View image in the official source

Prudential Standard CPS 232

Business Continuity Management

Objective and key requirements of this Prudential Standard

This Prudential Standard requires each regulated institution and Level 2 group to implement a whole-of-business approach to business continuity management that is appropriate to the nature and scale of its operations. Business continuity management increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation, profitability, depositors, policyholders and other stakeholders.

The ultimate responsibility for the business continuity of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).

The key requirements of this Prudential Standard are that:

• a regulated institution must identify, assess and manage potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors;

• the Board of the regulated institution must consider business continuity risks and controls as part of its overall risk management systems and approve a Business Continuity Management Policy;

• a regulated institution must develop and maintain a Business Continuity Plan that documents procedures and information which enable the regulated institution to manage business disruptions;

• a regulated institution must review the Business Continuity Plan annually and periodically arrange for its review by the internal audit function or an external expert; and

• a regulated institution must notify APRA in the event of certain disruptions.

Where a regulated institution is the Head of a Level 2 group, the group must have in place business continuity management appropriate to the nature and scale of its operations, and the provisions of this Prudential Standard must be applied appropriately throughout the group.

Authority

1. This Prudential Standard is made under:

(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);

(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and

(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).

Application

2. This Prudential Standard applies to:

(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;

(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and

(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.

These institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.

3. A requirement imposed upon a regulated institution that is also Head of a Level 2 group[1] is to be read as requiring that regulated institution to ensure that the applicable provision is applied appropriately throughout the Level 2 group.[2]

4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.

5. This Prudential Standard applies whether or not activities are outsourced to related bodies corporate or third-party service providers. This Prudential Standard also applies to arrangements where the service provider is located outside Australia or the functions are performed outside Australia.

6. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[3], provided that the policy has been approved by the Board[4] of the regulated institution and meets the requirements of this Prudential Standard.

7. This Prudential Standard commences on 1 January 2015.

Interpretation

8. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.

9. A ‘Level 2 group’ is:

(a) the consolidation of entities defined as Level 2 in APS 001; or

(b) a Level 2 insurance group as defined in GPS 001.

10. The ‘Head of a Level 2 group’ is:

(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;

(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or

(c) the parent entity of a Level 2 insurance group as defined in GPS 001.

The role of the Board and senior management

11. A regulated institution must identify, assess, manage, mitigate and report on potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors.

12. The Board is ultimately responsible for the business continuity of the regulated institution. The Board remains responsible for business continuity management (BCM) whether or not business operations are outsourced or are part of a corporate group.[5]

13. The Board may delegate day–to-day operational responsibility for BCM to a responsible committee, including a responsible committee of the Head of the Level 2 group, and/or senior management. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.

14. The Board must approve the regulated institution’s Business Continuity Management Policy (BCM Policy) (refer to paragraphs 20 and 21).

15. The Board must ensure that the regulated institution’s business continuity risks and controls are taken into account as part of its overall risk management strategy and when completing a risk management declaration required to be provided to APRA.[6]

Business continuity management

16. BCM is a whole-of-business approach that includes policies, standards and procedures for ensuring that critical business operations can be maintained or recovered in a timely fashion, in the event of a disruption. Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.

17. Critical business operations are the business functions, resources and infrastructure that may, if disrupted, have a material impact on the regulated institution’s business functions, reputation, profitability, depositors and/or policyholders.

18. A regulated institution’s BCM must, at a minimum, include:

(a) a BCM Policy in accordance with paragraphs 20 and 21;

(b) a business impact analysis (BIA) including risk assessment in accordance with paragraphs 22 and 23;

(c) recovery objectives and strategies; in accordance with paragraphs 24 and 25;

(d) a business continuity plan (BCP) including crisis management and recovery in accordance with paragraphs 26 to 28; and

(e) programs for:

(i) review and testing of the BCP in accordance with paragraph 29; and

(ii) training and ensuring awareness of staff in relation to BCM.

