---
title: [CM] [BDCB] [E1] [C9] Pre-Crisis - Risk Identification and Crisis Preparedness
description: [CM] [BDCB] [E1] [C9] Pre-Crisis - Risk Identification and Crisis Preparedness
image: https://blog.bcm-institute.org/hubfs/BDCB%20Graphic%20Folder/BDCB%20CM%20Graphic%20Folder/%5BCM%5D%20%5BBDCB%5D%20%5BE1%5D%20%5BC9%5D%20Pre-Crisis%20-%20Risk%20Identification%20and%20Crisis%20Preparedness.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Crisis Management in Action: A Practical Implementation Guide for BDCB
# \[CM\] \[BDCB\] \[E1\] \[C9\] Pre-Crisis - Risk Identification and Crisis Preparedness
[![\[CM\] \[BDCB\] \[Full Banner\] Crisis Management in Action\_ A Practical Implementation Guide for BDCB](https://no-cache.hubspot.com/cta/default/3893111/399bc296-6bd2-4c03-8819-8bfe517a3e07.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/399bc296-6bd2-4c03-8819-8bfe517a3e07)
This chapter explains how Brunei Darussalam Central Bank (BDCB) can strengthen its **pre-crisis capability by identifying potential crises, assessing and categorising crisis risks, developing scenarios and contingency arrangements, and establishing early-warning indicators**.
The pre-crisis stage is where an organisation seeks to anticipate emerging threats, reduce preventable exposures, and prepare management to act before an event develops into a strategic crisis.
BCM Institute's crisis-stage framework describes crisis management through three broad stages—pre-crisis, during crisis, and post-crisis—and characterises the pre-crisis stage principally in terms of prevention and preparation.
This chapter also provides a practical bridge between BDCB's understanding of its organisational context and the more detailed Crisis Risk Analysis, Crisis Management Strategy, and Crisis Management Plan activities addressed later in the implementation journey.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/981cfdd3-4d91-4cec-b657-2b6feaa7ef76)
[Moh Heng Goh](https://blog.bcm-institute.org/en/ebook-cm/author/moh-heng-goh) Oct 8, 2026
###### Crisis Management Certified Planner-Specialist-Expert
##### [![\[CM\] \[BDCB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/062c8304-1699-4f7b-a38d-f128d9815304.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/062c8304-1699-4f7b-a38d-f128d9815304)
### Chapter 9
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/981cfdd3-4d91-4cec-b657-2b6feaa7ef76)
#### Purpose of This Chapter
[![\[CM\] \[BDCB\] \[E1\] \[C9\] Pre-Crisis - Risk Identification and Crisis Preparedness](https://no-cache.hubspot.com/cta/default/3893111/6ebafa39-8b98-4f27-946f-5c04561346f3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6ebafa39-8b98-4f27-946f-5c04561346f3)
This chapter explains how Brunei Darussalam Central Bank (BDCB) can strengthen its **pre-crisis capability by identifying potential crises, assessing and categorising crisis risks, developing scenarios and contingency arrangements, and establishing early-warning indicators**.
The pre-crisis stage is where an organisation seeks to anticipate emerging threats, reduce preventable exposures, and prepare management to act before an event develops into a strategic crisis.
BCM Institute's crisis-stage framework describes crisis management through three broad stages—pre-crisis, during crisis, and post-crisis—and characterises the pre-crisis stage principally in terms of prevention and preparation.
This chapter also provides a practical bridge between BDCB's understanding of its organisational context and the more detailed Crisis Risk Analysis, Crisis Management Strategy, and Crisis Management Plan activities addressed later in the implementation journey.
It is aligned with the intent of **ISO 22361:2022**, which guides organisations to plan, establish, maintain, review, and continually improve a strategic crisis-management capability and covers organisational context, capability development, crisis leadership, decision-making, communication, training, validation, and learning.
#### **Introduction**
For BDCB, effective Crisis Management should begin well before the Crisis Management Team is activated.
The pre-crisis stage provides the opportunity to understand what could threaten the organisation, recognise how apparently isolated incidents could escalate, identify vulnerabilities and interdependencies, establish warning indicators, develop plausible crisis scenarios, and prepare leaders to make decisions under uncertainty.
The objective is not to predict every future crisis. It is to create sufficient organisational awareness and preparedness so that BDCB can identify emerging problems early and respond before consequences become unmanageable.
This requirement is particularly significant for a central bank. BDCB's stated core functions include currency issuance and management, the conduct of monetary policy, and supervision of banks and financial institutions.
Its objectives include domestic price stability, financial-system stability, efficient payment systems, and development of a sound and progressive financial-services sector.
