[CM] [BDCB] [E1] [C8] Implementing the CM Planning Methodology

Chapter 8

Implementing the Crisis Management Planning Methodology for Brunei Darussalam Central Bank

Introduction

Crisis Management (CM) capability should not begin with writing a Crisis Management Plan. An effective programme requires a structured methodology that establishes governance, identifies credible crisis scenarios, understands their consequences, develops appropriate strategies, documents response arrangements, validates them through exercises, and maintains the capability over time.

The BCM Institute Crisis Management Planning Methodology provides such a framework through seven interconnected phases. BCM Institute describes the methodology as seven blocks of activities supporting the implementation and ongoing management of Crisis Management, and notes that the methodology has been aligned with ISO 22361:2022.

For the Brunei Darussalam Central Bank (BDCB), the methodology needs to reflect its distinctive position as a central bank. BDCB's core functions include currency issuance and management, conduct of monetary policy, and supervision of banks and financial institutions. Its objectives include domestic price stability, financial-system stability, efficient payment systems, and development of a sound and progressive financial-services sector.

BDCB also operates Brunei Darussalam's National Payment and Settlement Systems (NPSS), comprising the Real-Time Gross Settlement (RTGS), Automated Clearing House (ACH), and Central Securities Depository (CSD). RTGS handles large-value and urgent interbank payments, while ACH clearing obligations ultimately settle through RTGS.

Consequently, a crisis affecting BDCB can extend beyond an internal organisational disruption and potentially affect financial institutions, payment and settlement activities, businesses, consumers, and confidence in Brunei Darussalam's financial system.

The seven-phase methodology is:

CM Project Management (PM) → Crisis Scenario Risk Analysis and Review (CAR) → Business Impact Analysis (BIA) → CM Strategy (BCS) → CM Plan Development (PD) → CM Testing and Exercising (TE) → CM Program Management (PgM)

Purpose of the CM Planning Methodology

The methodology provides BDCB with a structured path for converting Crisis Management principles into an operational capability.

Each phase answers a different management question:

The phases are sequential but not rigidly isolated. Findings from one phase should influence subsequent phases, while exercises, actual incidents, and organisational changes should feed improvements back into earlier phases.

Understand → Identify → Assess → Strategise → Plan → Exercise → Improve

This is consistent with BCM Institute's description of a structured and progressive CM planning sequence.

The Seven-Phase CM Planning Methodology

The overall implementation model for BDCB can be represented as:

Establish the CM Programme → Understand Crisis Risk → Understand Strategic Consequences → Develop Strategies → Develop the CM Plan → Exercise the Capability → Maintain and Improve

The methodology should not be viewed simply as seven documents to be completed. Each phase should produce a management decision and an improvement in organisational capability.

Phase 1 — CM Project Management (PM)

Purpose

Project Management establishes the foundation for BDCB's CM programme.

BCM Institute describes the first phase as establishing the Executive Management structure required to support CM planning and educating management on the purpose, process, and importance of Crisis Management.

For BDCB, this phase should establish:

• executive sponsorship;
• CM objectives;
• project scope;
• governance;
• CM policy;
• project organisation;
• roles and responsibilities;
• planning methodology;
• stakeholders;
• terminology;
• implementation schedule;
• reporting arrangements; and
• management approval requirements.

Establishing BDCB's CM Goals

BDCB's CM goals should be connected to its mandate and strategic responsibilities.

Possible goals include:

1. Protect life, safety, and welfare.
2. Maintain effective strategic leadership during crises.
3. Protect BDCB's ability to discharge its statutory responsibilities.
4. Support monetary and financial stability.
5. Protect critical payment and settlement activities.
6. Maintain reliable situational awareness.
7. Enable timely strategic decision-making.
8. Coordinate operational and specialist response capabilities.
9. Coordinate effectively with financial institutions and relevant authorities.
10. Maintain effective crisis communication.
11. Manage misinformation and confidence consequences.
12. Manage cascading and systemic consequences.
13. Sustain prolonged crisis operations.
14. Support controlled recovery.
15. Learn from crises and improve capability.

