Objective and key requirements of this PObjective and key requirements of this Prudential Standard

Objective and key requirements of this Prudential Standard

This Prudential Standard requires each regulated institution and Level 2 group to implement a whole-of-business approach to business continuity management that is appropriate to the nature and scale of its operations. Business continuity management increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation, profitability, depositors, policyholders and other stakeholders.

The ultimate responsibility for the business continuity of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).

The key requirements of this Prudential Standard are that:

• a regulated institution must identify, assess and manage potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors;

• the Board of the regulated institution must consider business continuity risks and controls as part of its overall risk management systems and approve a Business Continuity Management Policy;

• a regulated institution must develop and maintain a Business Continuity Plan that documents procedures and information which enable the regulated institution to manage business disruptions;

• a regulated institution must review the Business Continuity Plan annually and periodically arrange for its review by the internal audit function or an external expert; and

• a regulated institution must notify APRA in the event of certain disruptions.

Where a regulated institution is the Head of a Level 2 group, the group must have in place business continuity management appropriate to the nature and scale of its operations, and the provisions of this Prudential Standard must be applied appropriately throughout the group.