BDCB also operates Brunei Darussalam's National Payment and Settlement Systems (NPSS), comprising RTGS, ACH, and CSD. Consequently, a crisis could originate within BDCB or elsewhere in the financial ecosystem and could potentially propagate through financial institutions, payment infrastructure, businesses, consumers, and public confidence.
#### **Understanding the Pre-Crisis Stage**
The pre-crisis stage concerns what an organisation does **before a strategic crisis materialises**. BCM Institute's crisis-stage model identifies pre-crisis, during-crisis, and post-crisis stages, with the pre-crisis stage centred on prevention and preparation.
For BDCB, the pre-crisis stage should therefore address four interconnected activities:
**Identify Potential Crises → Assess, and Categorise Crisis Risks → Develop Scenarios and Contingency Arrangements → Monitor Early-Warning Indicators → Escalate Emerging Concerns**
These activities should not operate as a one-time risk-assessment exercise. They form an ongoing process in which information from risk management, supervision, cybersecurity, technology, payment operations, security, BCM, financial-stability monitoring, and external intelligence contributes to organisational crisis awareness.
The ultimate objective is:
**Earlier Detection + Better Understanding + Prepared Leadership + Tested Arrangements = Stronger Crisis Preparedness**
#### **Pre-Crisis Preparedness and ISO 22361**
ISO 22361 does not reduce Crisis Management to a collection of scenario-specific response procedures. It addresses the development of a strategic organisational capability to identify and manage crises, including organisational context, leadership, decision-making, communication, training, validation and learning.
For BDCB, alignment with this approach means that pre-crisis preparation should develop several capabilities simultaneously:
| Capability | Pre-Crisis Requirement |
| --- | --- |
| Context Awareness | Understand BDCB's mandate, stakeholders, and operating environment |
| Risk Awareness | Identify threats and conditions capable of creating strategic crises |
| Scenario Awareness | Understand how threats could develop and escalate |
| Early Warning | Detect changes indicating increasing crisis potential |
| Leadership Preparedness | Prepare senior leaders for crisis roles |
| Decision Preparedness | Identify strategic decision points and authorities |
| Communication Preparedness | Prepare stakeholder and crisis-communication arrangements |
| Response Preparedness | Develop strategies, plans, and playbooks |
| Validation | Exercise scenarios and test assumptions |
| Learning | Incorporate findings into continual improvement |
The emphasis should therefore be on **preparedness of the organisation**, rather than simply preparedness of the Crisis Management Plan.
#### **Identifying Potential Crises Affecting BDCB**
##### **Purpose of Crisis Identification**
The first activity is to identify circumstances capable of developing into a crisis for BDCB.
A threat does not automatically constitute a crisis. A routine technology outage, employee incident or supplier problem may initially be manageable through normal operational arrangements.
It becomes a Crisis Management concern when its actual or potential consequences require strategic leadership and coordination beyond routine management.
The progression can be understood as:
Crisis identification should therefore consider both the **originating event** and its **potential consequences**.
#### **Sources of Potential Crises**
BDCB should identify crisis exposures using multiple information sources rather than relying solely on an enterprise risk register.
Potential sources include:
- enterprise and operational risk assessments;
- BCM Business Impact Analysis;
- cyber-threat intelligence;
- information-security assessments;
- technology and infrastructure monitoring;
- payment-system monitoring;
- financial-sector surveillance;
- supervisory intelligence;
- third-party and supplier assessments;
- security threat assessments;
- health and safety assessments;
- facilities assessments;
- incident and near-miss records;
- internal audit findings;
- exercise observations;
- complaints and stakeholder intelligence;
- media and social-media monitoring;
- government and national threat information;
- international developments; and
- lessons from crises affecting comparable organisations.
The objective is to create a **multi-source view of crisis potential**.
#### **Categories of Potential Crisis Affecting BDCB**
Based on BDCB's role and operating environment, the following categories provide a practical starting point.
| Crisis Category | Illustrative Crisis Scenarios |
| --- | --- |
| Natural | Flooding, severe weather, haze, earthquake effects, and infectious disease |
| Technological | Major system failure, network outage, telecommunications failure, data-centre failure |
| Cyber | Cyberattack, ransomware, DDoS, cyber espionage, data manipulation |
| Payment and Settlement | RTGS disruption, ACH disruption, CSD disruption, payment-data integrity problem |
| Financial-System | Financial institution distress, liquidity stress, bank run, contagion |
| Confrontation | Protest, blockade, stakeholder confrontation |
| Malevolence | Terrorism, bomb threat, sabotage, extortion |
| Organisational Misdeeds | Fraud, corruption, concealment, abuse of authority |
| Workplace Violence | Assault, armed intruder, hostage situation |
| Rumours and Misinformation | False financial-stability information, deepfake, fake BDCB announcement |
| People | Loss of key personnel, widespread workforce unavailability |
| Third Party | Critical technology, telecommunications, utility, or supplier failure |
These are **planning scenarios**, not assertions that such incidents have occurred at BDCB.