19. In addition to the requirements stated elsewhere in this Prudential Standard, the Board of the Head of a Level 2 group must:

(a) ensure that the Level 2 group’s BCM is appropriate to the nature and scale of its operations and is consistent with the Level 2 group’s risk management strategy or framework;

(b) consistently apply BCM for each part of the Level 2 group;

(c) apply BCM to risk assessments and risk processes at a functional level in the Level 2 group, where appropriate; and

(d) ensure that the Level 2 group’s BCP is reviewed at least annually by responsible senior management of the Head of the Level 2 group.

BCM Policy

20. A regulated institution must have an up-to-date documented BCM Policy that sets out its objectives and approach in relation to BCM.

21. The BCM Policy must clearly state the roles, responsibilities and authorities to act in relation to the BCM Policy.

Business impact analysis

22. A BIA involves identifying all critical business functions, resources and infrastructure of the regulated institution and assessing the impact of a disruption on these.

23. When conducting the BIA, the regulated institution must consider:

(a) plausible disruption scenarios over varying periods of time;

(b) the period of time for which the regulated institution could not operate without each of its critical business operations;

(c) the extent to which a disruption to the critical business operations might have a material impact on the interests of depositors and/or policyholders of the regulated institution; and

(d) the financial, legal, regulatory and reputational impact of a disruption to a regulated institution’s critical business operations over varying periods of time.

Recovery objectives and strategies

24. Recovery objectives are pre-defined goals for recovering critical business operations to a specified level of service (recovery level) within a defined period (recovery time) following a disruption.

25. A regulated institution must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size and complexity of the regulated institution.

Business continuity planning

26. A regulated institution must maintain at all times a documented BCP that meets the objectives of the BCM Policy.[7]

27. The BCP must document procedures and information that enable the regulated institution to:

(a) manage an initial business disruption (crisis management); and

(b) recover critical business operations.

28. The BCP must reflect the specific requirements of the regulated institution and must identify:

(a) critical business operations;

(b) recovery levels and time targets for each critical business operation;

(c) recovery strategies for each critical business operation;

(d) infrastructure and resources required to implement the BCP;

(e) roles, responsibilities and authorities to act in relation to the BCP; and

(f) communication plans with staff and external stakeholders.

Review and testing of the BCP

29. A regulated institution must review and test its BCP at least annually, or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives. The results of the testing must be formally reported to the Board or to delegated management.[8]

30. The BCP must be updated if shortcomings are identified as a result of the review and testing required under paragraph 29.

Notification requirements

31. A regulated institution must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to have a material impact on the regulated institution’s risk profile, or affect its financial soundness. The regulated institution must explain to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The regulated institution must notify APRA when normal operations resume.

32. The information or notifications required by this Prudential Standard must be given in such form, if any, and by such procedures, if any, as APRA determines and publishes on its website from time to time.

Audit arrangements

33. A regulated institution’s internal audit function, or an external expert, must periodically review the BCP and provide an assurance to the Board or to delegated management that:

(a) the BCP is in accordance with the regulated institution’s BCM Policy and addresses the risks it is designed to control; and

(b) testing procedures are adequate and have been conducted satisfactorily.

34. APRA may request the external auditor of the regulated institution, or another appropriate external expert, to provide an assessment of the regulated institution’s BCM arrangements. Any such report must be paid for by the regulated institution and must be made available to APRA.[9]

Adjustments and exclusions

35. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[10]

Determinations made under previous prudential standards

36. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.

For the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:

(a) Prudential Standard APS 232 Business Continuity Management (including Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(b) Prudential Standard GPS 222 Business Continuity Management (including Guidance Note GGN 222.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(c) Prudential Standard LPS 232 Business Continuity Management made on 23 March 2007;

(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to business continuity management;

(e) Prudential Standard CPS 232 Business Continuity Management made on 9 September 2011; and

(f) Prudential Standard CPS 232 Business Continuity Management made on 30 November 2012.

