[CM] [BDCB] [E1] [C2] Understanding Your Organisation

Chapter 2

Understanding Your Organisation: Brunei Darussalam Central Bank

Introduction

An effective Crisis Management capability begins with a clear understanding of the organisation it is intended to protect. Crisis-management arrangements should not be designed independently of the organisation's mandate, strategic objectives, operating environment, stakeholders, dependencies, and potential sources of disruption.

This is particularly important for the Brunei Darussalam Central Bank (BDCB). BDCB is responsible for conducting Brunei Darussalam's monetary policy, issuing the Brunei currency, and regulating and supervising banks and other financial institutions.

Its statutory objectives include maintaining domestic price stability, ensuring financial-system stability, supporting efficient payment systems, and fostering a sound and progressive financial-services sector.

These responsibilities mean that a serious crisis affecting BDCB may extend well beyond disruption to the Central Bank itself.

Depending on the event, consequences could extend to financial institutions, payment and settlement systems, businesses, consumers, government stakeholders, and confidence in Brunei Darussalam's financial system.

For Crisis Management purposes, therefore, understanding BDCB means understanding both the organisation and the system within which it operates.

This chapter establishes that organisational context is the foundation for the subsequent development of BDCB's strategic Crisis Management capability.

ISO 22361 and Understanding Organisational Context

ISO 22361:2022 guides organisations to plan, establish, maintain, review, and continually improve a strategic crisis-management capability.

Its areas of consideration include organisational context and crisis-management concepts, capability development, crisis leadership, decision-making, crisis communication, training, validation, and learning.

Understanding organisational context is therefore not merely a preliminary background exercise. It directly influences:

• what BDCB considers to be a crisis;
• what consequences would be strategically significant;
• which stakeholders require consideration;
• what functions and assets require protection;
• which dependencies could create cascading consequences;
• what authority senior management requires;
• what scenarios should be planned and exercised;
• how crisis escalation should occur; and
• what constitutes successful stabilisation and recovery.

The ISO 22361-aligned approach used in this guide should therefore begin with a fundamental question:

What characteristics of BDCB and its operating environment determine the Crisis Management capability it requires?

Understanding Brunei Darussalam Central Bank

BDCB was established as a statutory body on 1 January 2011 under the Brunei Darussalam Central Bank Order, 2010. Its core responsibilities include monetary policy, currency issuance, and the regulation and supervision of banks and financial institutions.

BDCB identifies four principal objectives:

• Achieve and maintain domestic price stability.

• Ensure the stability of the financial system, particularly through financial regulations and prudential standards.

• Assist in establishing and functioning efficient payment systems and oversee them.
• Foster and develop a sound and progressive financial services sector.

These objectives provide the starting point for determining the consequences that BDCB's Crisis Management capability must be able to address.

A crisis should therefore not be assessed solely by asking whether BDCB's offices or systems have been disrupted. Management should also consider whether the situation threatens BDCB's ability to discharge these wider responsibilities.

Why Organisational Context Matters to Crisis Management

An organisation's crisis-management arrangements should reflect what makes that organisation strategically important.

For BDCB, the relevant context can be considered through six interconnected dimensions:

These dimensions should ultimately influence BDCB's crisis scenarios, escalation criteria, Crisis Management Team structure, strategic response arrangements, and exercise programme.

Understanding BDCB's Mandate

The starting point should be BDCB's mandate rather than a generic list of threats.

Monetary Stability

Brunei Darussalam's monetary system operates through a Currency Board Arrangement underpinned by the Currency Interchangeability Agreement with Singapore.

BDCB states that the Brunei Dollar is pegged to the Singapore Dollar at par and that the currency issued is backed as required under the Currency Order.

From a Crisis Management perspective, relevant concerns may therefore include:

• disruption affecting currency management;
• events affecting public confidence in the currency;
• misinformation concerning the Brunei Dollar;
• inability to perform important monetary operations;
• severe external events affecting supporting arrangements; and
• situations requiring coordination with key external stakeholders.

The important issue is not simply operational continuity. Management must understand the potential confidence and systemic consequences of the event.

Financial-System Stability

Ensuring financial-system stability is one of BDCB's stated objectives.

BDCB describes its role as including financial regulation, prudential standards, continuous monitoring, and supervision aimed at mitigating or preventing financial instability that could have systemic economic consequences.

This creates a distinctive crisis-management responsibility.

An event may originate outside BDCB but require BDCB Crisis Management.

Examples could include:

• severe liquidity stress at a regulated financial institution;
• rapid withdrawals or a loss of confidence;
• failure of a significant financial institution;
• simultaneous distress affecting multiple institutions;
• financial contagion;
• major cyberattack against a financial-sector participant;
• disruption to important financial infrastructure; or
• misinformation creates destabilising customer behaviour.