#### **Identifying Crises Through Consequences**
A useful approach is to supplement threat-based identification with **consequence-based identification**.
Management should ask:
**What outcomes would be sufficiently serious that BDCB's senior leadership would need to intervene strategically?**
Potential consequences include:
- risk to life and safety;
- inability to discharge statutory responsibilities;
- major interruption to critical BDCB activities;
- significant payment or settlement disruption;
- loss of integrity of important financial information;
- financial-institution distress;
- liquidity or settlement problems;
- significant regulatory consequences;
- major stakeholder concern;
- loss of public confidence;
- national-level implications;
- major media scrutiny;
- widespread misinformation; and
- potential financial system instability.
This avoids the weakness of trying to predict every possible initiating event.
#### **Crisis Identification Through Interdependencies**
Potential crises should also be identified through BDCB's dependencies and interdependencies.
For example:
A failure at the beginning of the chain may appear technical. Its eventual consequence may be strategic.
This is particularly relevant to BDCB's payment infrastructure.
BDCB states that safe, reliable, and efficient financial-market infrastructures are important to financial stability and economic growth.
Its NPSS comprises RTGS, ACH, and CSD; ACH obligations are ultimately submitted to RTGS for settlement, demonstrating an important operational dependency within the infrastructure.
#### **Crisis Risk Assessment and Categorisation**
##### **Purpose**
Once potential crisis scenarios have been identified, BDCB should assess them systematically.
The objective is not simply to produce a numerical risk score. The assessment should help management understand:
- how the crisis could develop;
- what could be affected;
- how serious the consequences could become;
- how quickly escalation could occur;
- what warning may be available;
- which controls currently exist;
- what additional preparedness is required; and
- which scenarios require priority Crisis Management planning.
#### **Assessing Crisis Impact**
Impact should be assessed across several dimensions because a crisis can create consequences that are not adequately represented by financial loss alone.
A practical BDCB framework could include:
| Impact Area | Assessment Considerations |
| --- | --- |
| People | Injury, safety, health, and workforce availability |
| Operations | Disruption to critical BDCB activities |
| Financial | Direct and indirect financial consequences |
| Legal and Regulatory | Statutory, legal, and compliance implications |
| Technology and Information | Availability, integrity, and confidentiality |
| Payment and Settlement | Effect on RTGS, ACH, CSD, and participants |
| Financial Institutions | Operational, liquidity, or solvency consequences |
| Reputation and Confidence | Stakeholder, media, and public confidence |
| National/Social | Effects on businesses, consumers, or national interests |
| Financial Stability | Potential systemic consequences |
For a central bank, **systemic consequences should** receive explicit attention even where the probability of occurrence is low.
#### **Assessing Likelihood**
Likelihood represents the reasonable prospect of a scenario occurring within an agreed planning horizon.
A simple five-level scale may be used:
| Score | Likelihood | Interpretation |
| --- | --- | --- |
| 1 | Very Low | Rare or exceptional |
| 2 | Low | Unlikely but plausible |
| 3 | Medium | Credible and reasonably possible |
| 4 | High | Expected to occur periodically |
| 5 | Very High | Frequent or highly probable |
Likelihood estimates should be supported where practicable by:
- historical incidents;
- internal events;
- industry events;
- threat intelligence;
- technology trends;
- supervisory observations;
- environmental information;
- supplier performance;
- geopolitical developments; and
- expert judgement.
#### **Beyond Impact and Likelihood**
Traditional risk assessment often focuses on impact and likelihood. Crisis preparedness should consider additional characteristics.
##### **Speed of Onset**
How quickly can the situation develop?
A cyberattack may escalate in minutes, whereas financial stress or reputational deterioration may develop over days or weeks.
##### **Duration**
How long might the strategic consequences persist?
##### **Detectability**
Will BDCB receive a meaningful warning?
##### **Uncertainty**
How difficult will it be to establish reliable facts?
##### **Interdependency**
How readily could the event spread to other systems, institutions, or stakeholders?
##### **Reversibility**
Can consequences be quickly reversed once the initiating event is controlled?
##### **Confidence Sensitivity**
Could communication, speculation, or stakeholder behaviour accelerate the crisis?
These dimensions can materially affect Crisis Management preparedness even where two scenarios have identical numerical risk ratings.
#### **Categorising Crisis Scenarios**
Following the assessment, BDCB can categorise scenarios according to preparedness priority.
One practical model is:
**Routine Operational Risk → Significant Incident → Potential Crisis → Strategic Crisis → Systemic/National Crisis**
The categorisation should not be interpreted as a rigid sequence. Some events may move directly from routine conditions to a strategic crisis.
