View image in the official source

Prudential Standard APS 232

Business Continuity Management

Objective and key requirements of this Prudential Standard

This Prudential Standard aims to ensure that an authorised deposit-taking institution (ADI) implements a whole of business approach to business continuity management (BCM) appropriate to the nature and scale of its operations. BCM increases an ADI’s resilience to business disruption arising from internal and external events and reduces the impact on the ADI’s business operations, reputation, profitability, depositors and other stakeholders.

The prime responsibility for the business continuity of the ADI rests with the Board of Directors (the Board) of the ADI, or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board.

The key requirements of this Prudential Standard are:

• the Board and senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework when completing the risk management declaration provided to APRA on an annual basis;
• an ADI must identify, on a whole of business basis, critical business functions, resources and infrastructure, which, if disrupted, would have a material impact;
• an ADI must assess the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure, and have in place appropriate recovery strategies to ensure that all necessary resources are readily available to withstand the impact of the disruption;
• an ADI must develop, implement and maintain a Business Continuity Plan (BCP) that documents procedures and information which enable the ADI to respond to disruptions and recover critical business functions. The BCP must be reviewed at least annually by responsible senior management and periodically reviewed through the ADI’s internal audit function or an external expert; and
• an ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors.

Authority and application

1. This Prudential Standard, made under section 11AF of the Banking Act 1959 (the Act), applies to all authorised deposit-taking institutions (ADIs).
2. Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management (AGN 232.1 Risk Assessment and Business Continuity Management) forms part of this Prudential Standard.
3. Requirements relating to annual risk management declarations are contained in Prudential Standard APS 310 Audit and Related Arrangements for Prudential Reporting (APS 310 Audit and Related Arrangements for Prudential Reporting). Additional requirements relating to outsourcing are set out in Prudential Standard APS 231 Outsourcing (APS 231 Outsourcing).

Business continuity management

4. Business continuity management (BCM) describes a whole of business approach to ensure critical business functions can be maintained, or restored in a timely fashion, in the event of material disruptions arising from internal or external events. Its purpose is to minimise the financial, legal, reputational and other material consequences arising from the disruption.

5. To this end, APRA requires all ADIs to identify, assess and manage potential business continuity risks to ensure each ADI is able to meet its financial and service obligations to its depositors and other creditors.

6. BCM involves an integrated process of:

(a) risk assessment;

(b) business impact analysis;

(c) consideration of recovery strategies;

(d) business continuity planning;

(e) establishing business continuity/crisis management teams; and

(f) review and testing.

7. BCM should also be part of the planning phase for new business acquisitions, joint ventures, material outsourcing arrangements and major projects involving the introduction of new business processes and systems.

The role of the Board and senior management

8. The Board of Directors (the Board), or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board,[1] is ultimately responsible for the business continuity of the ADI.

9. The Board may delegate operational responsibility for BCM to a responsible committee (the Committee) and/or senior management of the ADI. The operational responsibility must be clearly expressed in the charter of the Committee and in the performance objectives of responsible senior management.

10. Senior management must similarly establish clear lines of accountability and reporting for individuals with BCM responsibility.

11. In larger ADIs, consideration should also be given to establishing a centralised business continuity function[2] to ensure that common standards and practices are in place across the ADI.

Critical business functions, resources and infrastructure

12. An ADI must identify, on a whole of business basis, its critical business functions, resources and infrastructure.

13. The assessment of criticality is often a subjective one and depends on the circumstances faced by individual ADIs. In general, critical business functions, resources and infrastructure are defined as ones that have the potential, if disrupted, to impact materially on the ADI’s business operations, reputation or profitability.

Risk assessment

14. ADIs must identify plausible disruption scenarios that may lead to short, medium and long-term disruptions to critical business functions and assess the likelihood of these scenarios occurring. Suggested scenarios to be considered in the risk assessment are contained in AGN 232.1 Risk Assessment and Business Continuity Management.

