[CM] [BDCB] [E1] [C4] CM Vs BCM

Chapter 4

Introduction

Crisis Management (CM) and Business Continuity Management (BCM) are complementary organisational capabilities, but they are not interchangeable.

Understanding their differences is particularly important for the Brunei Darussalam Central Bank (BDCB), where an incident may affect not only internal operations but also regulated financial institutions, payment and settlement activities, stakeholders, and potentially confidence in the wider financial system.

BDCB carries responsibilities for monetary policy, currency issuance, regulation, and supervision of banks and other financial institutions. Its statutory objectives include domestic price stability, financial-system stability, efficient payment systems, and development of a sound and progressive financial-services sector.

BDCB also operates Brunei Darussalam's National Payment and Settlement Systems (NPSS), comprising the Real-Time Gross Settlement (RTGS), Automated Clearing House (ACH), and Central Securities Depository (CSD).

Consequently, the same initiating event could require BCM, CM, or both, depending on its consequences.

The distinction can be expressed simply:

BCM focuses primarily on maintaining and recovering critical business functions following disruption. CM focuses on providing strategic leadership, coordination, and decision-making when an event creates crisis-level consequences, uncertainty, and stakeholder concerns.

The distinction is important, but the two capabilities should operate as part of an integrated organisational resilience framework.

Defining Crisis Management

BCMpedia defines Crisis Management as the overall coordination of an organisation's response to a crisis in an effective and timely manner, to avoid or minimise damage to its profitability, reputation or ability to operate.

For BDCB, this definition should be interpreted within the context of a central bank.

The purpose of CM is therefore broader than restoring an interrupted process. It provides the strategic management capability required when an event creates substantial uncertainty, requires decisions beyond normal operational authority, affects multiple stakeholders, or threatens important organisational objectives.

This interpretation is consistent with ISO 22361:2022 — Security and resilience — Crisis management — Guidelines. ISO describes the standard as guidance for planning, establishing, maintaining, reviewing, and continually improving a strategic crisis-management capability.

Its principal elements include organisational context, development of the capability, crisis leadership, decision-making, crisis communication, training, validation, and learning.

For BDCB, CM, therefore, involves capabilities such as:

• strategic leadership;
• crisis recognition and escalation;
• situational awareness;
• strategic decision-making;
• Crisis Management Team activation;
• cross-functional coordination;
• stakeholder management;
• crisis communication;
• consideration of wider financial system consequences;
• stabilisation and recovery oversight; and
• post-crisis learning.

CM asks the strategic question:

“How should BDCB manage this situation and its wider consequences?”

Defining Business Continuity Management

Business Continuity Management is concerned principally with protecting the organisation's ability to continue and recover priority activities following disruption.

BCMpedia describes Business Continuity as safeguarding the interests of an organisation and its key stakeholders by protecting critical business functions against predetermined disruptions. BCMpedia

Its description of a BCM framework similarly identifies BCM as a methodology and planning process for managing disruption-related risk.

For BDCB, BCM would therefore focus on questions such as:

• Which business functions must continue?
• What are their recovery priorities?
• How quickly must they recover?
• What resources are required?
• Which systems, people, premises, suppliers, and information are needed?
• What alternative working arrangements are available?
• How will interrupted activities be recovered?
• How will continuity arrangements be maintained and exercised?

BCM asks the operational continuity question:

“How will BDCB continue or recover its critical business functions following disruption?”

Crisis Management Versus Business Continuity Management

The principal differences can be summarised as follows.

The difference is one of purpose and management perspective, rather than a rigid boundary.

Disaster Versus Crisis Scenario

A particularly important distinction is the difference between a disaster, which is traditionally addressed through BCM and recovery arrangements, and a crisis scenario, which is used to prepare the organisation's crisis-management capability.

Disaster

BCMpedia defines a disaster as a sudden, unplanned event causing great damage or serious loss to an organisation. Its accompanying explanation notes that such an event can result in an organisation being unable to provide critical business functions for a predetermined period, effectively denying access to people, processes, or infrastructure.

From a BCM perspective, the central issue is therefore disruption.

For example, BDCB could experience:

Flooding is affecting access to premises

The BCM question is whether the affected critical business functions can continue from another location.

Major technology outage

The BCM question is whether alternative procedures or recovery systems can maintain priority activities.

Extended telecommunications failure

The BCM question is how critical functions can operate using alternative communication arrangements.