A high-impact cyberattack, terrorist event, or sudden financial institution failure, for example, may require immediate senior-level intervention.
#### **Crisis Prioritisation**
BDCB should identify **Priority Crisis Scenarios** requiring deeper preparedness.
Prioritisation criteria could include:
- very high strategic impact;
- financial-stability implications;
- life-safety consequences;
- critical payment-system consequences;
- rapid escalation;
- low detectability;
- significant uncertainty;
- strong interdependencies;
- high stakeholder sensitivity;
- national implications;
- complex communications;
- limited response time; and
- scenarios requiring cross-agency coordination.
Priority does not mean that lower-rated scenarios are ignored.
A **low-likelihood but catastrophic scenario** may still require extensive preparation.
#### **Scenario Planning and Contingency Planning**
##### **Purpose of Scenario Planning**
Risk assessment identifies what could go wrong. **Scenario planning explores how it could unfold.**
A useful crisis scenario should describe:
- initiating event;
- operating context;
- affected activities;
- stakeholders;
- dependencies;
- escalation pathway;
- uncertainties;
- decision points;
- potential consequences; and
- possible recovery challenges.
The objective is not to predict exactly what will happen.
Instead, scenario planning prepares decision-makers to deal with **credible conditions and consequences**.
#### **Developing a Crisis Scenario**
A practical BDCB scenario-development process is:
**Threat Identification → Define Trigger Event → Identify Immediate Impact → Map Dependencies → Develop Escalation Path → Identify Strategic Consequences → Define Decision Points → Determine Response Requirements**
Each scenario should remain sufficiently realistic to support meaningful planning but sufficiently flexible to avoid over-engineering a single sequence of events.
#### **Example — Major RTGS Disruption**
Consider a prolonged RTGS disruption.
RTGS supports large-value and urgent interbank payments in real time, with interbank payments settled using funds held in settlement accounts at BDCB. BDCB describes RTGS as a central component of the national payment system.
The scenario could develop as:
**Technology Failure → RTGS Unavailable → Interbank Settlement Delayed → Financial Institutions Affected → Liquidity or Operational Pressure → Stakeholder Concern → Media Attention → Potential Confidence Impact → Strategic Crisis**
Scenario planning should then explore questions such as:
- What caused the failure?
- Is transaction integrity assured?
- Which institutions are affected?
- What settlement obligations are outstanding?
- Is ACH affected because of its settlement dependency on RTGS?
- Are CSD-related settlement activities affected?
- What liquidity consequences could develop?
- How long will recovery take?
- What information should participants receive?
- When should senior management be informed?
- What circumstances require CMT activation?
- Could misinformation amplify the situation?
- What external coordination may be required?
The scenario thereby moves beyond technology recovery into strategic Crisis Management.
#### **Contingency Planning**
Scenario planning should lead to **contingency planning**.
Contingency planning identifies what BDCB should be prepared to do if specified conditions develop.
It can include:
- alternative operational arrangements;
- Crisis Management Team activation;
- alternate communication methods;
- alternate workplaces;
- specialist technical response;
- additional monitoring;
- external stakeholder coordination;
- predefined decision authorities;
- crisis communication arrangements;
- payment-system participant communication;
- manual or workaround procedures;
- supplier escalation;
- resource mobilisation; and
- recovery priorities.
The relationship is:
**Scenario → Potential Consequences → Required Capabilities → Contingency Options → Decision Criteria → Prepared Response**
#### **Scenario Planning Should Include Escalation**
A crisis scenario should not be written merely as a description of the worst-case outcome.
It should explain **how conditions deteriorate**.
A practical escalation model is:
**Normal Operations → Abnormal Condition → Incident → Significant Incident → Potential Crisis → Crisis → Strategic/Systemic Consequences**
At each stage, BDCB should determine:
- what information becomes available;
- who should receive it;
- what threshold has been crossed;
- what decision is required;
- which team should respond; and
- whether governance should escalate.
This connects scenario planning directly to early warning.
#### **Preparing for Scenario Uncertainty**
A common weakness in contingency planning is assuming that the actual crisis will match the planned scenario.
BDCB should instead prepare for **variations and uncertainties**.
For example, an RTGS exercise might begin with system unavailability but subsequently introduce:
- uncertain transaction integrity;
- telecommunications problems;
- delayed technology recovery;
- simultaneous participant connectivity problems;
- liquidity concerns;
- misinformation that all banking payments have failed;
- increasing media enquiries; and
- conflicting technical recovery estimates.
This forces decision-makers to manage the **evolving strategic problem**, rather than simply follow a scripted technical recovery plan.
#### **Early Warning Systems and Crisis Indicators**
##### **Purpose of Early Warning**
Many crises provide signals before reaching their most serious stage.
