[OR] [BSN] [E2] [C13] Improving Lessons Learnt

Chapter 13

  Improving Lessons Learned – Stage 4 of the Implement Phase of BSN’s Operational Resilience Planning Methodology

Introduction

The "Improving Lessons Learned" stage in the Implement phase is a critical mechanism for institutionalising operational resilience at Bank Simpanan Nasional (BSN).

This chapter explores how BSN can systematically capture, analyse, and act upon lessons from resilience exercises, disruption events, and testing activities.

It ensures that insights are not only documented but translated into actionable improvements across critical business services (CBS).

This stage focuses on developing an adaptive learning culture and a continuous improvement feedback loop that strengthens BSN's preparedness, response, and recovery capabilities.

Lessons learned feed directly into risk mitigation strategies, training programs, and updates to response playbooks, strengthening resilience at all organisational levels.

Objectives of the “Improving Lessons Learned” Stage

• Institutionalise a repeatable process for capturing lessons from real incidents, tabletop exercises, and scenario tests.
• Translate findings into actionable improvements for CBS-1 to CBS-10.
• Improve leadership decision-making and front-line response through feedback mechanisms.
• Promote a culture of continuous learning and adaptive resilience.

Implementation Steps and Examples

Step 1: Establish a Lessons Learned Framework

Action:

Develop a standardised framework and governance structure for capturing and reviewing lessons post-incident or exercise. Assign roles (e.g., Incident Lead, CBS Coordinators, Risk Team) for documentation and follow-up.

Example (CBS-4 Digital Banking):

After a major system latency issue affecting the myBSN mobile app, BSN initiates a structured after-action review. The framework ensures all stakeholders—including IT Ops, Call Centre, and Customer Service—submit impact observations within 48 hours.

Step 2: Conduct Structured After-Action Reviews (AAR)

Action:

Hold AARs within 1–2 weeks of each disruptive event, testing exercise, or simulated scenario. Use structured templates that include:

• Event description and timeline
• Impact on CBS functions
• Decisions made and their effectiveness
• Gaps in coordination or communication
• Recommendations

Example (CBS-2 Government Aid & Disbursement):

Following a nationwide cash assistance rollout delay, an AAR revealed dependency on a single payment gateway. The outcome led to onboarding a secondary provider to ensure future resilience.

Step 3: Analyse Systemic and Process Weaknesses

Action:

Assess if the issue was a one-off or part of a broader systemic challenge. Analyse root causes and recurring patterns across CBS domains using risk dashboards and incident logs.

Example (CBS-8 Core Banking System):

Frequent slowdowns during peak hours prompted a deep dive, uncovering outdated queuing configurations. This insight drove a phased system modernisation plan prioritised in the following budget cycle.

Step 4: Track and Assign Action Items

Action:

Log all corrective actions in a centralised Operational Resilience Action Tracker. Assign owners and deadlines, and align with audit and compliance monitoring.

Example (CBS-10 Regulatory Reporting & Compliance):

An exercise revealed inconsistent data timestamping across reporting modules. IT and Compliance teams are assigned an action plan to align data logging systems, with a 60-day implementation deadline.

Step 5: Update Documentation and Resilience Playbooks

Action:

Update Business Continuity Plans (BCPs), scenario response playbooks, training materials, and system protocols with insights gained.

Example (CBS-6 Agent Banking):

After identifying communication breakdowns with remote banking agents during a flood event, BSN revised its communication protocol, including SMS-based fallback systems and revised agent training kits.

Step 6: Share Knowledge and Promote Learning Culture

Action:

Conduct organisation-wide knowledge-sharing sessions and resilience briefings. Establish “Resilience Insights Newsletters” and include lessons in new hire onboarding and manager training.

Example (CBS-1 Retail Banking Services):

A cyber-attack simulation led to improved password reset procedures. Insights were shared via an internal video briefing by the CISO, followed by a compulsory quiz for front-line staff.

Step 7: Monitor for Continuous Improvement

Action:

Establish metrics and key performance indicators (KPIs) to track the effectiveness of implemented improvements over time. Revisit and reassess lessons every 6–12 months.

Example (CBS-9 Customer Complaint & Dispute Resolution):

Post-implementation tracking showed a 35% drop in unresolved customer cases after revising escalation protocols learned from prior disruptions. This reinforced the value of lessons learned in customer experience.

Benefits to Bank Simpanan Nasional

Implementing a robust "Improving Lessons Learned" stage provides BSN with the following advantages:

• Proactive Risk Mitigation: Recurrent risks are addressed before they evolve into future disruptions.
• Operational Excellence: Enhances the maturity of operational processes across CBS-1 to CBS-10.
• Cultural Resilience: Promotes a learning culture that improves decision-making at all levels.
• Regulatory Alignment: Strengthens BSN’s alignment with BNM and global regulatory resilience expectations.

Table 13-1 Lessons Learned Across CBS

Table: Improving Lessons Learned – Review Summary for CBS-1 to CBS-10

Summing Up ...

The "Improving Lessons Learned" stage is not merely a post-mortem activity—it is a proactive, forward-looking discipline that ensures BSN grows stronger with every disruption faced or simulated.

By embedding a structured and accountable approach to capturing and applying insights, BSN ensures that operational risks are continuously mitigated and response frameworks remain relevant and robust.

For a diversified banking institution like BSN—spanning digital services, rural banking agents, government disbursements, and regulatory reporting—the stakes are high. Each CBS requires tailored insights to evolve based on real-world learning.

When fully embraced, this learning loop strengthens institutional memory, enhances crisis leadership, and propels the organisation toward operational excellence.

As the financial services industry advances into an era defined by volatility and digital interconnectivity, BSN’s resilience will depend not only on its systems and processes but on its capacity to learn, adapt, and respond.

Through this chapter, BSN sets a benchmark in operational maturity, transforming lessons into long-term value.

	Operational Resilience for Financial Services: The BSN Malaysia Approach
	"Implement" Phase of the Operational Resilience Planning Methodology

OR Planning Methodology Phases		Plan	Implement	Sustain

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About Blended Learning OR-5000 [BL-OR-5] or OR-300 [BL-OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.