[OR] [Pillar] [E3] [C1] Business Continuity, Crisis Management, and Incident Management as a Key Pillar of Operational Resilience

eBook 3: Chapter 1

Business Continuity, Crisis Management, and Incident Management as a Key Pillar of Operational Resilience

Introduction

Operational resilience has emerged as a defining capability for organisations operating in an increasingly volatile, interconnected, and risk-prone environment.

Regulatory expectations, particularly within the financial services sector, now emphasise not only the ability to recover from disruptions but also the capability to continue delivering critical business services under severe but plausible scenarios.

At the heart of this capability lies a set of well-established disciplines:

Business Continuity Management (BCM), Crisis Management (CM), and Incident Management (IM).

These three disciplines, when effectively integrated, form a key pillar of operational resilience, enabling organisations to respond to disruptions in a structured, coordinated, and sustainable manner.

This chapter introduces how BCM, CM, and IM collectively support operational resilience and explains why their integration is essential for organisations seeking to move beyond traditional recovery planning towards true resilience thinking.

Understanding Operational Resilience

Operational resilience refers to an organisation’s ability to:

• Prevent and withstand disruptions
• Adapt to changing conditions
• Recover and resume operations within acceptable thresholds
• Continue delivering critical business services

Unlike traditional risk management or business continuity, operational resilience adopts a service-centric perspective, focusing on outcomes rather than internal processes alone.

Key characteristics of operational resilience include:

• Focus on Critical Business Services (CBS)
• Defined Impact Tolerances (e.g., maximum tolerable downtime)
• Emphasis on end-to-end dependencies (people, process, technology, third parties)
• Continuous scenario testing and improvement

Within this framework, BCM, CM, and IM are not standalone functions—they are core enablers of resilience execution.

Business Continuity Management (BCM) as the Foundation of Service Continuity

Business Continuity Management provides the structured approach required to ensure that critical services can continue during and after a disruption.

Core Capabilities of BCM

• Identification of critical business services and functions
• Conduct of Business Impact Analysis (BIA)
• Development of Business Continuity Plans (BC Plans)
• Establishment of Disaster Recovery (DR) strategies
• Definition of Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)

Role in Operational Resilience

Within operational resilience, BCM:

• Defines what must be protected and sustained
• Establishes minimum service levels during disruption
• Provides structured recovery pathways
• Ensures alignment with impact tolerance thresholds

Key Contribution

BCM serves as the foundation of resilience, ensuring that organisations are not only prepared for disruptions but are also capable of maintaining operations within acceptable limits.

Crisis Management (CM) as the Strategic Coordination Layer

Crisis Management operates at the strategic and leadership level, ensuring that disruptions are managed in a coordinated and controlled manner across the organisation.

Core Capabilities of CM

• Activation of crisis management structures
• Strategic decision-making under uncertainty
• Coordination across business units and functions
• Stakeholder communication, including regulators, customers, and media
• Protection of brand and reputation

Role in Operational Resilience

Crisis Management:

• Provides governance and leadership during disruption
• Aligns response efforts with organisational priorities
• Enables rapid escalation and decision-making
• Ensures consistent communication

Key Contribution

Crisis Management serves as the command-and-control function, ensuring that the organisation responds decisively and cohesively during high-impact events.

Incident Management (IM) as the First Line of Response

Incident Management is the operational front line, responsible for the immediate handling of disruptions as they occur.

Core Capabilities of IM

• Detection and identification of incidents
• Rapid response and containment
• Restoration of affected systems and processes
• Escalation protocols to crisis management
• Real-time incident tracking and reporting

Role in Operational Resilience

Incident Management:

• Provides early-stage response capability
• Minimises disruption impact at the source
• Supplies real-time situational awareness
• Enables informed decision-making by crisis teams

Key Contribution

Incident Management serves as the first line of defence, ensuring that disruptions are quickly identified, contained, and managed before escalation.

The Integrated Role of BCM, CM, and IM in Operational Resilience

Operational resilience is achieved through the integration of BCM, CM, and IM—not through isolated implementation.

Integrated Disruption Lifecycle

End-to-End Flow

• Incident Occurs
  → Managed by Incident Management through immediate response

• Escalation to Crisis Level
  → Crisis Management coordinates enterprise-wide actions

• Sustained Disruption
  → BCM ensures continuity of critical services

• Recovery and Stabilisation
  → Organisation restores normal operations

• Post-Incident Learning
  → Enhancements made to strengthen resilience

Alignment with Regulatory Expectations

Regulators such as central banks and supervisory authorities (e.g., BSP, BNM, MAS, PRA) increasingly require organisations to demonstrate:

• Identification of Critical Business Services
• Defined Impact Tolerances
• Evidence of end-to-end mapping
• Regular scenario testing
• Integration of response, recovery, and communication capabilities

BCM, CM, and IM collectively enable compliance with these requirements by ensuring that organisations can:

• Respond effectively to disruptions
• Maintain service delivery within tolerances
• Demonstrate resilience under stress scenarios

From Recovery to Resilience: A Paradigm Shift

Traditional approaches focused on recovery after disruption. Operational resilience, however, requires organisations to:

• Anticipate disruptions
• Withstand impacts
• Adapt dynamically
• Continue delivering services

This shift transforms BCM, CM, and IM from reactive disciplines into proactive, integrated resilience capabilities.

Business Continuity Management, Crisis Management, and Incident Management together form a critical pillar of operational resilience, enabling organisations to manage disruption across its entire lifecycle.

• Incident Management ensures rapid detection and response
• Crisis Management provides strategic direction and coordination
• Business Continuity Management ensures sustained service delivery and recovery

When integrated, these disciplines allow organisations to move beyond fragmented response mechanisms and towards a holistic, service-centric resilience model.

Operational resilience is ultimately about ensuring continuity of value delivery, even under the most challenging circumstances. BCM, CM, and IM provide the operational backbone that makes this possible.