The challenge is that warning signs may be:
- weak;
- distributed across different departments;
- ambiguous;
- individually insignificant;
- rapidly changing; or
- recognised only in hindsight.
An effective early-warning capability, therefore, needs to connect information from multiple sources.
The process can be expressed as:
**Monitor → Detect → Verify → Assess → Escalate → Decide → Act**
#### **Leading and Lagging Indicators**
BDCB should distinguish between **leading indicators** and **lagging indicators**.
##### **Leading Indicators**
These suggest that risk is increasing before serious consequences occur.
Examples include:
- increasing cyber-threat activity;
- repeated system warnings;
- unusual transaction patterns;
- declining system performance;
- supplier instability;
- increasing liquidity pressure;
- unusual withdrawal activity;
- rising complaints;
- growing negative social-media activity;
- emerging misinformation;
- deteriorating weather;
- increased employee absenteeism; and
- repeated control failures.
##### **Lagging Indicators**
These confirm that adverse consequences are already occurring.
Examples include:
- system outage;
- failed transactions;
- financial loss;
- customer disruption;
- physical injury;
- confirmed data breach;
- payment settlement failure;
- media escalation; and
- formal stakeholder complaints.
The greatest preparedness value comes from detecting and acting upon **leading indicators** before lagging indicators confirm a crisis.
#### **Illustrative BDCB Crisis Indicators**
| Area | Illustrative Early-Warning Indicators |
| --- | --- |
| Cybersecurity | Increased malicious traffic, credential attacks, and abnormal privileged access |
| Technology | Repeated faults, capacity thresholds, unusual latency, failed changes |
| RTGS/ACH/CSD | Transaction backlog, connectivity problems, abnormal settlement behaviour |
| Financial Institutions | Liquidity pressure, abnormal withdrawals, and operational disruption |
| Third Parties | SLA deterioration, repeated outages, and financial deterioration |
| People | High absenteeism, loss of critical specialists |
| Facilities | Utility instability, environmental warning, and access constraints |
| Security | Threat reports, suspicious activity, protest intelligence |
| Reputation | Sudden increase in negative coverage |
| Misinformation | Rapid spread of false claims concerning BDCB, currency, banks, or payments |
| National Environment | Severe weather, public-health, or security warnings |
These indicators are illustrative. Thresholds should be developed and approved by BDCB based on its actual operating environment.
#### **Thresholds and Triggers**
An indicator becomes useful when management knows **what action it should trigger**.
BDCB can establish graduated thresholds such as:
| Status | Meaning | Illustrative Management Response |
| --- | --- | --- |
| Green | Normal conditions | Routine monitoring |
| Amber | Increasing concern | Enhanced monitoring and management notification |
| Red | Serious deterioration | Senior management escalation and readiness |
| Crisis | Strategic consequences occurring or imminent | Consider/activate Crisis Management arrangements |
The purpose is not to automate Crisis Management decisions.
Rather, thresholds help decision-makers recognise that the organisation is moving away from normal operating conditions.
#### **Escalation Criteria**
Crisis escalation should consider more than the severity of the initiating event.
Potential criteria include:
- actual or potential fatalities or serious injuries;
- inability to perform critical responsibilities;
- prolonged disruption;
- significant payment-system consequences;
- multiple financial institutions affected;
- potential financial contagion;
- uncertain data or transaction integrity;
- significant legal or regulatory exposure;
- national-level consequences;
- substantial public or media concern;
- rapidly spreading misinformation;
- multiple response teams required;
- decision outside normal authority;
- high uncertainty;
- rapidly changing circumstances; and
- requirement for senior strategic intervention.
The decision model can be represented as:
**Indicator Detected → Threshold Exceeded → Situation Assessed → Strategic Consequences Considered → Escalation Decision → CMT Readiness or Activation**
#### **Consolidated Crisis Monitoring**
One of the most important pre-crisis capabilities is the ability to consolidate signals from different parts of the organisation.
A technology team may see system degradation.
Cybersecurity may observe suspicious activity.
Payment operations may observe transaction delays.
Communications may detect increasing stakeholder enquiries.
Supervision may identify stress at financial institutions.
Individually, these may appear manageable. Together, they may indicate a developing crisis.
Therefore:
**Technology Signals + Cyber Intelligence + Operational Indicators + Financial-Sector Intelligence + Stakeholder Information + External Intelligence → Consolidated Crisis Awareness**
This consolidated perspective should support senior management situational awareness.
#### **From Early Warning to Crisis Activation**
Early warning is valuable only if it leads to appropriate action.
BDCB should therefore establish a clear pathway:
**Early Warning → Verification → Assessment → Management Notification → Enhanced Monitoring → Preparedness Actions → Escalation → CMT Activation if Required**
Preparedness actions before formal CMT activation may include:
- alerting CMT members;
- confirming availability;
- increasing monitoring;
- collecting information;
- preparing situation reports;
- checking communication channels;
- confirming external contacts;
- reviewing relevant playbooks;
- preparing holding statements; and
- placing specialist teams on standby.