In these circumstances, BDCB may remain operational while simultaneously confronting a significant strategic crisis.

This reinforces an important principle:

A BDCB crisis does not necessarily begin inside BDCB.

Payment and Settlement Systems

Financial-market infrastructure represents another critical dimension of BDCB's organisational context.

BDCB operates Brunei Darussalam's National Payment and Settlement Systems (NPSS), consisting of:

• Real-Time Gross Settlement (RTGS);
• Automated Clearing House (ACH); and
• Central Securities Depository (CSD).

RTGS supports large-value and urgent interbank payments in real time. ACH supports bulk clearing, with obligations submitted to RTGS for settlement. CSD supports securities-related records and transactions.

BDCB also undertakes approval, oversight, and supervision of payment systems and seeks to identify weaknesses that could harm customers, the national interest, or create unnecessary risk.

These responsibilities create important interdependencies.

For the final eBook, this sequence should be converted into a standalone professional diagram titled “BDCB Financial-System Interdependencies”, rather than retaining the text-arrow version.

A serious disruption to one component can therefore create cascading consequences elsewhere.

Understanding BDCB's Stakeholders

ISO 22361's emphasis on organisational context, leadership, decision-making, and crisis communication means that stakeholder identification should form an integral part of organisational understanding

For planning purposes, BDCB's stakeholder universe may include:

Not every stakeholder will require the same level of involvement in every crisis.

Stakeholder mapping should therefore determine:

This should be presented as a standalone diagram titled “BDCB Crisis Stakeholder Mapping” in the final eBook.

Internal Organisational Context

Understanding BDCB also requires examining how the organisation itself operates.

A Crisis Management capability should identify the internal functions required to support a strategic response. Depending on the scenario, these may include representatives or specialists responsible for:

• senior management;
• monetary operations;
• financial supervision;
• payment and settlement systems;
• technology;
• cybersecurity;
• operational risk;
• Business Continuity Management;
• physical security;
• facilities;
• human resources;
• legal matters;
• procurement and third-party management;
• corporate communication;
• finance and administration; and
• stakeholder or government liaison.

The purpose is not to place every function permanently on the Crisis Management Team.

Instead, BDCB should distinguish between:

Core Crisis Management Team — the senior decision-making group required for strategic control.

Crisis Support Functions — specialists providing analysis, information, advice and implementation support.

Operational Response Teams — teams managing the underlying incident, continuity arrangements and recovery activities.

This distinction prevents the Crisis Management Team from becoming an oversized operational coordination meeting.

Understanding BDCB's Critical Activities

Organisational understanding should identify which activities could become strategically significant if disrupted.

For BDCB, illustrative areas include:

Monetary Policy and Monetary Operations

Disruption could affect BDCB's ability to perform important monetary responsibilities or obtain information required for decision-making.

Currency Issuance and Management

A prolonged disruption could create operational challenges and, depending on circumstances, confidence concerns.

Financial Regulation and Supervision

During financial-sector stress, supervisory capability may become more important precisely when normal operations are under pressure.

Payment and Settlement Systems

RTGS, ACH, and CSD create dependencies between BDCB and financial-sector participants.

Financial-Stability Activities

Significant financial-sector events may require rapid information gathering, analysis, coordination and senior-management intervention.

Crisis Communication

During high-profile events, accurate and timely communication can become a critical organisational capability in its own right.

Technology and Information

Most modern central-bank activities depend heavily upon technology, telecommunications, data and information integrity.

The purpose of this analysis is not yet to establish formal recovery objectives. Those are addressed through appropriate BCM and recovery processes.

For Crisis Management, the question is:

Which activities, if seriously affected, could generate strategic consequences requiring senior-management intervention?

Understanding Dependencies

Modern crises rarely respect organisational boundaries.

BDCB's Crisis Management capability should therefore examine interdependencies, rather than merely compiling lists of internal assets.

Relevant dependency categories include:

People

Specialist knowledge, key appointment holders, decision-makers and sufficient personnel.

Premises

Access to operational sites, command locations, and alternative facilities.

Technology

Applications, infrastructure, networks, authentication services, data centres, and recovery environments.

Information

Accurate, timely and trusted information for both operational and strategic decisions.

Telecommunications

Internal communication, external connectivity, and contact with financial institutions and authorities.

Utilities

Power, cooling, water, and other essential infrastructure.

Financial Institutions

Institutions can simultaneously be regulated entities, stakeholders, participants in financial infrastructure and sources of systemic risk.

Third Parties

Technology vendors, telecommunications providers, equipment suppliers and specialist service providers.

Government and External Authorities

Certain events may require broader coordination beyond BDCB.