These goals provide the basis for later phases.

Establishing the CM Organisation

BDCB should distinguish between:

Strategic Crisis Management → Operational Incident Management → Specialist Response and Recovery

The Crisis Management Team (CMT) should focus primarily on strategic consequences and management decisions rather than performing technical response tasks.

Supporting teams may include:

• technology;
• cyber response;
• payment-system operations;
• financial-sector supervision;
• business continuity;
• disaster recovery;
• security;
• facilities;
• human resources;
• legal;
• risk;
• finance;
• procurement; and
• communications.

The governance structure should establish who leads, who supports, who provides information and who has authority to make particular decisions.

BDCB-Specific Requirement for PM

A specific BDCB requirement should be:

BDCB should establish a CM governance structure capable of simultaneously coordinating internal organisational disruption and external financial-system consequences.

This requirement recognises that an event such as a major RTGS disruption may require technology recovery while simultaneously requiring strategic coordination with financial institutions, assessment of settlement and liquidity consequences, stakeholder communication, and monitoring of financial-system confidence.

Phase 2 — Crisis Scenario Risk Analysis and Review (CAR)

Purpose

CAR identifies and evaluates the crisis scenarios for which BDCB should prepare.

The process should answer:

What could happen? → Why could it happen? → What controls exist? → What consequences could result? → How likely is it? → Which scenarios require priority preparedness?

The objective is not to predict every future crisis. It is to establish a sufficiently broad and credible portfolio of scenarios against which BDCB can develop Crisis Management capability.

Identifying BDCB Crisis Scenarios

Potential categories include:

• natural hazards;
• technological crises;
• cyber crises;
• payment and settlement crises;
• financial system crises;
• physical-security crises;
• confrontation;
• malevolent events;
• workplace violence;
• organisational misconduct;
• misinformation;
• people-related crises;
• third-party failures; and
• national or regional emergencies.

Scenario development should consider both events originating within BDCB and events originating outside BDCB.

Assessing Crisis Risk

CAR should evaluate relevant dimensions such as:

• people;
• operations;
• financial consequences;
• legal and regulatory implications;
• technology and information;
• payment and settlement;
• financial institutions;
• reputation;
• public confidence;
• social or national consequences; and
• financial-system stability.

Assessment should also go beyond conventional impact and likelihood.

BDCB should consider:

Speed of Onset + Duration + Uncertainty + Interdependencies + Detectability + Reversibility + Confidence Sensitivity

These characteristics determine how difficult the crisis may be to manage.

BDCB-Specific Requirement for CAR

BDCB should explicitly assess scenarios capable of creating financial-sector cascading consequences.

For example:

Technology Failure → RTGS Disruption → Financial Institutions Affected → Settlement Delays → Liquidity or Operational Pressure → Stakeholder Concern → Potential Confidence Consequences

This is particularly important because BDCB operates the NPSS, including RTGS, ACH and CSD. BDC Bank

A scenario should therefore not be rated solely according to its direct impact on BDCB.

Phase 3 — Business Impact Analysis (BIA)

Purpose

The BIA provides information about the activities, dependencies, and consequences that matter during a crisis.

Within the CM methodology, the BIA should not simply duplicate the organisation's BCM BIA. Instead, existing BCM information can provide an important foundation for understanding:

• critical business functions;
• products and services;
• recovery priorities;
• technology dependencies;
• personnel dependencies;
• facilities;
• information;
• third parties; and
• recovery requirements.

The Crisis Management perspective then asks what strategic consequences could emerge when those activities are seriously disrupted.