This creates a valuable **readiness stage** between normal operations and full crisis activation.
#### **Crisis Preparedness Arrangements**
Risk identification and early warning should ultimately result in organisational preparedness.
BDCB should consider preparedness across several areas:
##### **Governance Preparedness**
CMT structure, authority, alternates, escalation, and activation.
##### **People Preparedness**
Training, competence, succession, availability, and welfare.
##### **Information Preparedness**
Situation-reporting formats, information sources, decision logs, and information validation.
##### **Communication Preparedness**
Stakeholder lists, communication channels, approval processes, spokesperson arrangements, and holding statements.
##### **Technology Preparedness**
Resilient communications, alternate systems, and technical recovery coordination.
##### **Facility Preparedness**
Primary and alternate Crisis Management locations.
##### **Stakeholder Preparedness**
Government, financial institutions, payment participants, emergency services, and critical suppliers.
##### **Decision Preparedness**
Predefined strategic issues, decision authorities, options, and escalation thresholds.
#### **Crisis Management Team Readiness**
A Crisis Management Team should not first discover its operating arrangements when the crisis begins.
Before a crisis, BDCB should confirm:
- primary and alternate members;
- responsibilities;
- authority;
- notification arrangements;
- physical and virtual meeting arrangements;
- crisis-room capability;
- secure communications;
- situation-reporting templates;
- decision-log arrangements;
- stakeholder contacts;
- specialist advisers;
- communication approval;
- handover arrangements; and
- prolonged-response arrangements.
The preparedness principle is:
**People + Governance + Information + Communications + Facilities + Technology + Procedures → Crisis Management Readiness**
#### **Training and Exercising**
Preparedness should be validated through training and exercising.
ISO 22361 explicitly includes training, validation, and learning among the elements of strategic Crisis Management capability.
BDCB should consider a progressive exercise programme incorporating:
- orientation sessions;
- notification tests;
- call-tree tests;
- tabletop exercises;
- decision-making exercises;
- crisis-communication exercises;
- technology/cyber exercises;
- payment-system scenarios;
- multi-team exercises; and
- complex simulations involving external stakeholders.
Exercises should test not simply whether participants remember procedures, but whether they can **interpret information, manage uncertainty, make strategic decisions, and coordinate effectively**.
#### **Example Pre-Crisis Preparedness Framework for BDCB**
A practical end-to-end framework can be expressed as:
**Understand Organisational Context → Identify Threats → Develop Crisis Scenarios → Assess Risks → Prioritise**
**Scenarios → Identify Controls → Develop Contingency Strategies → Establish Early-Warning Indicators → Define**
**Escalation Thresholds → Prepare Crisis Management Arrangements → Train and Exercise → Review and Improve**
This framework creates a continuous connection between **risk awareness and crisis readiness**.
#### **Relationship with Business Continuity Management**
Pre-crisis Crisis Management and BCM should be integrated but remain distinct.
BCM identifies disruptions that could affect critical business functions and establishes continuity and recovery arrangements.
Crisis Management considers whether those disruptions—or other events not necessarily causing business interruption—could create strategic consequences requiring senior leadership.
The relationship can be represented as:
**Risk and Threat Information → BCM and Operational Preparedness → Emerging Incident → Operational Consequences + Strategic Consequences → BCM/Recovery and Crisis Management Responses as Required**
This is particularly important for technology, cyber, and payment-system incidents where operational recovery and strategic Crisis Management may need to proceed concurrently.
#### **Relationship with the Crisis Risk Assessment**
The work described in this chapter should feed directly into BDCB's more detailed **Crisis Risk Assessment (CRA)**.
The implementation progression is:
**Potential Threats → Crisis Scenarios → Existing Controls → Additional Controls → Impact Assessment → Likelihood Assessment → Crisis Risk Rating → Preparedness Priority**
The CRA, therefore, provides structured evidence supporting decisions about which scenarios require additional controls, contingency arrangements, playbooks, training, and exercising.
#### **Pre-Crisis Governance**
Senior management should have visibility of the organisation's significant crisis exposures before an event occurs.
Pre-crisis governance should therefore address:
- ownership of crisis risks;
- responsibility for scenario development;
- approval of assessment criteria;
- approval of escalation thresholds;
- monitoring responsibilities;
- CMT preparedness;
- exercise programmes;
- corrective actions;
- reporting to senior management; and
- periodic review of Crisis Management capability.
This reinforces a core ISO 22361 principle: Crisis Management is a **strategic organisational capability**, not merely an emergency-response procedure.