Business Continuity Management

Objective and key requirements of this Prudential Standard

This Prudential Standard requires each regulated institution and Level 2 group to implement a whole-of-business approach to business continuity management that is appropriate to the nature and scale of its operations. Business continuity management increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation, profitability, depositors, policyholders and other stakeholders.

The ultimate responsibility for the business continuity of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).

The key requirements of this Prudential Standard are that:

• a regulated institution must identify, assess and manage potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors;

• the Board of the regulated institution must consider business continuity risks and controls as part of its overall risk management systems and approve a Business Continuity Management Policy;

• a regulated institution must develop and maintain a Business Continuity Plan that documents procedures and information which enable the regulated institution to manage business disruptions;

• a regulated institution must review the Business Continuity Plan annually and periodically arrange for its review by the internal audit function or an external expert; and

• a regulated institution must notify APRA in the event of certain disruptions.

Where a regulated institution is the Head of a Level 2 group, the group must have in place business continuity management appropriate to the nature and scale of its operations, and the provisions of this Prudential Standard must be applied appropriately throughout the group.

Authority

1. This Prudential Standard is made under:

(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);

(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and

(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).

Application

2. This Prudential Standard applies to:

(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;

(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and

(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.

These institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.

3. A requirement imposed upon a regulated institution that is also Head of a Level 2 group[1] is to be read as requiring that regulated institution to ensure that the applicable provision is applied appropriately throughout the Level 2 group.[2]

4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.

5. This Prudential Standard applies whether or not activities are outsourced to related bodies corporate or third-party service providers. This Prudential Standard also applies to arrangements where the service provider is located outside Australia or the functions are performed outside Australia.

6. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[3], provided that the policy has been approved by the Board[4] of the regulated institution and meets the requirements of this Prudential Standard.

7. This Prudential Standard commences on 1 January 2015.

Interpretation

8. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.

9. A ‘Level 2 group’ is:

(a) the consolidation of entities defined as Level 2 in APS 001; or

(b) a Level 2 insurance group as defined in GPS 001.

10. The ‘Head of a Level 2 group’ is:

(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;

(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or

(c) the parent entity of a Level 2 insurance group as defined in GPS 001.

The role of the Board and senior management

11. A regulated institution must identify, assess, manage, mitigate and report on potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors.

12. The Board is ultimately responsible for the business continuity of the regulated institution. The Board remains responsible for business continuity management (BCM) whether or not business operations are outsourced or are part of a corporate group.[5]

13. The Board may delegate day–to-day operational responsibility for BCM to a responsible committee, including a responsible committee of the Head of the Level 2 group, and/or senior management. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.

14. The Board must approve the regulated institution’s Business Continuity Management Policy (BCM Policy) (refer to paragraphs 20 and 21).

15. The Board must ensure that the regulated institution’s business continuity risks and controls are taken into account as part of its overall risk management strategy and when completing a risk management declaration required to be provided to APRA.[6]

Business continuity management

16. BCM is a whole-of-business approach that includes policies, standards and procedures for ensuring that critical business operations can be maintained or recovered in a timely fashion, in the event of a disruption. Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.

17. Critical business operations are the business functions, resources and infrastructure that may, if disrupted, have a material impact on the regulated institution’s business functions, reputation, profitability, depositors and/or policyholders.

18. A regulated institution’s BCM must, at a minimum, include:

(a) a BCM Policy in accordance with paragraphs 20 and 21;

(b) a business impact analysis (BIA) including risk assessment in accordance with paragraphs 22 and 23;

(c) recovery objectives and strategies; in accordance with paragraphs 24 and 25;

(d) a business continuity plan (BCP) including crisis management and recovery in accordance with paragraphs 26 to 28; and

(e) programs for:

(i) review and testing of the BCP in accordance with paragraph 29; and

(ii) training and ensuring awareness of staff in relation to BCM.