Loss of critical staff availability

The BCM question is whether minimum staffing arrangements, alternates and cross-trained personnel can maintain required services.

In each example, BCM concentrates on the continuity consequence.

Crisis Scenario

BCMpedia defines a Crisis Scenario as a situation that might disrupt the business. It further describes it as a set of informed assumptions concerning a situation that may require human intervention and action to resolve.

For crisis-management purposes, a scenario should extend beyond identifying the initiating threat. It should explore how the situation could develop, what strategic consequences could arise, which stakeholders could become involved, what uncertainty could emerge, and what decisions senior management might face.

For BDCB, examples could include:

• a major cyberattack affecting critical central-bank systems;
• prolonged disruption to RTGS or other payment infrastructure;
• uncertainty regarding the integrity of payment or settlement data;
• severe financial distress affecting a regulated financial institution;
• financial contagion involving several institutions;
• widespread misinformation concerning the Brunei Dollar or financial system stability;
• a major security incident affecting BDCB;
• pandemic conditions are creating widespread workforce constraints;
• simultaneous disruption affecting BDCB and several financial institutions; or
• a severe natural event generating operational, financial-sector, and public-confidence consequences.

These are planning scenarios, not assertions that such events have occurred at BDCB.

Disaster and Crisis Scenario — The Critical Difference

The distinction becomes clearer when the two concepts are compared directly.

The difference can therefore be expressed as:

Disaster → Disruption → Critical Business Functions Affected → Business Continuity Response → Continuity and Recovery

Crisis Scenario → Escalating Situation → Strategic Consequences and Uncertainty → Crisis Management Response → Stabilisation and Strategic Recovery

These two sequences should be converted into separate professional diagrams in the final eBook rather than retaining the text-arrow versions.

The Same Event Can Be Both a BCM and CM Concern

A major event should not necessarily be classified exclusively as either a disaster or a crisis.

Consider a severe cyberattack.

From the BCM perspective, the cyberattack may make critical technology unavailable. Business units activate continuity arrangements, and technology teams implement recovery procedures.

From the CM perspective, the same cyberattack may create uncertainty regarding transaction integrity, affect financial institutions, attract media attention, generate misinformation, and require strategic decisions from BDCB's senior management.

The progression could therefore be:

These are presented as two separate diagrams (side-by-side) to demonstrate that the same initiating event can create different management requirements.

Example — Major RTGS Disruption

BDCB's RTGS system provides a useful example of the distinction.

BDCB states that it operates the NPSS comprising RTGS, ACH, and CSD. RTGS supports real-time settlement of large-value and urgent interbank payments, while ACH clearing obligations are ultimately submitted to RTGS for settlement.

Suppose a technology failure causes RTGS to become unavailable.

BCM Perspective

The immediate continuity questions include:

• Which critical activities are affected?
• What is the recovery requirement?
• Are alternative procedures available?
• Which people and systems are required?
• What recovery resources are needed?
• Can dependent activities continue?
• How quickly can the system be restored?

The objective is continuity and recovery.

CM Perspective

If the outage becomes prolonged or its consequences become uncertain, additional questions arise:

• How many financial institutions are affected?
• Are significant settlement obligations accumulating?
• Could liquidity pressures develop?
• Is ACH or another dependent service affected?
• Is transaction integrity certain?
• What information should participants receive?
• Are government stakeholders or other authorities required to be informed?
• Is misinformation circulating?
• Could public confidence be affected?
• Does the event create wider financial stability concerns?

At this point, the issue is no longer simply whether RTGS can be restored. It becomes a question of how BDCB strategically manages the wider situation.

BCM Manages Disruption; CM Manages Strategic Consequences

A useful distinction for BDCB practitioners is:

Business Continuity Management

BCM primarily manages the consequences of operational disruption.

Its principal concern is the availability and recovery of:

• people;
• processes;
• premises;
• technology;
• information;
• suppliers; and
• other resources required for critical business functions.

Crisis Management

CM primarily manages the strategic consequences of an abnormal and potentially escalating situation.

Its principal concerns include:

• uncertainty;
• leadership;
• strategic priorities;
• competing objectives;
• time-critical decisions;
• organisational consequences;
• financial-sector consequences;
• stakeholder expectations;
• media attention;
• misinformation;
• reputation;
• public confidence; and
• potentially financial system stability.