#### **Pre-Crisis Preparedness Checklist**
Before concluding that BDCB is prepared, management should be able to answer **Yes** to questions such as:
| Preparedness Question | Expected Evidence |
| --- | --- |
| Have credible crisis scenarios been identified? | Crisis scenario catalogue |
| Have scenarios been assessed? | Crisis Risk Assessment |
| Are priority scenarios known? | Risk prioritisation |
| Are dependencies understood? | Dependency maps |
| Are warning indicators identified? | Indicator register/dashboard |
| Are escalation thresholds defined? | Escalation framework |
| Are CMT members and alternates appointed? | CMT structure |
| Are the decision authorities clear? | Governance framework |
| Are communication arrangements prepared? | Crisis communication plan |
| Are key external contacts maintained? | Stakeholder contact register |
| Are scenario playbooks available where appropriate? | Crisis playbooks |
| Has the CMT been trained? | Training records |
| Have arrangements been made? | Exercise reports |
| Have corrective actions been implemented? | Improvement tracker |
| Are arrangements periodically reviewed? | Review records |
The checklist should be treated as a governance aid rather than a substitute for professional judgement.
#### **Key Implementation Principle**
The central principle of pre-crisis management is:
**The objective is not to predict the next crisis. It is to create an organisation capable of recognising emerging threats, understanding their potential consequences, and acting before those consequences become unmanageable.**
For BDCB, this requires connecting risk identification with strategic preparedness:
**Threat Awareness → Crisis Risk Understanding → Scenario Preparedness → Early Warning → Timely Escalation → Strategic Readiness**
A well-prepared organisation should therefore not wait for certainty that a crisis exists before beginning to prepare its leadership and response capability.
### [![\[Summary\] \[CM\] \[E1\] \[C9\] Pre-Crisis - Risk Identification and Crisis Preparedness](https://no-cache.hubspot.com/cta/default/3893111/d9982046-32d9-47ce-a0d4-990cca0e43f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d9982046-32d9-47ce-a0d4-990cca0e43f0)
The pre-crisis stage establishes the foundation upon which BDCB's Crisis Management capability operates.
It begins by identifying potential crises from threats, vulnerabilities, dependencies, financial-sector developments, and emerging conditions, and then assessing how these could affect people, operations, payment infrastructure, financial institutions, confidence, and financial-system stability.
Crisis Risk Assessment enables BDCB to prioritise scenarios, while scenario planning converts abstract risks into plausible situations involving triggers, escalation paths, stakeholders, strategic consequences, and management decision points.
Contingency planning then identifies the capabilities and response options that should be prepared before they are required.
Effective preparedness also depends on recognising early-warning signals and converting them into timely management action. Indicators should therefore be connected to thresholds, escalation criteria, senior-management notification, and Crisis Management Team readiness.
For BDCB, this requires information to be consolidated across technology, cybersecurity, payment operations, supervision, risk, security, communications, BCM, and external intelligence.
The result is an ISO 22361-aligned strategic capability that enables BDCB not merely to react when a crisis is fully developed, but to **anticipate, recognise, prepare, escalate, and intervene while there is still an opportunity to shape the outcome**.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
[![\[CM\] \[BDCB\] \[3/4 Banner\] Crisis Management in Action\_ A Practical Implementation Guide for BDCB](https://no-cache.hubspot.com/cta/default/3893111/b3d8c34f-d579-45e8-aba7-c04de5f90bb2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3d8c34f-d579-45e8-aba7-c04de5f90bb2)
| **eBook 1: Understanding Your Organisation** | | | | | | |
| --- | --- | --- | --- | --- | --- | --- |
| **C1** | **C2** | **C3** | **C4** | **C5** | **C5A** | **C6** |
