[OR] [OCBC] [E3] [Report] [P1] [S2] [C4] Analysing Gap

Implementing Operational Resilience Planning Methodology

Operational Resilience Management Report

"Plan" Phase – Stage 2: Analyse Gap

Completion Report

Executive Summary

This report outlines the key findings and progress from the Analyse Gap stage under the Plan phase of OCBC Bank’s Operational Resilience Planning Methodology.

This stage aims to assess current capabilities against regulatory expectations, internal policies, and industry best practices to identify gaps and prioritise actions required to achieve target resilience outcomes.

Objectives of the Analyse Gap Stage

Evaluate existing operational resilience capabilities against the defined target state.
Identify discrepancies between the current state and regulatory standards (e.g. MAS Notices, D-SIB expectations).
Assess maturity across critical business services, dependencies, risk tolerances, and response capabilities.
Develop a prioritised gap remediation plan.

Scope of Gap Analysis

Critical Business Services (CBS): Twelve critical business services, including Payments, Trade Finance, Digital Banking, Wealth Management, and Corporate Treasury, were reviewed.
Dependencies Mapping: Analysis included 126 internal and third-party dependencies across applications, data, facilities, and human resources.
Impact Tolerances: Assessment focused on whether tolerances are defined, tested, and communicated effectively.
Crisis Management & Response Plans: Evaluation of alignment with resilience objectives.
Governance & Oversight: Reviewed governance structures, roles, and accountability mechanisms.

Key Gaps Identified

Area	Gap Identified	Impact	Priority
Impact Tolerance Setting	Incomplete definition for 5 of 12 CBS	Inability to assess risk posture accurately	High
Mapping of Dependencies	Lack of updated mapping for third-party dependencies	Limits understanding of operational interdependencies	High
Testing and Exercising	Fragmented scenario testing for resilience (focused on DR/BC only)	Insufficient validation of end-to-end recovery	Medium
Governance	Limited integration of resilience oversight with 1st line of defence	Inconsistent accountability	Medium
Metrics and Reporting	Absence of resilience-specific KPIs and KRIs	Inability to track progress effectively	Medium

Remediation Roadmap (Summary)

Initiative	Description	Owner	Timeline
Impact Tolerance Definition Framework	Develop and roll out standard templates and thresholds	Risk Management	Q2 2025
Third-Party Mapping Exercise	Conduct a comprehensive review of third-party dependencies	Procurement + Ops	Q2–Q3 2025
Resilience Testing Program	Design end-to-end resilience testing beyond DR/BCP	BCM Office	Q3 2025
Governance Review	Revise the operating model to clarify roles and responsibilities	OR Steering Committee	Q2 2025
Resilience Dashboard	Develop metrics and a reporting framework for management	ORM + IT	Q3 2025

Recommendations

Endorsement of the Gap Remediation Roadmap to proceed to the next stage.
Allocation of necessary resources to support gap closure activities.
Ongoing monitoring and governance oversight by the Operational Resilience Committee.

Next Steps

Initiate the Design and Prioritise Solutions stage of the Plan phase.
Establish working groups for identified high-priority remediation items.
Schedule a follow-up management review in Q2 2025.

Prepared by:

Operational Risk & Resilience Office
OCBC Bank

	"Plan" Phase of the Operational Resilience Planning Methodology
	Management Report for Completion of Phase and Stage

OR Planning Methodology Phases		Plan	Implement	Sustain

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.