[OR] [BSP] Key Elements of Operational Resilience: A Comprehensive Approach for BSFIs

Key Elements of Operational Resilience

The Bangko Sentral ng Pilipinas (BSP) outlines critical elements for BSFIs (BSP-supervised financial institutions) to build and maintain operational resilience.

These elements ensure that BSFIs can deliver critical operations during disruptions, safeguard customer interests, and contribute to financial system stability.

Below are the seven essential components BSFIs must integrate into their operational resilience frameworks.

Set the Tone from the Top

Effective operational resilience begins with governance, where the board of directors and senior management play pivotal roles.

The board approves and oversees the operational resilience framework, ensuring the "three lines of defence" (business units, risk management, and internal audit) align with resilience principles.  Senior management leads the implementation, evaluates resilience capabilities, and communicates any required remedial actions to the board.

Determine Critical Operations, Tolerance for Disruption, and Scenarios

BSFIs must identify their critical operations and establish tolerances for disruption. Considering their unique business and risk profile, they should assess a range of severe but plausible scenarios that could impact these operations.

This process prioritises critical operations and helps BSFIs determine the resilience measures to withstand and absorb disruptions within acceptable limits.

Map Interconnections and Dependencies

Understanding the interconnections and dependencies within critical operations is essential. BSFIs should map out the chain of activities, especially those involving third-party service providers, to identify vulnerabilities.

By resolving these weak points before disruptions occur, BSFIs can bolster their resilience and stay within their disruption tolerance limits.  This mapping also helps refine scenario planning by highlighting process vulnerabilities.

Plan and Manage Risks to Critical Operations

Managing risks to critical operations requires a holistic, enterprise-wide approach.

BSFIs should leverage existing risk management frameworks—such as operational risk, business continuity, outsourcing, and IT risk management—to address vulnerabilities that threaten the continuous delivery of critical operations.  This integrated risk management ensures resilience across all facets of the organisation.

Test Ability to Deliver Critical Operations During Disruption

Regular testing is crucial to evaluate a BSFI’s ability to deliver critical operations under severe but plausible scenarios. 1 Testing exercises simulate disruptions of varying nature, duration, and intensity to identify weaknesses in the resilience framework.

 These exercises sharpen the organisation’s response capabilities and enhance operational resilience awareness among personnel. The outcomes of these tests should guide adjustments to the resilience framework.

Respond and Recover from Disruptions

When disruptions occur, BSFIs must have robust response and recovery plans. These plans must include clearly defined roles, succession of authority, and an incident response plan that outlines steps for managing the disruption.

BSFIs should maintain a catalogue of recovery actions, key personnel, and internal/external resources.  The response plan must cover the entire incident lifecycle, from classification to recovery, and should be regularly tested, reviewed, and updated.

Review, Refine, and Update the Resilience Framework

Operational resilience is an ongoing process requiring continuous review and refinement.  The resilience framework should evolve with changes in BSFI’s business model, risk appetite, or operational complexity.

Regular assessments and updates ensure the framework remains aligned with the BSFI’s goals and external developments. A dynamic framework enables BSFIs to maintain an optimal level of preparedness and resilience.

Summing Up...

These fundamental elements emphasise a structured and dynamic approach to operational resilience.  By embedding these principles into governance, risk management, and operational processes, BSFIs can effectively safeguard their critical operations, minimise disruption impacts, and strengthen their role in ensuring financial system stability.

BSP Operational Resilience Guidelines

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.