Business impact analysis

15. A business impact analysis (BIA) involves identifying all critical business functions, resources and infrastructure of the ADI and assessing the impact of a disruption on these.

16. To this end, an ADI must determine the potential financial, legal, reputational and other material consequences if the critical business functions, resources and infrastructure are unavailable.

17. Factors that APRA would expect to be considered by the ADI when making this determination include:

(a) the extent to which the interests of depositors may be adversely impacted by disruption to the normal services and operations of the ADI;

(b) the financial and reputational impact of a failure of the ADI to perform over a given period of time;

(c) the revenue lost as a share of total revenue;

(d) the degree of difficulty, including the time taken, in restoring the business activity or support function or implementing alternate arrangements; and

(e) the ability of the ADI to meet regulatory requirements if there were business continuity problems.

18. The period of time during which the ADI could not operate without its critical business functions, resources and infrastructure must be determined. The priority and timeframes assigned for the recovery of critical business functions, resources and infrastructure must also be determined.

19. The BIA[3] process must cover all business units of the ADI, including operations located inter-state and offshore, those subsidiary companies providing specialist services to the ADI and arrangements with critical service providers, to ensure a whole of business coverage.

20. Senior management must ensure that there is adequate representation and involvement from all business units when undertaking the BIA process. The BIA process must be validated by senior management.

Recovery strategy

21. An ADI must consider appropriate recovery strategies based on the results of the BIA.

22. Senior management should approve the resources needed to implement the agreed strategy and ensure sufficient budgetary and other resources are allocated to allow implementation of the strategy.

23. ADIs should have insurance arrangements in place to cover some of the costs of business disruption. However, this in itself is not considered a substitute for a comprehensive BCM framework.

Business continuity planning

24. Each ADI must maintain at all times a written Business Continuity Plan (BCP)[4] approved by the Board or delegated representatives.

25. The BCP refers to the documented procedures and information which enable the ADI to respond to a disruption, recover and resume critical business functions. Consideration must also be given to the necessary requirements for return to normal operations. This may be treated as a distinct stage of the business continuity planning process.

26. The business continuity planning process must include all business units and cover all critical business functions, resources and infrastructure, including operations located inter-state and offshore, those subsidiary companies providing specialist services to the ADI and arrangements with critical service providers, to ensure a whole of business coverage.

27. The BCP should reflect the specific requirements of the ADI. At a minimum, a BCP must contain:

(a) the procedures to be followed in response to a material disruption to normal business operations. The procedures should enable the ADI to manage the initial business disruption, recover and resume the critical business functions, resources and infrastructure outlined in the BCP within the nominated timeframe;

(b) a list of all resources needed to run operations in the event the primary operational site is unavailable. This would include, but is not limited to, computer hardware and software, printers, faxes, telephones, standard stationery and forms. Additional resources include suitably trained staff and relevant documentation such as insurance policies and contracts;

(c) a communication plan for notifying key internal and external stakeholders if the ADI’s BCP is invoked. Further detail on communication plans is contained in AGN 232.1 Risk Assessment and Business Continuity Management;

(d) consideration of business continuity as part of any material outsourcing agreement with a critical third party service provider. Further detail on outsourcing is contained in AGN 232.1 Risk Assessment and Business Continuity Management. ADIs should also refer to APS 231 Outsourcing for additional requirements regarding outsourcing arrangements; and

(e) relevant information about an ADI’s alternate site(s) for the recovery of business and/or IT operations if this forms part of the ADI’s BCP. An alternate site refers to a site used for the resumption of critical business functions. Further detail on alternate sites is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

28. A consistent method of documenting the BCP should be implemented throughout the ADI. Detailed input into the BCP should occur at the business unit level.