The dependency chain can be represented as:

This should be converted into a standalone professional diagram titled “Dependencies Supporting BDCB's Critical Activities”.

Understanding the External Environment

ISO 22361-aligned Crisis Management should also consider the environment in which the organisation operates.

For BDCB, the external environment includes several dimensions.

Financial Environment

Potential conditions include financial institution stress, liquidity pressures, market disruption, financial contagion, and changing customer behaviour.

Technological Environment

Cyber threats, technology concentration, third-party dependencies, rapidly evolving digital services, and data-integrity risks can generate new crisis scenarios.

Physical Environment

Flooding, severe weather, fire, infrastructure disruption, and other hazards may affect BDCB, financial institutions, and service providers simultaneously.

Social and Information Environment

Social media can accelerate rumours and misinformation. A false claim concerning currency, payment-system availability, or financial-system stability can spread much faster than traditional organisational response mechanisms.

Supply-Chain Environment

Critical services increasingly depend upon external technology, telecommunications, and specialist suppliers.

Cross-Border Environment

Financial systems, technology services, communications, and monetary arrangements can create dependencies extending beyond Brunei Darussalam.

The external context should therefore be periodically reassessed rather than treated as a static one-time exercise.

Understanding BDCB's Crisis Landscape

Once the organisational context has been established, BDCB can develop a more meaningful crisis landscape.

Illustrative crisis categories include:

These are illustrative planning scenarios, not assertions that they have occurred at BDCB.

From Threat to Crisis

Understanding the organisation enables BDCB to distinguish an operational incident from a strategic crisis.

An event may begin as a technical, physical, financial, or security problem.

It becomes strategically significant when its consequences exceed routine management capability.

This should be converted into a standalone professional diagram titled “From Threat to Strategic Crisis at BDCB”.

The transition is important because crisis activation should not depend solely upon whether a predetermined operational threshold has been exceeded.

Strategic escalation may also be required because of:

• significant uncertainty;
• life-safety concerns;
• reputational consequences;
• financial-sector consequences;
• stakeholder pressure;
• widespread misinformation;
• potential systemic impact; or
• decisions requiring senior-management authority.

BDCB's Organisational Context and Crisis Consequences

A useful way of assessing potential crises is to examine consequences at progressively wider levels.

The purpose is not to assume that every incident will reach Level 5.

Rather, management should understand the potential escalation pathway so that intervention occurs before consequences become unmanageable.

Example — Major RTGS Disruption

Consider a major disruption affecting RTGS.

BDCB describes RTGS as an interbank funds-transfer system supporting large-value and urgent payments, settled individually in real time using Brunei Dollar settlement accounts held directly with BDCB.

Initially, the event may be treated as a technology incident.

Technology teams investigate the fault and initiate recovery.

However, organisational context changes how management interprets the event.

Questions quickly extend beyond technology:

• Which banks are affected?
• Which payments cannot settle?
• Are transaction records reliable?
• Is ACH affected because its obligations settle through RTGS?
• Are settlement-liquidity issues developing?
• How long can participants tolerate the disruption?
• What information should financial institutions receive?
• What alternative arrangements exist?
• Is the media aware of the event?
• Is misinformation emerging?
• Could the situation affect confidence?
• Does senior management need to intervene?

The escalation can therefore develop as:

This should become a standalone diagram titled “Illustrative RTGS Crisis Escalation at BDCB”.

This example demonstrates why organisational understanding must precede Crisis Management planning.

Without understanding RTGS's role and dependencies, BDCB could underestimate the strategic consequences of what initially appears to be a technology incident.

Example — Financial Institution Under Severe Stress

A different scenario may originate entirely outside BDCB.

Suppose a regulated financial institution experiences severe financial stress.

Initially, the matter may be managed through supervisory and financial-stability arrangements. If the institution's condition deteriorates, however, customer concern could increase.

The scenario may progress as:

This should become a separate professional diagram titled “Illustrative Financial-Stability Crisis Escalation”.

The example demonstrates another essential point:

BDCB can face a crisis even when BDCB itself has not suffered an operational disruption.

Example — Misinformation and Confidence

Organisational context should also consider situations where the primary threat is information rather than physical disruption.

For example, false information concerning the Brunei Dollar, payment-system availability, or financial-system stability could circulate through social media.

The situation could progress rapidly:

This should become a standalone diagram titled “Misinformation Escalation and Confidence Risk”.

In such circumstances, systems may remain fully operational.

The crisis arises from perception, behaviour, uncertainty, and potential loss of confidence.

Crisis Management Objectives Derived from Organisational Context

Once BDCB's organisational context is understood, appropriate Crisis Management objectives can be established.