The distinction should not create organisational silos. Instead, it helps determine which management capability should lead which part of the response.

Alignment with ISO 22361

ISO 22361:2022 guides organisations to develop a strategic crisis-management capability. The standard specifically addresses organisational context, capability development, crisis leadership, decision-making challenges, crisis communication, training, validation, and learning.

Importantly, ISO also states that crisis management has relationships and interdependencies with other disciplines while remaining distinct from them.

This supports an integrated approach for BDCB.

The Crisis Management Team should not attempt to replace BCM, cybersecurity, technology recovery, emergency response, security, or specialist operational teams. Instead, CM should provide the strategic layer of leadership and coordination when consequences exceed the scope of routine management.

For BDCB, this distinction is particularly relevant because a serious incident can develop consequences across organisational boundaries and potentially affect regulated entities and financial infrastructure.

Types of Crisis Relevant to BDCB

ISO 22361 does not prescribe a fixed list of sector-specific crisis types; its guidance is designed for organisations generally. Accordingly, BDCB should identify crisis scenarios from its own organisational context, mandate, dependencies, and risk environment.

For this implementation guide, BDCB's crisis landscape should include the following planning categories.

These scenarios should be treated as illustrative planning assumptions, not statements that the events have occurred at BDCB.

Escalation from BCM to Crisis Management

A business continuity event may remain a BCM issue throughout its lifecycle.

For example, a temporary premises outage may be managed effectively using an alternate worksite without significant strategic consequences.

However, CM may need to be activated when the disruption begins generating broader consequences.

A useful escalation model is:

This should be converted into a standalone professional diagram titled “From Business Disruption to Strategic Crisis”.

The decision to activate CM should therefore not depend solely on elapsed time or operational severity.

Escalation indicators can include:

• significant uncertainty;
• multiple business functions affected;
• prolonged inability to restore critical services;
• significant financial-sector consequences;
• material stakeholder concern;
• media attention;
• misinformation;
• safety consequences;
• regulatory or legal implications;
• reputational consequences;
• need for decisions beyond delegated operational authority; or
• potential implications for financial system stability.

How BCM and CM Operate Together

During a major event, the two capabilities should operate concurrently.

Business Continuity Management → Maintain and Recover Critical Business Functions

Crisis Management → Provide Strategic Leadership, Direction and Coordination

Both contribute to:

Organisational Stabilisation → Sustainable Recovery → Lessons Learned and Improvement

These should be converted into a professional integrated diagram titled “Integrating Crisis Management and Business Continuity Management”.

The relationship can be understood through three management levels.

Strategic Level — Crisis Management

Senior management determines strategic priorities, risk posture, stakeholder approach, and organisational response.

Tactical Level — Coordination

Business, technology, communications, security, BCM, and other teams coordinate implementation.

Operational Level — Business Continuity and Recovery

Affected functions execute continuity procedures, technology recovery, alternative working arrangements, and operational restoration.

This separation preserves clear responsibilities while enabling coordinated response.

When BCM May Operate Without CM

Not every disruption requires activation of the Crisis Management Team.

Examples could include:

• short technology outage within established recovery tolerances;
• temporary premises inaccessibility managed successfully through alternate working;
• isolated supplier outage with an effective workaround;
• localised staff shortage; or
• minor operational interruption contained by existing procedures.

In such circumstances, BCM or normal incident-management arrangements may be sufficient.

CM should not become an additional approval layer for every operational disruption.

When CM May Operate Without Major BCM Activation

Conversely, some crises may require substantial strategic management even when BDCB's critical business functions remain operational.

Examples could include:

• serious allegations of misconduct;
• a major reputational event;
• rapidly spreading misinformation;
• significant public confrontation;
• threat against senior management;
• confidential-information disclosure where systems remain available; or
• financial distress at a regulated institution that does not directly disrupt BDCB operations.

In these situations, the organisation may be operationally functioning but strategically in crisis.

This is one of the most important differences between CM and BCM.

Crisis Management Is Not “BCM at a Higher Severity”

It would be misleading to treat Crisis Management simply as the highest level of Business Continuity Management.

The two capabilities overlap, but they solve different management problems.

BCM is fundamentally concerned with the continuity of critical activities following disruption.

CM is fundamentally concerned with the strategic leadership of an abnormal, uncertain, and consequential situation.

A severe disaster can create a crisis, but severity alone does not define the distinction.

