[OR] [PBCOM] [E2] [C1] OR Planning Methodology

eBook 2: Chapter 1

Strengthening Operational Resilience in the Philippine Bank of Communications

Introduction

For The Philippine Bank of Communications (PBCOM), operational resilience is not a standalone initiative but a structured, enterprise-wide capability that ensures the bank can deliver its critical business services consistently through disruption.

In line with global best practices and the regulatory expectations of the Bangko Sentral ng Pilipinas (BSP), particularly Circular No. 1203 on Operational Resilience, PBCOM must adopt a disciplined, phased methodology to design, implement, and sustain operational resilience across its operations.

The Operational Resilience Planning Methodology for PBCOM is therefore organised into three interrelated phases: Plan, Implement, and Sustain.

Each phase comprises five structured stages that collectively guide the bank from understanding its current resilience posture to building robust capabilities, and ultimately embedding resilience into its culture and governance.

This phased approach ensures that resilience is strategic, measurable, and continuously improving, rather than reactive or fragmented.

Purpose of the Chapter

The purpose of this chapter is to provide a clear and structured overview of the three phases of PBCOM’s Operational Resilience Planning Methodology, enabling stakeholders to understand how resilience is systematically developed, implemented, and sustained across the organisation.

By the end of this chapter, the reader is expected to:

• Understand the end-to-end lifecycle of operational resilience within PBCOM
• Recognise how each phase contributes to regulatory compliance, particularly with BSP Circular No. 1203
• Appreciate the logical progression from capability assessment to implementation and long-term sustainability
• Be prepared to apply the methodology to subsequent chapters, including Critical Business Services (CBS), dependency mapping, impact tolerances, and scenario testing

This chapter sets the foundation for all subsequent operational resilience activities by ensuring that readers have a common framework and language for understanding how resilience is built and maintained within PBCOM.

Overview of the Three Phases of Operational Resilience Planning Methodology

PBCOM’s Operational Resilience Planning Methodology is structured into three key phases:

• Phase 1: Plan – Establishing the foundation through assessment, strategy, and governance

• Phase 2: Implement – Operationalising resilience through identification, mapping, testing, and improvement

• Phase 3: Sustain – Embedding resilience into culture, capability, and continuous assurance

Each phase is essential and interdependent, ensuring that resilience is not only designed effectively but also executed and maintained over time.

Phase 1: Plan – Establishing the Foundations

The Plan Phase focuses on understanding PBCOM’s current resilience posture and establishing a structured roadmap aligned with regulatory expectations and business priorities.

Stages in Phase 1

• Assess Capability and Maturity [Stage 1]
  Evaluate the current state of PBCOM’s operational resilience capabilities across governance, risk management, business continuity, IT resilience, and third-party management. This includes benchmarking against BSP requirements and industry standards.

• Analyse Gap [Stage 2]
  Identify gaps between the current state and the desired target state. This includes deficiencies in policies, processes, tools, and organisational readiness.

• Develop Strategy and Roadmap [Stage 3]
  Formulate a structured roadmap to close identified gaps. This includes prioritising initiatives, setting timelines, allocating resources, and aligning with the business strategy.

• Confirm Risk Appetite [Stage 4]
  Define and validate the level of disruption PBCOM is willing to tolerate. This aligns resilience objectives with the bank’s overall risk appetite and strategic direction.

• Develop and Embed Governance [Stage 5]
  Establish governance structures, roles, responsibilities, and oversight mechanisms. This ensures accountability at the Board and senior management levels, in line with BSP expectations.

Phase 2: Implement – Translating Strategy into Action

The Implement Phase translates strategy into action by focusing on delivering and protecting critical business services (CBS).

Stages in Phase 2

• Identify Critical Business Services [Stage 1]
  Determine the services that are essential to customers and the financial system. These services become the primary focus of resilience efforts.

• Map Processes and Resources [Stage 2]
  Identify and document the end-to-end processes, people, technology, facilities, and third-party dependencies that support each CBS.

• Set Impact Tolerance [Stage 3]
  Define the maximum acceptable level of disruption for each CBS, including metrics such as downtime, data loss, and customer impact.

• Conduct Scenario Testing [Stage 4]
  Test the bank’s ability to remain within impact tolerances under severe but plausible scenarios, such as cyberattacks, system outages, or third-party failures.

• Improve Lesson Learned [Stage 5]
  Capture insights from testing and real incidents to enhance resilience capabilities, close gaps, and refine strategies.

Phase 3: Sustain – Embedding and Continuously Improving Resilience

The Sustain Phase ensures that operational resilience becomes an integral and enduring part of PBCOM’s organisational culture and management practices.

Stages in Phase 3

• Introduce Cultural Change [Stage 1]
  Promote a resilience-first mindset across all levels of the organisation, ensuring that employees understand their role in maintaining service continuity.

• Develop Communication Strategy [Stage 2]
  Establish clear communication frameworks for internal and external stakeholders during both normal operations and disruptions.

• Implement Training and Awareness [Stage 3]
  Conduct regular training programs, exercises, and awareness campaigns to build organisational capability and readiness.

• Provide Self-assessment [Stage 4]
  Enable business units and functions to regularly assess their own resilience capabilities against defined standards and expectations.

• Conduct Independent Quality Review [Stage 5]
  Perform independent reviews and audits to validate the operational resilience framework's effectiveness and ensure continuous improvement.
  

The three-phase Operational Resilience Planning Methodology provides The Philippine Bank of Communications with a structured and repeatable approach to achieving resilience in line with regulatory expectations and industry best practices.

By progressing through the Plan, Implement, and Sustain phases, PBCOM can systematically build, operationalise, and embed resilience across its critical business services.

This methodology ensures that resilience is not treated as a one-time initiative but as a continuous cycle of assessment, execution, and improvement, enabling PBCOM to remain robust, responsive, and reliable in the face of evolving risks and disruptions.

Blogs marked [x] are under construction.

ebook 2: Implementing Operational Resilience for the Rizal Commercial Banking Corporation
C1	C2 [x]	C8 [x]	C14 [x]

	BSP OR Policy	eBook 1	eBook 2	eBook 3	C20 [x]	C21 [x]
	"Plan" Phase of the Operational Resilience Planning Methodology
	C2 [x]	C3 [x]	C4 [x]	C5 [x]	C6 [x]	C7 [x]
	"Implement" Phase of the Operational Resilience Planning Methodology
	C8 [x]	C9 [x]	C10 [x]	C11 [x]	C12 [x]	C13 [x]
	"Sustain" Phase of the Operational Resilience Planning Methodology
	C14 [x]	C15 [x]	C16 [x]	C17 [x]	C18 [x]	C19 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.