BDCB's capability should seek to:

• Protect life and safety.

• Maintain strategic leadership and governance.

• Protect BDCB's ability to discharge its mandate.

• Support financial system stability.

• Protect critical payment and settlement activities.

• Preserve the integrity and availability of critical information.

• Provide effective situational awareness.

• Enable timely strategic decision-making.

• Coordinate internal and external response activities.

• Maintain credible stakeholder and public communication.

• Manage cascading and systemic consequences.

• Oversee stabilisation and strategic recovery.

• Capture lessons and continually improve the capability.

These objectives should provide the foundation for the subsequent Crisis Management strategy, plan, training, and exercise programme.

Information Requirements During a Crisis

Understanding the organisation also helps identify the information senior management will require.

A BDCB Crisis Management Team should be able to obtain a consolidated picture covering:

This provides the basis for effective situational awareness, one of the most important prerequisites for crisis decision-making.

Governance Implications

Understanding organisational context should ultimately influence Crisis Management governance.

BDCB should define:

• executive sponsorship for Crisis Management;
• Crisis Management Team leadership;
• membership and alternates;
• activation authority;
• delegated decision-making authority;
• escalation criteria;
• reporting arrangements;
• specialist advisers;
• information-management arrangements;
• stakeholder responsibilities;
• crisis-communication authority;
• liaison with external authorities;
• relationship with BCM and IT Disaster Recovery;
• de-escalation criteria; and
• post-crisis review responsibilities.

ISO 22361 is directed particularly at top management with strategic responsibilities for the delivery of a Crisis Management capability, reinforcing that CM is fundamentally a strategic management responsibility, rather than solely an operational or technical function.

Relationship with Other Resilience Capabilities

BDCB's Crisis Management capability should not duplicate specialist disciplines.

Instead, it should provide strategic leadership over an integrated organisational response.

Relevant capabilities may include:

ISO 22361 explicitly recognises relationships and interdependencies with other disciplines while treating Crisis Management as distinct.

Organisational Context Assessment for BDCB

The following assessment provides a practical starting point for implementation.

The assessment should be periodically reviewed because organisational context changes over time.

From Organisational Understanding to Crisis Management Capability

The purpose of understanding the organisation is ultimately to translate context into capability.

The implementation relationship can be expressed as:

For the final eBook, this should be converted into a standalone professional diagram titled “From Organisational Understanding to Crisis Management Capability” rather than retaining the text-arrow version.

This relationship captures the central message of the chapter:

Crisis Management capability should be derived from organisational context—not designed independently of it.

ISO 22361 Alignment

This chapter supports the organisational-context foundation of an ISO 22361-aligned Crisis Management capability.

The alignment can be summarised as follows:

This should not be interpreted as a clause-by-clause reproduction of ISO 22361. Rather, it translates the standard's strategic Crisis Management principles into a practical organisational-context assessment for BDCB.

Key Implementation Principle

For BDCB, understanding the organisation should extend beyond documenting its organisation chart.

A meaningful assessment should establish:

Together, these elements determine the Crisis Management capability BDCB requires.

For the final eBook, this should be converted into a professional diagram titled “Understanding BDCB for Crisis Management”.

The resulting understanding becomes the foundation for identifying crisis scenarios, establishing governance, designing response strategies, developing Crisis Management Plans, and exercising BDCB's strategic response capability.

Understanding the Brunei Darussalam Central Bank is the essential starting point for building an effective Crisis Management capability.

BDCB is not simply an organisation seeking to protect its own internal operations.

Its responsibilities encompass monetary policy, currency issuance, financial-sector regulation and supervision, financial-system stability, and efficient payment systems.

Its operation of RTGS, ACH, and CSD further creates important relationships with financial institutions and Brunei Darussalam's financial infrastructure.

Consequently, the organisation's Crisis Management capability must consider internal disruption, external financial-sector events, interdependencies, stakeholder expectations, information integrity, public confidence, and potential systemic consequences.

An ISO 22361-aligned approach begins by understanding this context and then using it to shape governance, crisis leadership, decision-making, communication, training, validation, and learning.

For BDCB, the central principle is therefore:

Understand the organisation first. Understand its dependencies second. Understand the potential consequences. Then build the Crisis Management capability required to protect its mandate and manage strategic crises effectively.

 

 

 

eBook 1: Understanding Your Organisation
C1	C2	C3	C4	C5 [x]	C5A	C6 [x]
C7 [x]	C8 [x]	C9 [x]	C10 [x]	C11 [x]	C12 [x]	C13 [x]

More Information About Crisis Management Blended/ Hybrid Learning Courses

To learn more about the course and schedule, click the buttons below for the  CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].

	Please feel free to send us a note if you have any questions.