From Business Impact to Crisis Consequence

For BDCB:

Critical Activity Disrupted → Operational Consequence → Stakeholders Affected → Strategic Consequence → Potential Crisis

For example:

RTGS Disruption → Interbank Settlement Delayed → Financial Institutions Affected → Liquidity/Operational Consequences → Confidence Concern → Potential Financial-Stability Consequence

The CMT needs this wider consequence information to make strategic decisions.

BDCB-Specific Requirement for BIA

BDCB should identify the interdependencies between its critical activities and the wider financial sector.

This should include, where applicable:

• financial institutions;
• payment-system participants;
• telecommunications;
• technology providers;
• utilities;
• government stakeholders;
• counterparties;
• external financial infrastructure; and
• critical suppliers.

For NPSS, BDCB's published material confirms that ACH obligations ultimately feed into RTGS for settlement, demonstrating a direct system interdependency that should be reflected in impact and scenario analysis.

Phase 4 — CM Strategy (BCS)

Purpose

Once priority scenarios and consequences are understood, BDCB must determine how it intends to manage them.

The CM Strategy phase should develop both:

Crisis Prevention Strategies

Measures designed to reduce the likelihood or potential severity of a crisis.

Crisis Response Strategies

Pre-considered strategic approaches for managing the event once it has occurred.

The strategy phase bridges risk analysis and operational planning.

Crisis Scenario → Strategic Consequences → Strategic Objectives → Response Options → Preferred Strategy

Crisis Prevention Strategy

Prevention strategies may include:

• resilience measures;
• redundancy;
• enhanced monitoring;
• preventive security;
• cyber controls;
• supplier controls;
• financial-sector surveillance;
• early-warning indicators;
• stakeholder engagement;
• escalation arrangements; and
• crisis-awareness programmes.

Not every crisis can be prevented.

The objective is therefore:

Prevent Where Possible → Detect Early → Limit Escalation → Prepare for Residual Risk

Crisis Response Strategy

Strategic response approaches may include:

• monitoring without immediate strategic intervention;
• controlled restriction of information where disclosure would be inappropriate;
• active response and defence;
• proactive intervention;
• authoritative communication;
• stakeholder coordination;
• sector-wide coordination; and
• extraordinary management measures were authorised.

The selected approach should depend on the nature and consequences of the scenario rather than on a single universal response.

BDCB-Specific Requirement for BCS

For scenarios affecting critical financial infrastructure, BDCB should develop strategies addressing both technical recovery and financial-sector stabilisation.

For example:

RTGS Crisis Strategy = Technology Recovery + Transaction Integrity + Participant Coordination + Liquidity/Settlement Assessment + Strategic Communication + Confidence Management

Technical restoration alone should not define successful crisis resolution.

Phase 5 — CM Plan Development (PD)

Purpose

Plan Development converts governance and strategy into usable response procedures.

The Crisis Management Plan should explain how BDCB will:

• detect;
• assess;
• escalate;
• activate;
• establish command;
• develop situational awareness;
• make strategic decisions;
• coordinate operational teams;
• communicate;
• stabilise;
• recover; and
• stand down.

BCM Institute distinguishes the methodology from the crisis lifecycle but notes that the methodology equips organisations to prepare for and respond effectively across the lifecycle. BCM Institute Blog

Core Components of the BDCB Crisis Management Plan

The plan should contain or reference:

• purpose and scope;
• activation criteria;
• escalation procedures;
• CMT structure;
• roles and responsibilities;
• authority;
• contact arrangements;
• crisis command locations;
• virtual CMT arrangements;
• situation assessment;
• SitRep format;
• crisis logging;
• decision logging;
• action tracking;
• stakeholder management;
• crisis communication;
• scenario playbooks;
• recovery transition;
• stand-down; and
• post-crisis review.

The plan should support decision-making rather than become an excessively detailed document that is difficult to use under pressure.

Crisis Activation

A clear activation process should be established:

Event Detected → Situation Assessed → Strategic Consequences Considered → Escalation Criteria Reached → Authorised Decision → CMT Activated

Activation should be driven by strategic consequence, not merely technical severity.