29. Off-site copies of the BCP must be kept by a number of responsible managers who have designated responsibilities in terms of the BCP and should also be available at the alternate site(s) if applicable. Further detail on issues to be taken into account when using an alternate site is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

Business continuity/crisis management team

30. The composition and responsibilities of the business continuity or crisis management team, or other group that has the authority to invoke the BCP or a separate Crisis Management Plan (CMP), must be clearly identified in the BCP and/or CMP. This would include, but is not limited to, an assessment of the impact of the disruption, determining the appropriate response, implementing the communications plan, evacuating staff and activating the alternate site(s) if required.

Review and testing of the BCP

31. The ADI’s BCP must be reviewed by responsible senior management at least annually or more frequently if there are material changes to business operations.

32. The ADI’s internal audit function, or an external expert, must also periodically review the BCP and provide an assurance to the Board or the Committee that the BCP is in accordance with the ADI’s formal policy (see paragraph 40), addresses the risks it is designed to control and that testing procedures are adequate and have been conducted satisfactorily.

33. An ADI must undertake a testing program of its BCP at least annually, or more frequently if there are material changes to business operations, to ensure the BCP is capable of meeting its objectives. Further detail on testing is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

34. The results of the testing must be formally reported to responsible senior management and the Board or the Committee. The BCP must be amended to reflect any enhancements as a result of the tests.

Accountability and application

35. While some ADIs may rely upon third party service providers for components of their BCP, accountability for the BCP remains with the ADI. It is important for ADIs to recognise that, while outsourcing can be of significant benefit and may in fact reduce some risks, it may also give rise to other risks (refer to APS 231 Outsourcing).

36. In large conglomerates, where a central service model is employed to provide specialist services, the Board of an ADI remains responsible for the BCP and must establish effective oversight and management reporting arrangements.

37. In other cases, ADIs may be involved in joint ventures, strategic alliances or partnering arrangements that perform the BCP activities. This Prudential Standard applies regardless of whether activities are outsourced to related or third party service providers. However, APRA will be flexible in applying this Prudential Standard where the services are provided by another APRA-regulated entity within the group. This Prudential Standard also applies to arrangements where the service provider is located outside Australia, or the functions are performed outside Australia.

BCM as part of the risk management framework

38. BCM should be an integrated component of the ADI’s risk management and control framework.

39. The Board and responsible senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework and when completing the risk management declaration provided to APRA on an annual basis as required by APS 310 Auditing and Related Arrangements for Prudential Reporting.

40. An ADI must have a formal policy that sets out its approach to BCM. The policy should be summarised in the risk management system descriptions as required by APS 310 Auditing and Related Arrangements for Prudential Reporting.

41. Procedures must be in place to ensure that all business units are fully aware of, and comply with, the BCM policy.

Notification requirements

42. An ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors. The ADI should outline to APRA the nature of the disruption, the action being taken and the timeframe for return to normal operations. APRA must be notified when normal operations are resumed.

43. APRA may request additional information where it considers it necessary to do so in order to understand and assess the impact of the disruption on the ADI’s risk profile.

External audit

44. Where it considers it necessary, APRA may request the external auditor of the ADI, or an appropriate external expert, to provide an assessment of the BCM arrangements within the ADI or in respect of a critical service provider. Such reports will be paid for by the ADI and must be made available to APRA.

Transitional arrangements

45. A transitional period of 12 months applies from the date this Prudential Standard is determined. During this transitional period, all ADIs must:

(a) report on their compliance with this Prudential Standard in their annual risk management declaration (as required under APS 310 Auditing and Related Arrangements for Prudential Reporting); and

(b) submit to APRA a plan and timeframe for rectifying areas of non-compliance with this Prudential Standard.

Business Continuity Management

Objective and key requirements of this Prudential Standard

This Prudential Standard aims to ensure that an authorised deposit-taking institution (ADI) implements a whole of business approach to business continuity management (BCM) appropriate to the nature and scale of its operations. BCM increases an ADI’s resilience to business disruption arising from internal and external events and reduces the impact on the ADI’s business operations, reputation, profitability, depositors and other stakeholders.

