[CM] [OCBC] [E1] [C8] Implementing the CM Planning Methodology

Chapter 8

Implementing the Crisis Management Planning Methodology for OCBC Bank

Introduction

In today’s rapidly evolving financial landscape, OCBC Bank must be prepared for a wide range of crises that can disrupt operations, damage reputation, and affect stakeholder trust.

Crisis Management (CM) plays a crucial role in enabling the bank to respond swiftly and effectively to such incidents.

To mitigate the risks associated with potential crises, OCBC Bank must adopt a structured and comprehensive Crisis Management Planning (CMP) methodology.

This methodology, aligned with ISO 22361 standards, consists of seven critical phases:

1. CM Project Management (PM)
2. Crisis Scenario Risk Analysis and Review (CAR)
3. Business Impact Analysis (BIA)
4. CM Strategy (BCS)
5. CM Plan Development (PD)
6. CM Testing and Exercising (TE)
7. CM Program Management (PgM)

This chapter will provide an overview of each of these phases, focusing on the specific requirements for OCBC Bank and how they contribute to building resilience and ensuring business continuity during a crisis.

1. CM Project Management (PM)

The first phase of the CMP methodology focuses on establishing a clear and organised approach to managing the entire crisis management project.

For OCBC Bank, this involves setting up a dedicated Crisis Management team with well-defined roles and responsibilities, who will be accountable for executing the CM planning process.

The CM Project Manager must ensure that all stakeholders are aligned, resources are allocated effectively, and the timeline for completing the CMP methodology is adhered to.

Specific Requirement for OCBC Bank

• The project management phase should emphasise coordination with various departments such as IT, Operations, Risk Management, and Compliance to ensure all aspects of the bank’s operations are covered.
• The CM team must include members from senior leadership to ensure the authority and resources are available for decision-making.

2. Crisis Scenario Risk Analysis and Review (CAR)

In this phase, the focus shifts to identifying and analysing potential crisis scenarios that could disrupt OCBC Bank's operations.

This includes reviewing past crisis events, conducting scenario workshops, and evaluating the likelihood and impact of various crisis types—ranging from natural disasters to cyber-attacks, financial fraud, or pandemics.

Specific Requirement for OCBC Bank

• OCBC Bank should conduct a detailed analysis of specific threats unique to the financial sector, including regulatory changes, fraud risk, and cybersecurity threats.
• Collaboration with external stakeholders, such as regulators and industry partners, can provide insight into emerging threats and potential vulnerabilities.

3. Business Impact Analysis (BIA)

The BIA phase focuses on understanding the critical functions of OCBC Bank and how various crises could impact these operations.

A comprehensive BIA will help identify the bank’s essential services, key systems, and processes, and estimate the potential financial and reputational impact of different crisis scenarios.

Specific Requirement for OCBC Bank

• For OCBC, a priority should be placed on assessing the impact of crises on financial transactions, customer trust, and regulatory compliance.
• The BIA must also consider the specific needs of international operations, as well as the diverse range of services the bank offers, including wealth management and corporate banking.

4. Crisis Management Strategy (BCS)

The strategy phase involves defining the key actions and resources necessary to respond to the identified crisis scenarios.

This phase also establishes the overall approach to crisis communication, decision-making, and resource allocation.

Specific Requirement for OCBC Bank

• The strategy should be customised to OCBC’s unique structure, focusing on coordination between branches, subsidiaries, and regional offices.
• Developing a clear communication strategy with stakeholders, including customers, regulators, and the media, is crucial to ensuring transparency during a crisis.

5. Crisis Management Plan Development (PD)

In this phase, OCBC Bank will develop detailed, actionable crisis management plans for each identified crisis scenario. These plans will outline step-by-step procedures for responding to crises, including emergency response, business recovery, and communication strategies.

Specific Requirement for OCBC Bank

• Plans should be developed for both immediate response (such as IT system failures or security breaches) and longer-term recovery (such as reputational damage or prolonged market disruptions).
• Each department, including Risk, Operations, IT, and Customer Service, must have a role in the crisis response, with plans for seamless integration during activation.

6. Crisis Management Testing and Exercising (TE)

This phase focuses on validating the crisis management plans through testing and exercises. These activities help OCBC Bank assess the effectiveness of its plans, identify gaps, and ensure that staff are familiar with their roles in a crisis scenario.

Specific Requirement for OCBC Bank

• OCBC should conduct regular, scenario-based crisis simulation exercises that involve key stakeholders from across the bank’s operations.
• Testing should also include collaboration with external partners, such as third-party service providers and regulators, to assess the bank's readiness in a coordinated response.

7. Crisis Management Program Management (PgM)

The final phase ensures that the crisis management planning process is continuously maintained and improved.

This phase involves reviewing lessons learned from tests and real-life crises, as well as adjusting plans in response to changes in the bank’s operations, the external environment, and emerging risks.

Specific Requirement for OCBC Bank

• OCBC Bank must establish a system for continuous monitoring and evaluation of crisis management plans, with periodic reviews aligned with industry trends and regulatory updates.
• The program should also include training sessions for new staff and ongoing education for existing employees to ensure the crisis management capabilities remain robust.

Implementing the Crisis Management Planning methodology at OCBC Bank is not just about preparing for a crisis but about ensuring that the bank is resilient in the face of adversity.

By following the seven phases outlined in this chapter—CM Project Management, Crisis Scenario Risk Analysis, Business Impact Analysis, CM Strategy, CM Plan Development, CM Testing and Exercising, and CM Program Management—OCBC can develop a robust and adaptable crisis management framework.

This framework will not only help mitigate risks but also enhance the bank’s ability to recover quickly and maintain customer confidence during times of crisis.

Regular testing, reviews, and updates to the crisis management plans will ensure that OCBC Bank is always prepared to navigate future challenges.