[OR] [RCBC] [E2] [C1] OR Planning Methodology

eBook 2: Chapter 1

Implementing Operational Resilience at Rizal Commercial Banking Corporation: A Practical Guide

Introduction

Operational resilience has become a strategic priority for banks operating in increasingly complex, digital, and interconnected environments.

For Rizal Commercial Banking Corporation (RCBC), the ability to prevent, adapt, respond to, and recover from disruptions is critical to maintaining customer trust, regulatory compliance, and financial stability.

Guided by regulatory expectations such as BSP Circular No. 1203, Series of 2024, RCBC must adopt a structured, comprehensive approach to ensure that its critical business services remain within acceptable levels of disruption, even during severe but plausible events.

Purpose of the Chapter

The purpose of this chapter is to provide a clear and structured overview of RCBC’s Operational Resilience Planning Methodology, enabling readers to understand how resilience is systematically designed, implemented, and sustained across the organisation.

It introduces the three phases and their respective stages, offering a roadmap that aligns with regulatory expectations and industry best practices.

By the end of this chapter, the reader is expected to gain a comprehensive understanding of how RCBC structures its resilience programme—from assessing its current capability and defining its strategic direction, to embedding resilience into day-to-day operations and sustaining it through governance, culture, and continuous improvement.

This foundational understanding prepares the reader for subsequent chapters that will explore each phase and stage in greater detail.

Overview of the Three Phases of Operational Resilience Planning Methodology

 RCBC’s Operational Resilience Planning Methodology is structured into three distinct but interrelated phases:

1. Phase 1: Plan – Establishing the foundation of resilience through assessment, strategy, and governance
   

2. Phase 2: Implement – Operationalising resilience across critical business services
   

3. Phase 3: Sustain – Embedding resilience into organisational culture and continuous improvement
   

Each phase consists of five stages, forming a comprehensive and iterative framework.

Phase 1: Plan – Establishing the Foundations

The Plan Phase focuses on understanding RCBC’s current resilience posture, identifying gaps, and establishing a strategic direction supported by governance and risk appetite.

Stages in Phase 1

• Assess Capability and Maturity [Stage 1]
  RCBC evaluates its current operational resilience capabilities across business continuity, IT disaster recovery, operational risk, third-party risk, and crisis management. This includes benchmarking against regulatory expectations such as BSP Circular No. 1203 Series of 2024.
  
  
• Analyse Gap [Stage 2]
  The Bank identifies gaps between its current state and desired resilience maturity, focusing on weaknesses in governance, processes, technology, and third-party dependencies.
  
  
• Develop Strategy and Roadmap [Stage 3]
  A multi-year resilience roadmap is developed to outline initiatives, priorities, timelines, and resource requirements to address identified gaps.
  
  
• Confirm Risk Appetite [Stage 4]
  RCBC defines its tolerance for disruption, aligned with its business objectives and regulatory expectations, ensuring clarity on acceptable levels of operational risk.
  
  
• Develop and Embed Governance [Stage 5]
  Governance structures, policies, and oversight mechanisms are established to ensure accountability, Board visibility, and alignment across business units.

Phase 2: Implement – Translating Strategy into Action

The Implement Phase translates strategy into action by identifying critical services, mapping dependencies, and validating resilience through testing.

Stages in Phase 2

• Identify Critical Business Services [Stage 1]
  RCBC identifies services whose disruption would cause intolerable harm to customers or financial stability, consistent with regulatory guidance.
  
  
• Map Processes and Resources [Stage 2]
  End-to-end mapping is conducted across people, processes, technology, facilities, and third parties to understand service delivery dependencies.
  
  
• Set Impact Tolerance [Stage 3]
  For each critical business service, RCBC defines measurable tolerance thresholds such as maximum tolerable downtime, transaction backlogs, and customer impact levels.
  
  
• Conduct Scenario Testing [Stage 4]
  The Bank tests its ability to remain within tolerance under severe but plausible scenarios such as cyberattacks, system outages, or natural disasters.
  
  
• Improve Lesson Learned [Stage 5]
  Insights from testing are analysed, and improvements are implemented to enhance resilience capabilities and close identified weaknesses.

Phase 3: Sustain – Embedding and Continuously Improving Resilience

The Sustain Phase ensures that operational resilience becomes embedded within RCBC’s culture, governance, and continuous improvement processes.

Stages in Phase 3

• Introduce Cultural Change [Stage 1]
  RCBC promotes a resilience-first mindset across all levels of the organisation, ensuring that resilience is understood as a shared responsibility.
  
  
• Develop Communication Strategy [Stage 2]
  Clear communication protocols are established for internal stakeholders, customers, regulators, and third parties during disruptions.
  
  
• Implement Training and Awareness [Stage 3]
  Regular training programmes and awareness initiatives are conducted to build organisational capability and preparedness.
  
  
• Provide Self-assessment [Stage 4]
  Business units perform periodic self-assessments to evaluate their resilience maturity and compliance with internal and regulatory standards.
  
  
• Conduct Independent Quality Review [Stage 5]
  Independent reviews, audits, and assurance activities are conducted to validate the effectiveness of the resilience programme.

RCBC’s three-phase Operational Resilience Planning Methodology provides a structured and practical framework for building, implementing, and sustaining resilience across the organisation.

By progressing from planning to implementation and ultimately to continuous improvement, the Bank ensures that resilience is not treated as a one-time initiative but as an ongoing capability.

This methodology aligns closely with regulatory expectations, such as BSP Circular No. 1203, Series of 2024, and positions RCBC to respond effectively to disruptions while safeguarding customers, maintaining operational continuity, and supporting financial system stability.

Blogs marked [x] are under construction.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.