[CM] [BDCB] [E1] [C5] Identifying the Types of Crisis Scenarios

eBook 1 - Chapter 5

What Crisis Scenarios Does the Brunei Darussalam Central Bank Face in Crisis Management?

Introduction

Crisis management begins with understanding the situations that could escalate beyond routine incident management and require coordinated intervention by senior management.

For Brunei Darussalam Central Bank (BDCB), this is particularly important because a significant crisis may affect more than the organisation itself.

Depending on its nature and severity, an event could affect confidence in Brunei Darussalam's financial system, the availability of currency, the functioning of payment arrangements, regulated financial institutions, financial consumers, employees, and BDCB's reputation as the country's central bank.

BDCB's official responsibilities include conducting monetary policy, issuing and managing Brunei currency, regulating and supervising banks and other financial institutions, supporting financial-system stability, helping establish and oversee efficient payment systems, and supporting the development of the financial-services sector.

Consequently, BDCB should consider crisis scenarios from both an organisational perspective and a broader central-bank and financial-system perspective.

What Is a Crisis Scenario?

BCMpedia describes a Crisis Scenario as a situation that might disrupt an organisation's business and further explains it as a set of informed assumptions concerning a situation that may require human intervention and action to resolve.

This distinction is important.

An incident does not automatically become a crisis. Many incidents can be resolved through established operational, security, IT, emergency-response, business-continuity, or disaster-recovery procedures.

A situation becomes relevant to crisis management when its scale, uncertainty, complexity, stakeholder impact or potential consequences require management-level coordination and decision-making.

For BDCB, the escalation can be represented as:

The objective of scenario identification is therefore not to predict every possible event.

It is to establish a structured range of circumstances against which BDCB can develop prevention, preparedness, response, communication and recovery arrangements.

Crisis Scenario Framework for BDCB

BCMpedia identifies eight broad types relevant to crisis planning:

1. Natural
2. Technological
3. Organisational Misdeeds
4. Confrontation
5. Malevolence
6. Workplace Violence
7. Rumours
8. Lack of Funds

BCMpedia's crisis-management methodology further distinguishes the first two—Natural and Technological—as threats commonly addressed during risk assessment, while treating the remaining categories as crisis scenarios.

For practical BDCB crisis planning, however, consider all eight categories because a natural or technological disruption can escalate into a management-level crisis.

CS-1: Natural Crisis

A Natural Crisis originates from environmental, climatic, biological or other naturally occurring events.

For BDCB, relevant scenarios could include:

• severe flooding affecting BDCB premises or access routes;
• severe storms and associated infrastructure disruption;
• prolonged haze or environmental conditions affecting employee safety;
• infectious-disease outbreaks or pandemics;
• major regional natural disasters affecting financial institutions, suppliers or infrastructure;
• widespread utility disruption caused by severe environmental events; and
• simultaneous disruption of BDCB and important financial-sector participants.

The crisis-management concern is not merely physical damage.

For example, severe flooding could prevent employees from reaching critical facilities, affect technology or telecommunications, interfere with currency distribution, constrain supervisory activities and create simultaneous disruption among regulated financial institutions.

BDCB issues and manages currency, including supplying notes and coins to banks in the domestic financial system. A severe natural event affecting transport, premises, personnel or supporting infrastructure could therefore create consequences extending beyond the BDCB workplace.

Illustrative Scenario

Severe flooding affects BDCB premises and several financial institutions at the same time.

The crisis could require BDCB to:

• protect employees and visitors;
• assess facility accessibility;
• activate alternate working arrangements;
• maintain critical central-bank functions;
• coordinate with financial institutions;
• monitor financial-sector disruption;
• manage currency availability;
• assess payment-system implications;
• communicate with relevant government authorities; and
• provide accurate information to affected stakeholders.

The event becomes a crisis when these issues require coordinated strategic decisions rather than isolated operational responses.

CS-2: Technological Crisis

A Technological Crisis results from the failure, compromise or disruption of technology, infrastructure, equipment or supporting systems.

BCMpedia examples include equipment, IT and hardware failures.

