[OR] [OCBC] [E3] [Report] [P2] [S5] [C13] Improving Lessons Learned

Operational Resilience Management Report

"Implement" Phase

Stage 5: Improving Lessons Learned

Completion Report

Chapter 13

Executive Summary

This report outlines the implementation of the "Improving Lessons Learned" stage in the Operational Resilience Planning Methodology for OCBC Bank.

This stage systematically captures, evaluates, and applies lessons from previous disruption events, simulations, and incident management exercises to strengthen OCBC’s operational resilience capabilities across all critical business services.

2. Objective

To establish a structured and continuous improvement approach to learning from past experiences (real events, simulations, and near misses) and integrating those insights into policies, processes, and response plans for enhanced resilience.

3. Implementation Steps

Step 1: Establishing a Centralised Lessons Learned Repository

• Action: Develop a digital knowledge base to store insights from all incident reviews, simulations, and crisis events.

• Example: A SharePoint-based repository tagged by service type (e.g., Digital Banking, Treasury) and event type (e.g., cyber incident, third-party failure).

• Purpose: To ensure visibility and accessibility of documented learnings across departments.

Step 2: Conducting Structured Post-Incident Reviews (PIRs)

• Action: Formalise and standardise the PIR process for all disruptions and test exercises.

• Approach: Use a consistent PIR template that captures:

  • Event summary

  • Root cause analysis

  • Response effectiveness

  • Stakeholder communication gaps

  • Improvement opportunities

• Example: After a simulated Distributed Denial-of-Service (DDoS) attack on the mobile banking platform, the PIR identified delays in customer communication and gaps in cloud resource scaling.

Step 3: Assigning Ownership and Tracking Improvements

• Action: Link each lesson learned to a responsible department and establish follow-up actions with deadlines.

• Tool: Integrate with OCBC’s internal risk register and issue-tracking tools (e.g., ServiceNow or Jira).

• Example: The Technology Infrastructure team was assigned to implement an enhancement in automated traffic redirection to mitigate similar DDoS impacts in future.

Step 4: Thematic Analysis and Trend Identification

• Action: Every quarter, analyse collected lessons to identify recurring patterns or systemic weaknesses.

• Purpose: To develop strategic insights that inform risk management priorities.

• Example: Trend analysis over three quarters revealed repeated issues related to third-party vendor coordination during crises.

Step 5: Incorporating Lessons into Training and Scenario Testing

• Action: Refresh training content and update scenario testing scripts based on the identified lessons.

• Example: Enhancing the annual business continuity exercise with a cross-border scenario that includes regulatory communication requirements, prompted by a past regional service outage.

Step 6: Senior Management Reporting and Oversight

• Action: Present synthesised lessons and associated actions during quarterly risk and resilience governance meetings.

• Metrics Tracked:

  • Number of PIRs conducted

  • Percentage of lessons closed with verified improvements

  • Number of updated procedures/processes resulting from lessons

• Example: A dashboard tracking lesson closure rates is shared with the Operational Resilience Steering Committee.

4. Benefits to OCBC Bank

• Continuous Improvement: Ensures OCBC remains agile and adaptable to evolving threats.

• Culture of Learning: Promotes accountability and proactive learning across departments.

• Informed Decision-Making: Enables management to prioritise resilience investments based on real data and insights.

• Regulatory Alignment: Supports compliance with regulatory expectations from MAS on operational resilience and post-incident reviews.

5. Recommendations to Management

• Support resourcing for dedicated lessons learned analysts and platform enhancement.

• Mandate participation in PIRs for all relevant units.

• Ensure governance through periodic reviews by the Operational Resilience Committee.

Prepared by:
Operational Resilience Office
OCBC Bank

Reviewed by:
Head of Enterprise Risk Management
Chief Information Security Officer
Chief Operating Officer

OCBC Bank – Lessons Learned Improvement Log

Submission to: Monetary Authority of Singapore
Reporting Period: [Insert Period, e.g., Q1 202X]

Summary Metrics for Reporting Period

• Total Lessons Logged: 5

• Closed Lessons: 3

• In Progress: 2

• Overdue Items: 0

• % with Updated Procedures/Controls: 100%

• % Applied to Future Scenarios or Training: 60%

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.