BDCB-Specific Requirement for PD

BDCB should include a specific Major Payment and Settlement System Disruption Playbook.

The playbook should address at least:

• RTGS;
• ACH;
• CSD;
• participant connectivity;
• transaction integrity;
• technology recovery;
• settlement implications;
• financial-institution coordination;
• stakeholder notification;
• communications;
• financial-stability considerations; and
• recovery validation.

BDCB's own description of safe, reliable, and efficient financial-market infrastructures as key components supporting financial stability reinforces the importance of this requirement. 

Phase 6 — CM Testing and Exercising (TE)

Purpose

A Crisis Management Plan is only an assumption until it has been exercised.

Testing and Exercising should demonstrate whether:

• people understand their roles;
• escalation works;
• activation is timely;
• information reaches decision-makers;
• the CMT can develop situational awareness;
• decisions can be made under uncertainty;
• specialist teams coordinate effectively;
• stakeholder communication works;
• facilities and technology support the response; and
• recovery can be managed.

The methodology therefore moves from:

Plan Exists → Capability Exercised → Performance Observed → Gaps Identified → Improvements Implemented

Types of Exercises

BDCB can progressively use:

• Walkthroughs — review procedures and roles.

• Tabletop Exercises — discuss a simulated crisis.

• Functional Exercises — activate selected response capabilities.

• Simulation Exercises — introduce dynamic information and time pressure.

• Integrated Exercises — involve multiple internal teams.

• Multi-Organisation Exercises — involve financial institutions or other stakeholders where appropriate.

Exercise maturity should increase over time.

Exercising Decision-Making

Exercises should not simply test whether CMT members know the plan.

They should test whether the CMT can answer:

What is happening? → What could happen next? → What matters most? → What should BDCB do?

Scenarios should include:

• incomplete information;
• conflicting information;
• uncertainty;
• time pressure;
• stakeholder demands;
• media interest;
• misinformation;
• resource constraints; and
• changing conditions.

These conditions better approximate a real strategic crisis.

BDCB-Specific Requirement for TE

BDCB should periodically conduct an integrated exercise involving a significant payment-system disruption with escalating financial-sector consequences.

A possible exercise chain is:

RTGS Failure → Settlement Delays → Multiple Financial Institutions Affected → Liquidity Concerns → Stakeholder Enquiries → Media Attention → Misinformation → Confidence Concern → CMT Strategic Decisions

The exercise should test not merely technology recovery, but:

• escalation;
• CMT activation;
• situational awareness;
• participant coordination;
• decision-making;
• communications;
• financial-sector monitoring;
• recovery; and
• post-crisis transition.

Given the role of RTGS in large-value and urgent interbank settlement, this is a particularly relevant scenario for BDCB. 

Exercise Evaluation

Each exercise should produce evidence.

A structured process is:

Exercise → Observation → Finding → Root Cause → Corrective Action → Owner → Target Date → Implementation → Validation → Closure

A lesson is not fully learned until the required improvement has been implemented and demonstrated to be effective.

Phase 7 — CM Program Management (PgM)

Purpose

Program Management converts a one-time implementation project into an enduring organisational capability.

BCM Institute's methodology places Program Management after the initial implementation phases; published indicative scheduling shows it continuing after the initial project period. 

PgM should maintain:

• governance;
• policies;
• plans;
• teams;
• competencies;
• contact information;
• scenario assessments;
• exercises;
• corrective actions;
• management reporting;
• assurance;
• lessons learned; and
• continual improvement.

Maintaining the Programme

BDCB should review its CM arrangements when there are significant changes involving:

• organisation structure;
• senior leadership;
• statutory responsibilities;
• financial infrastructure;
• technology;
• payment systems;
• suppliers;
• facilities;
• threats;
• financial-sector structure;
• regulatory requirements; or
• lessons from incidents and exercises.

Program Management should therefore operate continuously.