For a modern central bank, the category should be interpreted more broadly to include:

• major ICT outage;
• data-centre failure;
• telecommunications disruption;
• ransomware;
• destructive malware;
• cyber intrusion;
• denial-of-service attack;
• compromise of privileged accounts;
• corruption or loss of critical data;
• failure of supervisory or regulatory systems;
• payment infrastructure disruption;
• cloud or third-party technology failure;
• failed technology change;
• prolonged power failure; and
• loss of critical communication platforms.

Illustrative Scenario

A major cyberattack causes a loss of access to several critical BDCB systems, and the authenticity and integrity of financial information cannot be confirmed immediately.

This could rapidly escalate because management would need to determine:

• whether systems should be isolated;
• whether critical information can be trusted;
• which services can continue safely;
• whether regulated institutions are affected;
• whether payment arrangements are exposed;
• whether sensitive or confidential information has been compromised;
• whether external authorities should be engaged; and
• what should be communicated publicly.

For BDCB, technological crisis planning should therefore be closely integrated with cybersecurity, incident management, ICT disaster recovery and business continuity.

CS-3: Organisational Misdeeds

Organisational misdeeds arise when actions, decisions or behaviours associated with an organisation create significant ethical, governance, legal, regulatory or reputational consequences.

For crisis-management purposes, this category can be considered under three subcategories.

Skewed Management Values

This occurs when inappropriate organisational or management priorities contribute to questionable decisions or behaviour.

Potential BDCB scenarios might involve allegations that:

• inappropriate pressure influenced an important decision;
• governance safeguards were deliberately bypassed;
• institutional interests were placed above statutory responsibilities;
• significant concerns raised internally were ignored; or
• management knowingly tolerated unacceptable practices.

Such scenarios may remain allegations until investigated. Crisis-management arrangements should therefore avoid premature conclusions while ensuring rapid fact-finding and appropriate governance escalation.

Deception

Deception involves deliberate misrepresentation, concealment or falsification.

Potential scenarios could include:

• falsification of internal records;
• deliberate manipulation of information;
• concealment of a significant control failure;
• fraudulent documentation;
• unauthorised alteration of reports;
• misleading information provided internally or externally; or
• deliberate concealment of a serious incident.

A central bank depends heavily on institutional credibility. An allegation of deliberate deception can therefore become a crisis before the facts are fully established.

Management Misconduct

Potential scenarios could include allegations involving:

• abuse of authority;
• serious conflicts of interest;
• corruption or bribery;
• inappropriate disclosure of confidential information;
• serious breach of internal policy;
• procurement misconduct; or
• other serious ethical or professional misconduct.

The crisis-management challenge is to protect due process while maintaining institutional integrity and stakeholder confidence.

CS-4: Confrontation

A Confrontation Crisis occurs where individuals or groups challenge the organisation through disputes, protests, coordinated opposition or other confrontational actions.

BCMpedia associates confrontation with conflict involving employees, management or other parties.

For BDCB, possible scenarios include:

• demonstrations outside BDCB premises;
• organised protests concerning financial-sector policies;
• confrontation involving dissatisfied financial consumers;
• disputes involving employees or contractors;
• coordinated opposition from affected stakeholder groups;
• hostile gatherings affecting access to BDCB facilities; or
• aggressive confrontation involving a regulatory or enforcement matter.

Illustrative Scenario

A large group gathers outside a BDCB facility following a controversial financial-sector issue, attracting significant media and social-media attention.

The immediate challenge may involve physical access and security, but the broader crisis may involve:

CS-5: Malevolence

Malevolence involves deliberate harmful acts by individuals or groups intending to cause damage, fear, disruption, financial loss or reputational harm.

For BDCB, scenarios could include:

• terrorism;
• bomb threats;
• sabotage;
• deliberate physical damage;
• extortion;
• kidnapping;
• threats against senior officials or employees;
• malicious cyberattack;
• deliberate destruction or corruption of information;
• theft of sensitive information;
• impersonation of BDCB or its officials;
• deliberate release of confidential information; or
• coordinated attempts to disrupt critical central-bank activities.

BCMpedia's crisis-management material includes examples such as kidnapping, extortion, explosions, threats against people and property, assaults and property damage.