The prime responsibility for the business continuity of the ADI rests with the Board of Directors (the Board) of the ADI, or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board.

The key requirements of this Prudential Standard are:

• the Board and senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework when completing the risk management declaration provided to APRA on an annual basis;
• an ADI must identify, on a whole of business basis, critical business functions, resources and infrastructure, which, if disrupted, would have a material impact;
• an ADI must assess the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure, and have in place appropriate recovery strategies to ensure that all necessary resources are readily available to withstand the impact of the disruption;
• an ADI must develop, implement and maintain a Business Continuity Plan (BCP) that documents procedures and information which enable the ADI to respond to disruptions and recover critical business functions. The BCP must be reviewed at least annually by responsible senior management and periodically reviewed through the ADI’s internal audit function or an external expert; and
• an ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors.

Authority and application

1. This Prudential Standard, made under section 11AF of the Banking Act 1959 (the Act), applies to all authorised deposit-taking institutions (ADIs).
2. Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management (AGN 232.1 Risk Assessment and Business Continuity Management) forms part of this Prudential Standard.
3. Requirements relating to annual risk management declarations are contained in Prudential Standard APS 310 Audit and Related Arrangements for Prudential Reporting (APS 310 Audit and Related Arrangements for Prudential Reporting). Additional requirements relating to outsourcing are set out in Prudential Standard APS 231 Outsourcing (APS 231 Outsourcing).

Business continuity management

4. Business continuity management (BCM) describes a whole of business approach to ensure critical business functions can be maintained, or restored in a timely fashion, in the event of material disruptions arising from internal or external events. Its purpose is to minimise the financial, legal, reputational and other material consequences arising from the disruption.

5. To this end, APRA requires all ADIs to identify, assess and manage potential business continuity risks to ensure each ADI is able to meet its financial and service obligations to its depositors and other creditors.

6. BCM involves an integrated process of:

(a) risk assessment;

(b) business impact analysis;

(c) consideration of recovery strategies;

(d) business continuity planning;

(e) establishing business continuity/crisis management teams; and

(f) review and testing.

7. BCM should also be part of the planning phase for new business acquisitions, joint ventures, material outsourcing arrangements and major projects involving the introduction of new business processes and systems.

The role of the Board and senior management

8. The Board of Directors (the Board), or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board,[1] is ultimately responsible for the business continuity of the ADI.

9. The Board may delegate operational responsibility for BCM to a responsible committee (the Committee) and/or senior management of the ADI. The operational responsibility must be clearly expressed in the charter of the Committee and in the performance objectives of responsible senior management.

10. Senior management must similarly establish clear lines of accountability and reporting for individuals with BCM responsibility.

11. In larger ADIs, consideration should also be given to establishing a centralised business continuity function[2] to ensure that common standards and practices are in place across the ADI.

Critical business functions, resources and infrastructure

12. An ADI must identify, on a whole of business basis, its critical business functions, resources and infrastructure.

13. The assessment of criticality is often a subjective one and depends on the circumstances faced by individual ADIs. In general, critical business functions, resources and infrastructure are defined as ones that have the potential, if disrupted, to impact materially on the ADI’s business operations, reputation or profitability.

Risk assessment

14. ADIs must identify plausible disruption scenarios that may lead to short, medium and long-term disruptions to critical business functions and assess the likelihood of these scenarios occurring. Suggested scenarios to be considered in the risk assessment are contained in AGN 232.1 Risk Assessment and Business Continuity Management.

Business impact analysis

15. A business impact analysis (BIA) involves identifying all critical business functions, resources and infrastructure of the ADI and assessing the impact of a disruption on these.

16. To this end, an ADI must determine the potential financial, legal, reputational and other material consequences if the critical business functions, resources and infrastructure are unavailable.