19. In addition to the requirements stated elsewhere in this Prudential Standard, the Board of the Head of a Level 2 group must:

(a) ensure that the Level 2 group’s BCM is appropriate to the nature and scale of its operations and is consistent with the Level 2 group’s risk management strategy or framework;

(b) consistently apply BCM for each part of the Level 2 group;

(c) apply BCM to risk assessments and risk processes at a functional level in the Level 2 group, where appropriate; and

(d) ensure that the Level 2 group’s BCP is reviewed at least annually by responsible senior management of the Head of the Level 2 group.

BCM Policy

20. A regulated institution must have an up-to-date documented BCM Policy that sets out its objectives and approach in relation to BCM.

21. The BCM Policy must clearly state the roles, responsibilities and authorities to act in relation to the BCM Policy.

Business impact analysis

22. A BIA involves identifying all critical business functions, resources and infrastructure of the regulated institution and assessing the impact of a disruption on these.

23. When conducting the BIA, the regulated institution must consider:

(a) plausible disruption scenarios over varying periods of time;

(b) the period of time for which the regulated institution could not operate without each of its critical business operations;

(c) the extent to which a disruption to the critical business operations might have a material impact on the interests of depositors and/or policyholders of the regulated institution; and

(d) the financial, legal, regulatory and reputational impact of a disruption to a regulated institution’s critical business operations over varying periods of time.

Recovery objectives and strategies

24. Recovery objectives are pre-defined goals for recovering critical business operations to a specified level of service (recovery level) within a defined period (recovery time) following a disruption.

25. A regulated institution must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size and complexity of the regulated institution.

Business continuity planning

26. A regulated institution must maintain at all times a documented BCP that meets the objectives of the BCM Policy.[7]

27. The BCP must document procedures and information that enable the regulated institution to:

(a) manage an initial business disruption (crisis management); and

(b) recover critical business operations.

28. The BCP must reflect the specific requirements of the regulated institution and must identify:

(a) critical business operations;

(b) recovery levels and time targets for each critical business operation;

(c) recovery strategies for each critical business operation;

(d) infrastructure and resources required to implement the BCP;

(e) roles, responsibilities and authorities to act in relation to the BCP; and

(f) communication plans with staff and external stakeholders.

Review and testing of the BCP

29. A regulated institution must review and test its BCP at least annually, or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives. The results of the testing must be formally reported to the Board or to delegated management.[8]

30. The BCP must be updated if shortcomings are identified as a result of the review and testing required under paragraph 29.

Notification requirements

31. A regulated institution must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to have a material impact on the regulated institution’s risk profile, or affect its financial soundness. The regulated institution must explain to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The regulated institution must notify APRA when normal operations resume.

32. The information or notifications required by this Prudential Standard must be given in such form, if any, and by such procedures, if any, as APRA determines and publishes on its website from time to time.

Audit arrangements

33. A regulated institution’s internal audit function, or an external expert, must periodically review the BCP and provide an assurance to the Board or to delegated management that:

(a) the BCP is in accordance with the regulated institution’s BCM Policy and addresses the risks it is designed to control; and

(b) testing procedures are adequate and have been conducted satisfactorily.

34. APRA may request the external auditor of the regulated institution, or another appropriate external expert, to provide an assessment of the regulated institution’s BCM arrangements. Any such report must be paid for by the regulated institution and must be made available to APRA.[9]

Adjustments and exclusions

35. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[10]

Determinations made under previous prudential standards

36. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.

For the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:

(a) Prudential Standard APS 232 Business Continuity Management (including Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(b) Prudential Standard GPS 222 Business Continuity Management (including Guidance Note GGN 222.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(c) Prudential Standard LPS 232 Business Continuity Management made on 23 March 2007;

(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to business continuity management;

(e) Prudential Standard CPS 232 Business Continuity Management made on 9 September 2011; and

(f) Prudential Standard CPS 232 Business Continuity Management made on 30 November 2012.