Similarly, a crisis can occur without a major business interruption.

This principle is consistent with ISO 22361's treatment of crisis management as a distinct strategic capability that nevertheless has relationships and interdependencies with other organisational disciplines.

Governance and Activation

BDCB should establish clearly defined governance arrangements identifying when responsibility remains with operational management, when BCM arrangements are activated, and when escalation to the Crisis Management Team is required.

An integrated activation framework could operate as follows:

Event Detected → Operational Assessment → Incident Management

If critical business functions are disrupted:

Activate Business Continuity Arrangements

If strategic consequences or significant uncertainty emerge:

Escalate to Crisis Management

Where both conditions exist:

BCM and CM Operate Concurrently Under Coordinated Governance

The framework should define:

• notification responsibilities;
• escalation thresholds;
• disaster declaration authority, where applicable;
• CM activation authority;
• Crisis Management Team membership;
• BCM leadership responsibilities;
• communication responsibilities;
• decision authorities; and
• arrangements for de-escalation and stand-down.

BCMpedia describes disaster declaration as the process used to activate BC, DR or CM arrangements after a disaster or emergency and notes the role of authorised personnel in initiating pre-arranged actions.

Recovery and Return to Normal Operations

BCM and CM also have different but complementary responsibilities during recovery.

BCM focuses on:

• restoring critical business functions;
• returning resources and systems to acceptable operating conditions;
• managing backlogs;
• transitioning from temporary arrangements;
• validating restored processes; and
•  
• returning to normal operations.

CM maintains strategic oversight of:

• stakeholder consequences;
• unresolved strategic risks;
• external communication;
• reputation;
• financial-sector implications;
• significant management decisions;
• organisational stabilisation; and
• transition out of crisis governance.

The Crisis Management Team should therefore not necessarily stand down simply because a disrupted system has been restored.

Technical recovery may occur before strategic recovery is complete.

Post-Incident and Post-Crisis Learning

Both disciplines should ultimately contribute to organisational learning.

Following a significant disruption or crisis, BDCB should review:

• what occurred;
• why it occurred;
• whether escalation was timely;
• whether responsibilities were clear;
• whether continuity strategies worked;
• whether the Crisis Management Team received sufficient information;
• whether decisions were timely and effective;
• whether communication was appropriate;
• whether recovery objectives were achieved;
• what unexpected dependencies emerged;
• which controls failed;
• what worked well; and
• what should change.

The results should feed into revised risk assessments, continuity strategies, crisis scenarios, plans, playbooks, training, and exercises.

This reflects ISO 22361's inclusion of training, validation, and learning as part of an effective strategic crisis-management capability. 

Practical BDCB Decision Framework

When an event occurs, management can use four questions to determine the appropriate response:

The fourth situation is particularly important for BDCB.

A major cyberattack, prolonged payment-system disruption, widespread natural disaster or multi-institution financial event could require several specialist capabilities to operate simultaneously.

Key Principle for BDCB

The distinction can ultimately be summarised through two questions:

Business Continuity Management

Can BDCB continue and recover its critical business functions?

Crisis Management

Can BDCB strategically manage the wider situation, uncertainty, and consequences?

For a significant crisis, BDCB may need to answer both questions simultaneously.

Crisis Management and Business Continuity Management are distinct but interconnected organisational capabilities.

BCMpedia's disaster definition emphasises an event that can cause serious loss and prevent an organisation from providing critical business functions, while its crisis-scenario definition focuses on an assumed situation that might disrupt the organisation and require human intervention and action.

For BDCB, BCM should primarily protect the continuity and recovery of critical business functions, while CM should provide the strategic leadership, decision-making, coordination, and communication needed to manage crisis-level consequences.

The distinction is especially significant because BDCB's responsibilities include monetary policy, currency issuance, financial-sector regulation and supervision, financial-system stability, and efficient payment systems.

BDCB also operates RTGS, ACH, and CSD, creating important relationships with financial institutions and financial-market infrastructure.

ISO 22361 reinforces this strategic perspective by treating crisis management as a capability involving context, leadership, decision-making, communication, training, validation, and learning, while acknowledging its relationships and interdependencies with other disciplines.

The implementation principle for BDCB is therefore:

BCM maintains continuity. CM maintains strategic control.

When a major event creates both operational disruption and strategic consequences, BCM and CM should operate concurrently—each performing its distinct role within an integrated organisational response.