[OR] [MB] [E4] [CBS] [1] [ST] Perform Scenario Testing

Perform Scenario Testing

Perform Scenario Testing for

CBS-1: Retail and SME Loans

In today's dynamic financial landscape, financial institutions like Maybank must not only deliver seamless services but also demonstrate the capacity to withstand unexpected disruptions.

This chapter explores the application of scenario testing for Maybank’s Critical Business Service (CBS-1): Retail and SME Loans, detailing how each sub-process is assessed against severe but plausible events.

Scenario testing, a core component of operational resilience, goes beyond theoretical planning by challenging assumptions through practical, stress-inducing simulations.

These exercises aim to verify whether Maybank can continue to deliver its critical services within established impact tolerances, even when facing multidimensional crises.

Purpose of Chapter

The purpose of this chapter is to guide readers through the practical implementation of scenario testing by highlighting specific tests for each sub-CBS process—from loan origination to compliance reporting and system infrastructure.

Readers will gain insights into how cyber and ICT risks are embedded into scenario planning, ensuring alignment with regulatory expectations and digital-age threats.

The table provided consolidates test scenarios, cyber/ICT risk integration, and proactive resilience measures—enabling risk and resilience professionals to understand how robust, end-to-end preparedness can be operationalised within a critical loan servicing function.

By the end of this chapter, the reader is expected to appreciate how structured scenario testing supports ongoing resilience enhancement and regulatory compliance.

Below is the Scenario Testing Table for CBS-1: Retail and SME Loans for Maybank, incorporating each Sub-CBS process, relevant scenario examples, cyber/ICT risk integration, and proactive risk management evidence.

The purpose is to simulate severe but plausible disruptions to test the firm's ability to remain within impact tolerances.

Perform Scenario Testing Table for CBS-1: Retail and SME Loans

Sub-CBS Code	Sub-CBS	Recommended Scenario Testing	Integration of Cyber and ICT Risks	Proactive Risk Management Action (Evidence)
1.1	Loan Product Origination and Marketing	Disruption in product launch due to regulatory changes or miscommunication between product and marketing teams.	Simulate a phishing attack targeting marketing systems to leak product strategy.	Review of go-to-market processes, conduct regular red-team cyber drills, and align marketing with regulatory reviews.
1.2	Customer Onboarding and Application Processing	System outage during peak onboarding period (e.g. festive promotions) leading to incomplete applications and high dropout.	DDoS attack or malicious API disruption on digital onboarding portals.	Strengthen onboarding app resilience, implement failover systems, and simulate customer comms under disruption.
1.3	Credit Assessment and Underwriting	High default rates due to mis-assessed risk from third-party data error or AI model malfunction.	Cyber tampering of underwriting models or data inputs (data poisoning).	Audit AI/ML model inputs and decisions, validate external data sources, and monitor for anomalies.
1.4	Loan Disbursement and Documentation	Core banking system delay is causing stalled disbursements during critical payout windows.	Malware attack affecting document verification or payment gateway integration.	DRP for the disbursement system, manual override protocol, and continuous patching of fintech connectors.
1.5	Loan Servicing and Customer Support	Sudden spike in customer queries due to market panic or repayment policy change; support systems overwhelmed.	Ransomware is disabling the CRM and call centre interface.	Cloud-based CRM redundancy, outsourcing surge capability, and customer self-service portal enhancement.
1.6	Loan Monitoring and Early Warning	Missed early warning signs of mass SME defaults during the economic downturn due to alert system failure.	Cyberattack manipulates dashboards and alert systems, hiding key indicators.	Conduct synthetic SME stress data injection drills and EWS system vulnerability assessment.
1.7	Collections and Recovery	A surge in defaults leads to failure of recovery teams to manage their workload, as well as legal risks in handling high-profile cases.	Data leak of defaulting customers or unauthorised changes in recovery schedules.	Dual authentication for recovery access, tabletop exercises for collections under economic stress.
1.8	Compliance and Regulatory Reporting	Missed submission deadlines for regulatory reports due to a breakdown in the reporting pipeline or a new regulatory mandate.	Cyber manipulation of the reporting database or regulatory portal breach.	Regular regulatory mock audits, backup of compliance reports, and a cyber-resilience tabletop for MAS/BNM incidents.
1.9	System Support and Technology Infrastructure	Simultaneous failure of production and backup environments during a significant system upgrade.	Coordinated cyberattack on core and recovery environments (wiper malware or insider threat).	Real-time monitoring, zero-trust architecture, testing of immutable backups and isolated recovery zones.

Key Notes

Scenario Testing simulates severe but plausible disruptions in alignment with Operational Resilience Principles.
Cyber and ICT risks are integrated to reflect evolving threat landscapes and regulatory expectations (e.g. BNM, MAS).
Proactive actions reflect evidence-based operational resilience, showcasing both testing outcomes and mitigation planning.

Summing Up ...

Scenario testing is no longer a theoretical exercise but a strategic necessity for institutions like Maybank striving to ensure operational resilience.

By proactively evaluating each key process within the Retail and SME Loans service through realistic and multifaceted disruption scenarios—including cyber and ICT threats—Maybank can validate the effectiveness of its contingency measures and response strategies.

This rigorous approach not only reinforces stakeholder trust but also strengthens the organisation’s ability to remain within acceptable impact thresholds during crises, thus fulfilling both business and regulatory resilience expectations.

Operational Resilience in Action: Case Studies and Best Practices for MayBank
eBook 4: Starting Your OR Implementation
CBS-1 Retail and SME Loans
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.