17. Factors that APRA would expect to be considered by the ADI when making this determination include:

(a) the extent to which the interests of depositors may be adversely impacted by disruption to the normal services and operations of the ADI;

(b) the financial and reputational impact of a failure of the ADI to perform over a given period of time;

(c) the revenue lost as a share of total revenue;

(d) the degree of difficulty, including the time taken, in restoring the business activity or support function or implementing alternate arrangements; and

(e) the ability of the ADI to meet regulatory requirements if there were business continuity problems.

18. The period of time during which the ADI could not operate without its critical business functions, resources and infrastructure must be determined. The priority and timeframes assigned for the recovery of critical business functions, resources and infrastructure must also be determined.

19. The BIA[3] process must cover all business units of the ADI, including operations located inter-state and offshore, those subsidiary companies providing specialist services to the ADI and arrangements with critical service providers, to ensure a whole of business coverage.

20. Senior management must ensure that there is adequate representation and involvement from all business units when undertaking the BIA process. The BIA process must be validated by senior management.

Recovery strategy

21. An ADI must consider appropriate recovery strategies based on the results of the BIA.

22. Senior management should approve the resources needed to implement the agreed strategy and ensure sufficient budgetary and other resources are allocated to allow implementation of the strategy.

23. ADIs should have insurance arrangements in place to cover some of the costs of business disruption. However, this in itself is not considered a substitute for a comprehensive BCM framework.

Business continuity planning

24. Each ADI must maintain at all times a written Business Continuity Plan (BCP)[4] approved by the Board or delegated representatives.

25. The BCP refers to the documented procedures and information which enable the ADI to respond to a disruption, recover and resume critical business functions. Consideration must also be given to the necessary requirements for return to normal operations. This may be treated as a distinct stage of the business continuity planning process.

26. The business continuity planning process must include all business units and cover all critical business functions, resources and infrastructure, including operations located inter-state and offshore, those subsidiary companies providing specialist services to the ADI and arrangements with critical service providers, to ensure a whole of business coverage.

27. The BCP should reflect the specific requirements of the ADI. At a minimum, a BCP must contain:

(a) the procedures to be followed in response to a material disruption to normal business operations. The procedures should enable the ADI to manage the initial business disruption, recover and resume the critical business functions, resources and infrastructure outlined in the BCP within the nominated timeframe;

(b) a list of all resources needed to run operations in the event the primary operational site is unavailable. This would include, but is not limited to, computer hardware and software, printers, faxes, telephones, standard stationery and forms. Additional resources include suitably trained staff and relevant documentation such as insurance policies and contracts;

(c) a communication plan for notifying key internal and external stakeholders if the ADI’s BCP is invoked. Further detail on communication plans is contained in AGN 232.1 Risk Assessment and Business Continuity Management;

(d) consideration of business continuity as part of any material outsourcing agreement with a critical third party service provider. Further detail on outsourcing is contained in AGN 232.1 Risk Assessment and Business Continuity Management. ADIs should also refer to APS 231 Outsourcing for additional requirements regarding outsourcing arrangements; and

(e) relevant information about an ADI’s alternate site(s) for the recovery of business and/or IT operations if this forms part of the ADI’s BCP. An alternate site refers to a site used for the resumption of critical business functions. Further detail on alternate sites is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

28. A consistent method of documenting the BCP should be implemented throughout the ADI. Detailed input into the BCP should occur at the business unit level.

29. Off-site copies of the BCP must be kept by a number of responsible managers who have designated responsibilities in terms of the BCP and should also be available at the alternate site(s) if applicable. Further detail on issues to be taken into account when using an alternate site is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

Business continuity/crisis management team

30. The composition and responsibilities of the business continuity or crisis management team, or other group that has the authority to invoke the BCP or a separate Crisis Management Plan (CMP), must be clearly identified in the BCP and/or CMP. This would include, but is not limited to, an assessment of the impact of the disruption, determining the appropriate response, implementing the communications plan, evacuating staff and activating the alternate site(s) if required.

Review and testing of the BCP

31. The ADI’s BCP must be reviewed by responsible senior management at least annually or more frequently if there are material changes to business operations.