Illustrative Scenario

A malicious actor claims to have compromised confidential BDCB information and threatens to publish it unless demands are met.

The situation could simultaneously require:

• cybersecurity investigation;
• law-enforcement engagement;
• information-security response;
• assessment of data authenticity;
• legal advice;
• protection of affected individuals;
• stakeholder communication;
• media management; and
• executive decision-making.

This illustrates why crisis scenarios often cross traditional departmental boundaries.

CS-6: Workplace Violence

Workplace violence includes actual or threatened violence involving employees, contractors, visitors or other persons interacting with BDCB.

Possible scenarios include:

• assault on an employee;
• threats against senior management;
• armed intrusion;
• hostage situation;
• threatening behaviour by a visitor;
• violence between employees;
• credible threats made electronically;
• stalking or targeted harassment; and
• violence affecting a BDCB event or facility.

The immediate priority is life safety.

However, once emergency services and security procedures are activated, management may also need to address:

• employee welfare;
• family liaison;
• site closure;
• continuity of critical activities;
• evidence preservation;
• employee communication;
• media enquiries;
• psychological support; and
• return-to-work arrangements.

The crisis-management framework should complement—not replace—security and emergency-response procedures.

CS-7: Rumours

Rumours can be particularly significant for a central bank because financial systems depend heavily on trust and confidence.

Potential BDCB-related rumours could concern:

• the stability of a bank or financial institution;
• the safety of customer deposits;
• alleged financial-sector problems;
• currency availability;
• the Brunei dollar;
• alleged changes to monetary arrangements;
• the integrity of payment systems;
• alleged cyber incidents;
• supposed confidential BDCB decisions;
• fabricated regulatory announcements; or
• false statements attributed to BDCB senior management.

BDCB's responsibilities include domestic price stability, financial-system stability, payment-system oversight and financial-sector development. Consequently, misinformation concerning these areas may require rapid assessment even when BDCB's own operations remain unaffected.

Illustrative Scenario

A false social-media message claims that a major financial institution is experiencing severe financial difficulties and falsely attributes the information to BDCB.

Potential escalation could occur as follows:

The response should be based on verified information. Speed is important, but accuracy and institutional credibility are equally critical.

CS-8: Lack of Funds

For a commercial organisation, a lack-of-funds crisis typically concerns liquidity, financing, or an inability to meet financial commitments.

For a central bank such as BDCB, the scenario requires a more tailored interpretation. It should not be read simply as corporate insolvency.

Instead, crisis planners should examine situations involving financial-resource constraints, liquidity-related pressures, financial-sector stress or inability of a relevant entity to meet critical obligations.

Potential scenarios could include:

• severe liquidity stress at a regulated financial institution;
• financial distress affecting an important financial-sector participant;
• failure of a critical supplier because of financial difficulties;
• inability of a contracted provider to continue essential services;
• financial-market disruption requiring urgent coordination;
• unusual demand for physical currency;
• simultaneous financial stress affecting multiple institutions; or
• a broader event threatening confidence in financial-system stability.

BDCB describes safeguarding financial stability as a core mandate and supervises financial institutions to ensure compliance with regulatory requirements.

Illustrative Scenario

A significant financial institution experiences severe financial stress accompanied by intense public speculation and unusually high customer withdrawals.

For BDCB, this could create interconnected issues involving:

The specific financial or supervisory response would depend on BDCB's legal powers, the circumstances and applicable regulatory arrangements. From a crisis-management perspective, the key requirement is coordinated strategic decision-making under significant uncertainty.

Consolidated BDCB Crisis Scenario Catalogue

The following catalogue provides an initial basis for BDCB's Crisis Risk Assessment.

This catalogue should not be treated as exhaustive. It provides the starting point for structured assessment.

Crisis Scenarios Are Often Interconnected

One of the most important BDCB principles is that real crises are unlikely to remain within a single category.

For example:

Similarly:

Crisis planning should therefore avoid creating completely isolated plans for each scenario. BDCB requires a common crisis-management structure that can respond to different combinations of events.

From Crisis Scenario to Crisis Risk Assessment

Identification is only the first stage.

