[OR] [P1-S5] [R] Key Governance Requirements and Expectations

Key Governance Requirements and Expectations

Introduction

Operational resilience has become a cornerstone of regulatory expectations for financial institutions worldwide. In light of increasing systemic disruptions—ranging from cyber threats to geopolitical instability.

Regulators such as the Bank for International Settlements (BIS) through the BASEL Committee, and central banks including Bank Negara Malaysia (BNM), Monetary Authority of Singapore (MAS), and the Bank of England, have heightened their focus on how banks govern their ability to withstand, adapt to, and recover from operational disruptions.

A critical area of scrutiny is governance, which determines how resilience is integrated into the bank’s leadership structures, decision-making processes, and risk oversight mechanisms.

This prompt explores the regulatory requirements and best practices in the governance domain, with a focus on how Board oversight, senior management accountability, and risk committee involvement are expected to function to ensure sustained resilience across critical operations and services.

When a bank reports on its operational resilience implementation, particularly to comply with BASEL operational resilience principles and central bank regulatory frameworks (such as those from the Bank of England, MAS, BNM, etc.), governance is a foundational pillar.

This is a breakdown of key governance requirements and expectations, especially in the areas of Board oversight, senior management accountability, and risk committee involvement:

Governance Requirements for Operational Resilience

Governance underpins all aspects of operational resilience. Regulators expect a clear governance framework that ensures operational resilience is integrated into the bank’s overall risk management and strategic planning.

Core Expectations

• Clearly defined roles and responsibilities across the three lines of defence.

• Integration of resilience with enterprise risk management (ERM) and business strategy.

• Regular reporting to the Board and senior executives on resilience posture and key vulnerabilities.

• Governance structures that enable timely decision-making during disruptions.

Board Oversight

Regulatory Expectations

• The Board of Directors must have ultimate accountability for operational resilience.

• The Board must set the tone from the top by endorsing the bank's resilience strategy, tolerance levels (impact tolerances), and priorities.

• Approve and review:

  • Impact tolerance statements.

  • Critical business services (CBS) identified.

  • Major disruptions and recovery outcomes.

• Ensure adequate resources (financial, technological, and human) are allocated to support resilience efforts.

Focus Areas for the Board

• Strategic alignment: Ensuring that operational resilience aligns with the bank’s overall business strategy and risk appetite.

• Monitoring: Review resilience metrics, self-assessments, and scenario test results to ensure ongoing evaluation.

• Accountability: Hold senior management accountable for resilience implementation.

Senior Management Accountability

Responsibilities

• Day-to-day responsibility for implementing the operational resilience framework.

• Translate Board-approved policies into actionable plans and operational execution.

• Own the impact tolerance setting process and ensure business services remain within these tolerances during disruption scenarios.

• Oversee the development of:

  • Business impact analyses (BIAs),

  • Mapping of dependencies,

  • Testing scenarios and remediation.

Regulatory Focus

• Ensure cross-functional coordination (Ops, IT, Risk, Compliance).

• Deliver comprehensive reporting to the Board and relevant committees.

• Embed operational resilience into existing risk and control frameworks.

Role of the Risk Committees (Board-Level or Senior Executive Committees)

Key Roles

• Review resilience risks and their interconnection with broader operational and enterprise risks.

• Challenge assumptions around resilience capabilities and dependencies.

• Oversee the effectiveness of scenario testing and lessons learned processes.

• Provide risk-based assurance to the Board regarding the adequacy of operational resilience arrangements.

Expectations

• Maintain oversight of critical third-party and technology risks, which often underpin critical business services (CBS).

• Regularly review the bank’s ability to remain within its impact tolerances.

Table 1-1: Regulatory Frameworks Referenced

Table 1-2: Summary of Best Practices

Summing Up ...

In conclusion, effective governance is not just a regulatory checkbox but the foundation upon which operational resilience is built and maintained.

Regulators expect banks to demonstrate a clear chain of accountability, active Board and committee engagement, and strategic alignment of resilience objectives with business priorities.

The Board of Directors must lead from the top by endorsing resilience strategies and overseeing performance against impact tolerances.

At the same time, senior management must operationalise those directives through structured implementation and oversight.

Equally important is the role of risk committees in challenging assumptions, monitoring resilience risks, and ensuring continuous improvement.

By aligning governance practices with regulatory expectations under BASEL and national frameworks, banks can not only remain compliant but also better safeguard their operations, customers, and reputation during times of disruption.

More Information About Blended Learning OR-5000 [BL-OR-5] or OR-300 [BL-OR-3]