-84ff-e06677302878.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2b75ccca-cdc3-4327-84ff-e06677302878) |
| **C13** | **C14** | **C15** | **C16** | **C17** | **C18** |
| [![\[OR\] \[P2\] \[S5\] \[LL\] \[C13\] Regulatory Expectations and Compliance](https://no-cache.hubspot.com/cta/default/3893111/516c631b-bb38-4b5f-9446-afcedbe2751c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/516c631b-bb38-4b5f-9446-afcedbe2751c) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C14\] Common Challenges and Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/afb5b7fb-efcb-4832-a6bd-44f3f36c97ee.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/afb5b7fb-efcb-4832-a6bd-44f3f36c97ee) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C15\] Practical Case Study (Banking Sector Example)](https://no-cache.hubspot.com/cta/default/3893111/9769f9fc-a994-4962-b5cf-7b2aa9ad5875.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9769f9fc-a994-4962-b5cf-7b2aa9ad5875) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C16\] Future Trends in Lessons Learned](https://no-cache.hubspot.com/cta/default/3893111/b0a94161-20fe-4a63-a164-12d2be9c007c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b0a94161-20fe-4a63-a164-12d2be9c007c) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C17\] Key Takeaways and Call to Action](https://no-cache.hubspot.com/cta/default/3893111/edcf7673-1c76-45e7-9b70-12cda97ceac6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/edcf7673-1c76-45e7-9b70-12cda97ceac6) | [![\[OR\] \[P2\] \[S5\] \[LL\] \[C18\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/6b6d918c-c6a7-4861-8e83-5760b1c19713.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6b6d918c-c6a7-4861-8e83-5760b1c19713) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-14T15:29:50.733Z",
"datePublished" : "2026-05-14T13:33:47.000Z",
"headline" : "[OR] [P2] [S5] [LL] [C13] Regulatory Expectations and Compliance",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-p2-s5-ll-c13-regulatory-expectations-and-compliance",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```