Each scenario should subsequently be assessed to determine:

• the specific form the crisis could take at BDCB;
• plausible causes and initiating events;
• existing preventive controls;
• potential impact on people;
• potential impact on critical BDCB functions;
• potential impact on regulated institutions;
• potential financial-system implications;
• stakeholder impact;
• legal and regulatory considerations;
• reputational consequences;
• potential for rapid escalation;
• communication requirements;
• management decision points; and
• required response capabilities.

The practical progression should be:

This aligns with BCMpedia's broader crisis-management approach, which connects scenario and threat assessment with prevention, crisis response and recovery strategies.

Establishing Crisis Escalation Triggers

BDCB should avoid activating its highest-level crisis arrangements for every incident. Instead, escalation criteria should help management determine when normal incident-management arrangements are no longer sufficient.

Potential escalation indicators include:

• threat to life or employee safety;
• prolonged loss of a critical BDCB function;
• significant cyber or information compromise;
• impact affecting several financial institutions;
• potential financial-system instability;
• significant payment-system disruption;
• substantial currency availability concerns;
• intervention required from senior BDCB management;
• involvement of multiple government authorities;
• intense media or public interest;
• rapidly spreading misinformation;
• serious allegations involving BDCB;
• significant legal or regulatory implications; or
• material threat to public confidence.

A practical escalation model is:

Implications for BDCB's Crisis Management Programme

The crisis-scenario catalogue should feed into the wider BDCB Crisis Management Programme.

Each priority scenario should eventually be linked to:

This prevents the scenario catalogue from becoming simply a list of risks. Instead, it becomes the foundation for developing actionable crisis-management capabilities.

Key Considerations for a Central Bank

Crisis management at BDCB has several characteristics that distinguish it from crisis management in many commercial organisations.

First, institutional credibility is itself an important asset. A crisis affecting confidence in BDCB could have consequences beyond direct operational disruption.

Second, BDCB operates within an interconnected financial ecosystem. Banks, financial institutions, payment arrangements, technology providers, government bodies and other stakeholders may become simultaneously involved.

Third, some events may originate outside BDCB. A serious incident affecting a regulated financial institution can potentially require significant BDCB coordination even when BDCB's own systems and premises remain fully operational.

Fourth, crisis communication can become integral to crisis management. During periods of uncertainty, inaccurate or poorly coordinated information may amplify an otherwise manageable event.

Finally, crises may evolve rapidly. The initial classification should therefore not constrain the response. A technological incident can become a reputational crisis; a rumour can create financial consequences; and a natural disaster can trigger simultaneous technology, workforce, supply-chain and financial-sector disruption.

The purpose of identifying crisis scenarios is not to predict precisely how BDCB's next crisis will occur. It is to ensure that management has considered the principal classes of events that could require extraordinary coordination and strategic intervention.

Using the BCMpedia framework, BDCB should consider eight broad categories:

Natural | Technological | Organisational Misdeeds | Confrontation | Malevolence | Workplace Violence | Rumours | Lack of Funds

For BDCB, these categories should be interpreted through the organisation's responsibilities for monetary policy, currency issuance and management, financial supervision, financial-system stability and payment-system oversight.

The most useful output is therefore not simply a list of threats. It is a BDCB Crisis Scenario Catalogue that translates each broad category into credible organisation-specific situations, identifies how those situations could escalate, determines when senior-management intervention is required, and provides the basis for crisis prevention, response, communication, recovery and exercising.

Ultimately, effective crisis preparedness should enable BDCB to move rapidly from:

Uncertainty → Situational Awareness → Strategic Decision → Coordinated Response → Stabilisation → Recovery → Organisational Learning

That capability is central to protecting BDCB's people and operations while preserving institutional credibility, stakeholder confidence and the resilience of the wider financial system.

The chapter is structured to lead directly into a BDCB Crisis Risk Assessment (CRA), where each scenario is expanded into specific threats, consequences, existing controls, prevention strategies, escalation triggers, and response requirements.

More Information About Crisis Management Courses

To learn more about the course and schedule, click the buttons below for the  CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].

		Please feel free to send us a note if you have any questions.