[Implement Phase]
What is the Mapping of Processes and Resources?
Mapping is identifying, documenting, and understanding the "Processes", which are the activities that deliver critical business services.
An organisation should identify, document, and map the following "Resources" that are required to deliver each critical business service (CBS):
- people
- processes
- information
- technology
- third-party service providers
- facilities
This exercise should be undertaken collaboratively across the business to ensure comprehensive mapping. A sample of the detailed mapping is appended below. Each CBS has been mapped to its supporting resources.
[Sample] Mapping of Dependencies for Retail Banking
Dependency Category |
Details |
People |
|
Processes |
|
Technology |
|
Third-Party Vendors |
|
Facilities |
|
Why Do We Map Processes and Resources?
Organisations must capture the key resources and dependencies that contribute to providing each critical business service to understand the possible threats to operational resilience.
Mapping incorporates identifying interdependencies and interconnections, including people, processes, information, technology, facilities, and third-party service providers.

The mapping process enables an organisation to have sufficient details to:
- test against the scenario
- test vulnerabilities
- test remediation
When mapping the "Processes," the relationship with key resources should be considered:
- people
- processes
- technology
- third-party vendor
- facilities
- information
[Sample] Table on Mapping of Processes and Resources
Sub-CBS Code |
Sub-CBS |
People |
Processes |
Technology (Apps & Infra) |
Third-Party Vendors |
1.1 |
Customer Account Management |
Branch staff, Account officers, Customer service agents |
KYC, Account opening/closure, Data validation |
Core banking system, Document Management System (DMS), CRM |
National Registration Department (NRD), eKYC provider |
Explanatory Notes for Table
The objective of the above table is to present a comprehensive dependency mapping for the sub-critical business services (Sub-CBS) under the main CBS.
Each Sub-CBS is mapped against four key dependency types—People, Process, Technology, and Third Party—with detailed descriptions of what or who is involved and how these elements interconnect or interact with the overall working of the CBF.
By establishing clear visibility into these dependencies, the organisation can effectively identify single points of failure, prioritise mitigation strategies, and strengthen its overall OR framework.
How to Map OR Dependencies and Connections Across the Organisation?
Mapping operational resilience dependencies and connections is essential for understanding the interdependencies between business units, systems, processes, and external stakeholders. The following actions are involved:
Identify Key Stakeholders
- Engage with business unit leaders, IT managers, risk management teams, and other relevant stakeholders to identify and involve the key departments and individuals responsible for critical business functions.
Conduct Dependency Analysis
- Analyse the dependencies between business units, systems, applications, processes, and external entities (suppliers, partners, regulatory bodies).
- This analysis helps identify the critical links and potential vulnerabilities.
Identify Internal Interdependencies among different Systems, Processes, and Functions.
- Analyse how one area's failures or disruptions can impact others.
- Consider dependencies on IT infrastructure, data centres, communication networks, and personnel.
- Document these interdependencies to gain a comprehensive understanding of internal dependencies.
Identify External Interdependencies
- Assess the external interdependencies with third-party vendors, service providers, and other external entities.
- Identify critical relationships and dependencies that the institution relies on to deliver its services.
- Includes outsourced processes, cloud service providers, regulatory reporting systems, and other external dependencies.
- Evaluate the potential impact of disruptions in these relationships on the institution's operations.
Document Interconnectivity and Interdependencies
- Create a comprehensive inventory that documents the identified dependencies and connections.
- Include information such as criticality, dependencies, contact persons, and relevant documentation.
- Document the identified interconnectivity and interdependencies in a structured manner.
- Develop visual representations such as diagrams or flowcharts to illustrate the relationships and dependencies.
- Includes information on the relationship's nature, data flows, communication channels, and any contractual or legal obligations.
- Serve as a reference documentation for future analysis and planning.
[Sample] Table on Mapping of Dependencies and Connectivities
Sub-CBS |
Sub-CBS Code |
Dependency Type |
Dependency Detail (What/ Who is involved) |
Connectivity (How it connects/ interacts) |
Customer Account Management |
1.1 |
People |
Customer Service Officers, Branch Managers |
Interact with customers to open, close, or manage accounts, and feed data to the CRM and Core Banking systems. |
Process |
KYC, AML Checks, Account Maintenance Workflow |
Integrated into core banking processes and compliance systems |
||
Technology |
Core Banking System (e.g., Silverlake), CRM, Customer Database |
The core engine manages the account lifecycle, synchronising across teller, mobile, and branch services. |
||
Third Party |
Credit Bureau, Document Verification Vendors |
Third-party KYC/AML checks; integrated via secure APIs |
Establish Communication Channels
- Establish effective communication channels to facilitate ongoing collaboration and information sharing among stakeholders.
- Ensure a common understanding of dependencies and enable efficient coordination during disruptions.
Review and Update Regularly
- Review and update the dependency mapping continuously to reflect changes in the organisational structure, processes, or external relationships.
- Ensure the accuracy and relevance of the mapping information.
"Implement" Phase of the OR Planning Methodology
Identify Important Business Services | Map Processes and Resources |
Set Impact Tolerance |
Conduct Scenario Testing | Improve Lesson Learnt | |
![]() |
![]() |
![]() |
![]() |
More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
|
![]() |
![]() |