Critical services
Identifying services whose disruption harms customers or markets.
Operational Resilience Framework
An operational resilience framework identifies an institution's critical services, sets how much disruption each can tolerate, and maps and tests everything those services depend on. BNM's December 2025 discussion paper sets the direction, and the Responsibility Mapping policy already makes a senior manager accountable. We help institutions build the framework: critical services, impact tolerances, dependency maps and scenario tests.
Operational Resilience Framework
What it is
A governance and risk engagement to design and implement an operational resilience framework, linked to existing business continuity, outsourcing and technology risk work.
Why organisations need it
BNM issued its Discussion Paper on Operational Resilience on 19 December 2025, with comments closing 30 April 2026. It is not yet a policy document, but Responsibility Mapping, in force since 1 January 2026, already requires a senior manager reporting to the CEO to own the operational resilience framework. Institutions need something for that person to own.
What the engagement covers
Impact tolerances
Maximum tolerable disruption for each.
Dependency mapping
People, processes, technology and third parties.
Scenario testing
Severe but plausible scenarios.
Governance
Accountable senior manager and board reporting.
Integration
Links to BCP, outsourcing and RMiT.
What the business gets out of it
Something to own
A framework for the accountable senior manager.
Ahead of the final policy
Built before it becomes mandatory.
Fewer blind spots
Dependencies made visible.
Tested
Scenarios reveal weaknesses.
Integrated
Uses existing BCP and risk work.
How it works
How the engagement runs
01
Assessment
Current practices and gaps.
02
Design
Critical services and tolerances.
03
Mapping
Dependencies for priority services.
04
Testing
Scenario exercises.
05
Governance
Reporting and review cycle.
Deliverables
What you receive
Framework document
Policy and methodology.
Critical services register
With tolerances.
Dependency maps
For priority services.
Scenario test report
Results and actions.
Board reporting template
For the accountable senior manager.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
The framework itself is at discussion paper stage: BNM issued its Discussion Paper on Operational Resilience on 19 December 2025. But Responsibility Mapping, in force since 1 January 2026, already requires a senior manager reporting to the CEO to own the operational resilience framework, so something has to exist for that person to own.
Business continuity planning restores processes after disruption. Operational resilience starts from the customer-facing services that matter most, sets impact tolerances for them, and maps every people, technology, supplier and data dependency behind them. It builds on existing continuity, outsourcing and technology risk work rather than replacing it.
Banks, insurers, takaful operators and other BNM-regulated institutions, particularly those whose senior manager now owns operational resilience under Responsibility Mapping. The approach scales with the institution's size and the number of critical services.
We design and facilitate scenario tests that check whether critical services stay within their impact tolerances. Technical recovery testing, such as failing over systems, stays with your IT teams and vendors, and its results feed into the scenario test findings.
Typically three to six months for an initial framework and the first scenario tests: identifying critical services, setting impact tolerances, mapping dependencies, and testing a small number of severe but plausible scenarios before extending the programme.