Objective and key requirements of this Prudential Standard

This Prudential Standard requires each regulated institution and Level 2 group to implement a whole-of-business approach to business continuity management that is appropriate to the nature and scale of its operations. Business continuity management increases resilience to business disruption arising from internal and external events and may reduce the impact on the regulated institution’s or group’s business operations, reputation, profitability, depositors, policyholders and other stakeholders.

The ultimate responsibility for the business continuity of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).

The key requirements of this Prudential Standard are that:

• a regulated institution must identify, assess and manage potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors;

• the Board of the regulated institution must consider business continuity risks and controls as part of its overall risk management systems and approve a Business Continuity Management Policy;

• a regulated institution must develop and maintain a Business Continuity Plan that documents procedures and information which enable the regulated institution to manage business disruptions;

• a regulated institution must review the Business Continuity Plan annually and periodically arrange for its review by the internal audit function or an external expert; and

• a regulated institution must notify APRA in the event of certain disruptions.

Where a regulated institution is the Head of a Level 2 group, the group must have in place business continuity management appropriate to the nature and scale of its operations, and the provisions of this Prudential Standard must be applied appropriately throughout the group.

Authority

1. This Prudential Standard is made under:

(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);

(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and

(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).

Application

2. This Prudential Standard applies to:

(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;

(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and

(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.

These institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.

3. A requirement imposed upon a regulated institution that is also Head of a Level 2 group[1] is to be read as requiring that regulated institution to ensure that the applicable provision is applied appropriately throughout the Level 2 group.[2]

4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.

5. This Prudential Standard applies whether or not activities are outsourced to related bodies corporate or third-party service providers. This Prudential Standard also applies to arrangements where the service provider is located outside Australia or the functions are performed outside Australia.

6. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[3], provided that the policy has been approved by the Board[4] of the regulated institution and meets the requirements of this Prudential Standard.

7. This Prudential Standard commences on 1 January 2015.

Interpretation

8. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.

9. A ‘Level 2 group’ is:

(a) the consolidation of entities defined as Level 2 in APS 001; or

(b) a Level 2 insurance group as defined in GPS 001.

10. The ‘Head of a Level 2 group’ is:

(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;

(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or

(c) the parent entity of a Level 2 insurance group as defined in GPS 001.

The role of the Board and senior management

11. A regulated institution must identify, assess, manage, mitigate and report on potential business continuity risks to ensure that it is able to meet its financial and service obligations to its depositors, policyholders and other creditors.

12. The Board is ultimately responsible for the business continuity of the regulated institution. The Board remains responsible for business continuity management (BCM) whether or not business operations are outsourced or are part of a corporate group.[5]

13. The Board may delegate day–to-day operational responsibility for BCM to a responsible committee, including a responsible committee of the Head of the Level 2 group, and/or senior management. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.

14. The Board must approve the regulated institution’s Business Continuity Management Policy (BCM Policy) (refer to paragraphs 20 and 21).

15. The Board must ensure that the regulated institution’s business continuity risks and controls are taken into account as part of its overall risk management strategy and when completing a risk management declaration required to be provided to APRA.[6]

Business continuity management

16. BCM is a whole-of-business approach that includes policies, standards and procedures for ensuring that critical business operations can be maintained or recovered in a timely fashion, in the event of a disruption. Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.

17. Critical business operations are the business functions, resources and infrastructure that may, if disrupted, have a material impact on the regulated institution’s business functions, reputation, profitability, depositors and/or policyholders.

18. A regulated institution’s BCM must, at a minimum, include:

(a) a BCM Policy in accordance with paragraphs 20 and 21;

(b) a business impact analysis (BIA) including risk assessment in accordance with paragraphs 22 and 23;

(c) recovery objectives and strategies; in accordance with paragraphs 24 and 25;

(d) a business continuity plan (BCP) including crisis management and recovery in accordance with paragraphs 26 to 28; and

(e) programs for:

(i) review and testing of the BCP in accordance with paragraph 29; and

(ii) training and ensuring awareness of staff in relation to BCM.