Monitor → Review → Update → Train → Exercise → Learn → Improve

Management Reporting

Senior management should receive periodic information on CM readiness.

A useful dashboard could include:

The purpose is to provide management with evidence of capability, not merely evidence that documents exist.

BDCB-Specific Requirement for PgM

BDCB should maintain an integrated CM assurance process covering:

Internal CM Capability + Critical Financial Infrastructure + External Financial-Sector Dependencies + Crisis Communication + Recovery Capability

This is important because BDCB's resilience cannot be assessed solely within its organisational boundary.

For example, payment-system resilience depends on BDCB infrastructure, participant connectivity, and the ability of financial institutions to interact successfully with the system.

Integrating the Seven Phases

The methodology works because each phase provides inputs to the next.

PM — Establish Governance and Scope

↓

CAR — Identify and Prioritise Crisis Scenarios

↓

BIA — Understand Critical Activities, Dependencies and Consequences

↓

BCS — Develop Prevention and Response Strategies

↓

PD — Document Crisis Management Arrangements

↓

TE — Validate Capability

↓

PgM — Maintain and Improve

The output of Program Management then feeds back into the next cycle.

PgM → Updated PM/CAR/BIA/BCS/PD/TE → Improved CM Capability

Deliverables by Phase

These deliverables should be treated as components of one integrated CM capability.

BDCB Implementation Example — Major RTGS Disruption

The value of the methodology can be demonstrated through a single scenario.

PM

Establish who has authority to activate the CMT and who represents technology, payment systems, communications, financial-sector supervision, and other relevant functions.

CAR

Identify a prolonged RTGS disruption as a credible crisis scenario and assess existing controls, likelihood, consequences, and preparedness priority.

BIA

Determine which BDCB activities, financial institutions, payment activities, and stakeholders could be affected and how consequences develop over time.

BCS

Determine strategic approaches for technical recovery, participant coordination, settlement management, communications, and financial-sector stabilisation.

PD

Develop an RTGS crisis playbook defining escalation, CMT activation, information requirements, decisions, communication, and recovery arrangements.

TE

Exercise the scenario under realistic uncertainty and escalating consequences.

PgM

Correct weaknesses, update arrangements, and repeat the exercise to demonstrate improvement.

Thus:

RTGS Scenario → Assess Risk → Understand Consequences → Develop Strategy → Document Response → Exercise → Improve

Integrating Crisis Management with Related Capabilities

Crisis Management should not operate in isolation.

BDCB should integrate:

Incident Management + Emergency Management + Cyber Incident Response + IT Disaster Recovery + Business Continuity + Security + Crisis Communication → Coordinated Organisational Response

Each discipline has a different role.

Operational teams control their respective incidents. The CMT manages the strategic consequences.

This leads to a fundamental governance principle:

Operational Teams Manage the Incident → Crisis Management Team Manages the Strategic Response

Relationship with the Crisis Lifecycle

The planning methodology should also be distinguished from the crisis lifecycle.

BCM Institute explains that the crisis lifecycle describes how a crisis evolves, whereas the CM Planning Methodology provides the structured approach used to prepare the organisation to manage crises.

The lifecycle may broadly be viewed as:

Pre-Crisis → During Crisis → Post-Crisis

The seven-phase methodology develops the capability required to operate across all three stages.

For example:

The two concepts should therefore be complementary rather than interchangeable.

Implementation Governance

A practical implementation structure for BDCB could involve:

Senior Management Sponsorship → CM Program Lead → CM Project Team → Business and Specialist Representatives → Crisis Management Team → Supporting Response Teams

Senior management should approve major phase deliverables before the project progresses, where appropriate.

BCM Institute's training-led implementation approach similarly describes the CM Program Lead consolidating findings for each phase into reports for management approval before progressing.

Competency Development

BDCB should ensure that individuals responsible for implementing and operating the CM programme possess appropriate competency.