| [![\[CM\] \[BDCB\] \[E1\] \[C1\] Overview of Case Study](https://no-cache.hubspot.com/cta/default/3893111/c6dfd532-71c7-42be-a2d2-57ee143d6a90.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c6dfd532-71c7-42be-a2d2-57ee143d6a90) | [![\[CM\] \[BDCB\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/8901e543-d6be-4099-b44c-38a231ad93c9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8901e543-d6be-4099-b44c-38a231ad93c9) | [![\[CM\] \[BDCB\] \[E1\] \[C3\] Establishing CM Goals](https://no-cache.hubspot.com/cta/default/3893111/0c84af12-bdfb-4390-aaa3-982304dd50e5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0c84af12-bdfb-4390-aaa3-982304dd50e5) | [![\[CM\] \[BDCB\] \[E1\] \[C4\] CM Vs BCM](https://no-cache.hubspot.com/cta/default/3893111/2f5b3e5c-a85c-4d21-be23-0d1bb9002cdb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2f5b3e5c-a85c-4d21-be23-0d1bb9002cdb) | [![\[CM\] \[BDCB\] \[E1\] \[C5\] Identifying the Types of Crisis Scenarios](https://no-cache.hubspot.com/cta/default/3893111/20721361-3ba5-4e4f-8b95-393ae1f11cec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/20721361-3ba5-4e4f-8b95-393ae1f11cec) | [![\[CM\] \[BDCB\] \[E1\] \[C5A\] Technological Crisis Scenarios](https://no-cache.hubspot.com/cta/default/3893111/3889a50b-7ef7-4fc9-abba-b240819bbca9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3889a50b-7ef7-4fc9-abba-b240819bbca9) | [![\[CM\] \[BDCB\] \[E1\] \[C6\] Assessing Risks and Threats](https://no-cache.hubspot.com/cta/default/3893111/29a8e079-9de4-4c23-8bae-327e1b68a4a0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/29a8e079-9de4-4c23-8bae-327e1b68a4a0) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12** | **C13** |
| [![\[CM\] \[BDCB\] \[E1\] \[C7\] Composing the CM Team](https://no-cache.hubspot.com/cta/default/3893111/b582100d-8c8c-45a2-9e80-664d3960913f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b582100d-8c8c-45a2-9e80-664d3960913f) | [![\[CM\] \[BDCB\] \[E1\] \[C8\] Implementing the CM Planning Methodology](https://no-cache.hubspot.com/cta/default/3893111/7a2fd2b6-08ab-450c-93f1-85aaa8bfddd3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7a2fd2b6-08ab-450c-93f1-85aaa8bfddd3) | [![\[CM\] \[BDCB\] \[E1\] \[C9\] Pre-Crisis - Risk Identification and Crisis Preparedness](https://no-cache.hubspot.com/cta/default/3893111/6ebafa39-8b98-4f27-946f-5c04561346f3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6ebafa39-8b98-4f27-946f-5c04561346f3) | [![\[CM\] \[BDCB\] \[E1\] \[C10\] During Crisis - Crisis Response and Decision-Making](https://no-cache.hubspot.com/cta/default/3893111/a0d99bef-6420-47d2-b185-cafad05f89d8.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a0d99bef-6420-47d2-b185-cafad05f89d8) | [![\[CM\] \[BDCB\] \[E1\] \[C11\] Post Crisis - Crisis Recovery](https://no-cache.hubspot.com/cta/default/3893111/6f4529d8-d55d-4b83-b788-694b197407d4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6f4529d8-d55d-4b83-b788-694b197407d4) | [![\[CM\] \[BDCB\] E1\] \[C12\] Summary and Strategic Outlook](https://no-cache.hubspot.com/cta/default/3893111/24bcf380-f7b1-48d0-b5cb-b2bd308adafb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24bcf380-f7b1-48d0-b5cb-b2bd308adafb) | [![\[CM\] \[BDCB\] \[E1\] \[C13\] \[Back Cover\] CM eBook 1](https://no-cache.hubspot.com/cta/default/3893111/03a018f8-e311-43d0-b4af-41449a9756bf.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/03a018f8-e311-43d0-b4af-41449a9756bf) |
| | | | | | | |
#### More Information About Crisis Management Blended/ Hybrid Learning Courses
To learn more about the course and schedule, click the buttons below for the CM-300 Crisis Management Implementer \[CM-3\] and the CM-5000 Crisis Management Expert Implementer \[CM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5ffecd2d-8000-4805-b5e3-e9ead2e259cc) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c3546220-6c76-4a10-8c76-4040b94e09e5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/03294547-1df3-435c-9243-971c3d9bb6ce) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b29594fe-d44a-4ff8-8160-03f7ce454385) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/dd120e7f-9fe2-49ed-ad24-489b81c06739) | [![\[BL-CM\] \[5\] Register](https://no-cache.hubspot.com/cta/default/3893111/82024308-16f4-4491-98be-818a882c6286.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/82024308-16f4-4491-98be-818a882c6286) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c8aaf76b-4c0b-402a-ad12-c8aff24eb911) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/30bcbbbf-c8ea-48d8-8643-da2638f3f0f8) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/83d00c12-c51c-4476-9902-69f9b7667a91) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/672d2949-6233-4b26-ad42-ae0dd0a1a3ac) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3ca6f50d-a3c5-41b8-8da2-26feb8a7613e) |
### Your Comments Here:
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/en/ebook-cm/author/moh-heng-goh"
},
"dateModified" : "2026-10-08T09:05:49.807Z",
"datePublished" : "2026-10-08T08:55:33.000Z",
"headline" : "[CM] [BDCB] [E1] [C9] Pre-Crisis - Risk Identification and Crisis Preparedness",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/en/ebook-cm/cm-bdcb-e1-c9-pre-crisis-risk-identification-and-crisis-preparedness",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```