19. In addition to the requirements stated elsewhere in this Prudential Standard, the Board of the Head of a Level 2 group must:

(a) ensure that the Level 2 group’s BCM is appropriate to the nature and scale of its operations and is consistent with the Level 2 group’s risk management strategy or framework;

(b) consistently apply BCM for each part of the Level 2 group;

(c) apply BCM to risk assessments and risk processes at a functional level in the Level 2 group, where appropriate; and

(d) ensure that the Level 2 group’s BCP is reviewed at least annually by responsible senior management of the Head of the Level 2 group.

BCM Policy

20. A regulated institution must have an up-to-date documented BCM Policy that sets out its objectives and approach in relation to BCM.

21. The BCM Policy must clearly state the roles, responsibilities and authorities to act in relation to the BCM Policy.

Business impact analysis

22. A BIA involves identifying all critical business functions, resources and infrastructure of the regulated institution and assessing the impact of a disruption on these.

23. When conducting the BIA, the regulated institution must consider:

(a) plausible disruption scenarios over varying periods of time;

(b) the period of time for which the regulated institution could not operate without each of its critical business operations;

(c) the extent to which a disruption to the critical business operations might have a material impact on the interests of depositors and/or policyholders of the regulated institution; and

(d) the financial, legal, regulatory and reputational impact of a disruption to a regulated institution’s critical business operations over varying periods of time.

Recovery objectives and strategies

24. Recovery objectives are pre-defined goals for recovering critical business operations to a specified level of service (recovery level) within a defined period (recovery time) following a disruption.

25. A regulated institution must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size and complexity of the regulated institution.

Business continuity planning

26. A regulated institution must maintain at all times a documented BCP that meets the objectives of the BCM Policy.[7]

27. The BCP must document procedures and information that enable the regulated institution to:

(a) manage an initial business disruption (crisis management); and

(b) recover critical business operations.

28. The BCP must reflect the specific requirements of the regulated institution and must identify:

(a) critical business operations;

(b) recovery levels and time targets for each critical business operation;

(c) recovery strategies for each critical business operation;

(d) infrastructure and resources required to implement the BCP;

(e) roles, responsibilities and authorities to act in relation to the BCP; and

(f) communication plans with staff and external stakeholders.

Review and testing of the BCP

29. A regulated institution must review and test its BCP at least annually, or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives. The results of the testing must be formally reported to the Board or to delegated management.[8]

30. The BCP must be updated if shortcomings are identified as a result of the review and testing required under paragraph 29.

Notification requirements

31. A regulated institution must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to have a material impact on the regulated institution’s risk profile, or affect its financial soundness. The regulated institution must explain to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The regulated institution must notify APRA when normal operations resume.

32. The information or notifications required by this Prudential Standard must be given in such form, if any, and by such procedures, if any, as APRA determines and publishes on its website from time to time.

Audit arrangements

33. A regulated institution’s internal audit function, or an external expert, must periodically review the BCP and provide an assurance to the Board or to delegated management that:

(a) the BCP is in accordance with the regulated institution’s BCM Policy and addresses the risks it is designed to control; and

(b) testing procedures are adequate and have been conducted satisfactorily.

34. APRA may request the external auditor of the regulated institution, or another appropriate external expert, to provide an assessment of the regulated institution’s BCM arrangements. Any such report must be paid for by the regulated institution and must be made available to APRA.[9]

Adjustments and exclusions

35. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[10]

Determinations made under previous prudential standards

36. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.

For the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:

(a) Prudential Standard APS 232 Business Continuity Management (including Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(b) Prudential Standard GPS 222 Business Continuity Management (including Guidance Note GGN 222.1 Risk Assessment and Business Continuity Management) made on 18 April 2005;

(c) Prudential Standard LPS 232 Business Continuity Management made on 23 March 2007;

(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to business continuity management;

(e) Prudential Standard CPS 232 Business Continuity Management made on 9 September 2011; and

(f) Prudential Standard CPS 232 Business Continuity Management made on 30 November 2012.