Different competencies are required for:

• CM programme leadership;
• risk and scenario analysis;
• impact analysis;
• strategic planning;
• crisis leadership;
• decision-making;
• crisis communication;
• exercise design;
• exercise evaluation;
• operational coordination; and
• post-crisis review.

Training should therefore be role-based rather than limited to general awareness.

Evidence of Implementation

For each phase, BDCB should maintain sufficient evidence to demonstrate that the methodology has been implemented.

Evidence might include:

Policy + Reports + Assessments + Approvals + Plans + Logs + Training Records + Exercise Reports + Corrective Actions + Management Reviews

This supports governance, assurance, independent review, and continual improvement.

Success Criteria

The methodology should ultimately enable BDCB to demonstrate that it can:

1. Recognise potential crises early.
2. Escalate emerging situations appropriately.
3. Activate the correct leadership structure.
4. Develop reliable situational awareness.
5. Make strategic decisions under uncertainty.
6. Coordinate specialist response teams.
7. Protect critical central-bank responsibilities.
8. Manage financial-sector consequences.
9. Communicate effectively with stakeholders.
10. Manage misinformation and confidence concerns.
11. Sustain a prolonged response.
12. transition effectively into recovery.
13. Learn from crises and exercises.
14. Continually improve its capability.

Success is therefore measured by demonstrated organisational capability, not by the number of Crisis Management documents produced.

Key Implementation Principle

The central implementation principle is:

BDCB should treat Crisis Management as an organisational capability developed progressively through governance, risk understanding, consequence analysis, strategy, planning, exercising, and continual improvement—not simply as the production of a Crisis Management Plan.

The implementation journey can therefore be summarised as:

Govern → Understand → Assess → Strategise → Plan → Exercise → Improve

BCM Institute's seven-phase approach is designed to provide this structured roadmap and has been positioned as a modular methodology aligned with ISO 22361:2022. 

Implementing Crisis Management for Brunei Darussalam Central Bank requires a systematic methodology reflecting both BDCB's organisational responsibilities and its wider role within Brunei Darussalam's financial system. The seven-phase Crisis Management Planning Methodology provides a practical framework for achieving this.

CM Project Management establishes governance, sponsorship, and organisational foundations. Crisis Scenario Risk Analysis and Review identifies and prioritises credible crises. Business Impact Analysis provides an understanding of critical activities, dependencies, and strategic consequences. CM Strategy determines how priority scenarios should be prevented, prepared for, and managed. CM Plan Development converts those strategies into executable arrangements. CM Testing and Exercising demonstrates whether the capability works under realistic conditions. Finally, CM Program Management ensures that the capability remains current, competent, and continually improving.

For BDCB, the methodology should place particular emphasis on financial-system interdependencies and the National Payment and Settlement Systems. BDCB operates RTGS, ACH, and CSD, and its published material recognises safe, reliable, and efficient financial-market infrastructure as important to financial stability and economic growth.  Consequently, CM implementation should explicitly address scenarios in which an internal operational or technology event propagates into financial institutions, payment and settlement activities, and wider confidence consequences.

The complete BDCB implementation cycle is:

Establish Governance → Identify Crisis Scenarios → Understand Consequences → Develop Strategies → Build the Crisis Management Plan → Exercise the Capability → Maintain, Review, and Improve

The outcome should be more than an approved plan. BDCB should be able to demonstrate a trained, exercised, evidence-based, and continually improving Crisis Management capability capable of protecting people, supporting its mandate, maintaining strategic leadership, and managing crises whose consequences could extend into Brunei Darussalam's wider financial system.

 

 

 

eBook 1: Understanding Your Organisation
C1	C2	C3	C4	C5	C5A	C6
C7	C8	C9	C10	C11	C12	C13

More Information About Crisis Management Blended/ Hybrid Learning Courses

To learn more about the course and schedule, click the buttons below for the  CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].

	Please feel free to send us a note if you have any questions.