32. The ADI’s internal audit function, or an external expert, must also periodically review the BCP and provide an assurance to the Board or the Committee that the BCP is in accordance with the ADI’s formal policy (see paragraph 40), addresses the risks it is designed to control and that testing procedures are adequate and have been conducted satisfactorily.

33. An ADI must undertake a testing program of its BCP at least annually, or more frequently if there are material changes to business operations, to ensure the BCP is capable of meeting its objectives. Further detail on testing is contained in AGN 232.1 Risk Assessment and Business Continuity Management.

34. The results of the testing must be formally reported to responsible senior management and the Board or the Committee. The BCP must be amended to reflect any enhancements as a result of the tests.

Accountability and application

35. While some ADIs may rely upon third party service providers for components of their BCP, accountability for the BCP remains with the ADI. It is important for ADIs to recognise that, while outsourcing can be of significant benefit and may in fact reduce some risks, it may also give rise to other risks (refer to APS 231 Outsourcing).

36. In large conglomerates, where a central service model is employed to provide specialist services, the Board of an ADI remains responsible for the BCP and must establish effective oversight and management reporting arrangements.

37. In other cases, ADIs may be involved in joint ventures, strategic alliances or partnering arrangements that perform the BCP activities. This Prudential Standard applies regardless of whether activities are outsourced to related or third party service providers. However, APRA will be flexible in applying this Prudential Standard where the services are provided by another APRA-regulated entity within the group. This Prudential Standard also applies to arrangements where the service provider is located outside Australia, or the functions are performed outside Australia.

BCM as part of the risk management framework

38. BCM should be an integrated component of the ADI’s risk management and control framework.

39. The Board and responsible senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework and when completing the risk management declaration provided to APRA on an annual basis as required by APS 310 Auditing and Related Arrangements for Prudential Reporting.

40. An ADI must have a formal policy that sets out its approach to BCM. The policy should be summarised in the risk management system descriptions as required by APS 310 Auditing and Related Arrangements for Prudential Reporting.

41. Procedures must be in place to ensure that all business units are fully aware of, and comply with, the BCM policy.

Notification requirements

42. An ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors. The ADI should outline to APRA the nature of the disruption, the action being taken and the timeframe for return to normal operations. APRA must be notified when normal operations are resumed.

43. APRA may request additional information where it considers it necessary to do so in order to understand and assess the impact of the disruption on the ADI’s risk profile.

External audit

44. Where it considers it necessary, APRA may request the external auditor of the ADI, or an appropriate external expert, to provide an assessment of the BCM arrangements within the ADI or in respect of a critical service provider. Such reports will be paid for by the ADI and must be made available to APRA.

Transitional arrangements

45. A transitional period of 12 months applies from the date this Prudential Standard is determined. During this transitional period, all ADIs must:

(a) report on their compliance with this Prudential Standard in their annual risk management declaration (as required under APS 310 Auditing and Related Arrangements for Prudential Reporting); and

(b) submit to APRA a plan and timeframe for rectifying areas of non-compliance with this Prudential Standard.

Objective and key requirements of this Prudential Standard

This Prudential Standard aims to ensure that an authorised deposit-taking institution (ADI) implements a whole of business approach to business continuity management (BCM) appropriate to the nature and scale of its operations. BCM increases an ADI’s resilience to business disruption arising from internal and external events and reduces the impact on the ADI’s business operations, reputation, profitability, depositors and other stakeholders.

The prime responsibility for the business continuity of the ADI rests with the Board of Directors (the Board) of the ADI, or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board.

The key requirements of this Prudential Standard are:

• the Board and senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework when completing the risk management declaration provided to APRA on an annual basis;
• an ADI must identify, on a whole of business basis, critical business functions, resources and infrastructure, which, if disrupted, would have a material impact;
• an ADI must assess the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure, and have in place appropriate recovery strategies to ensure that all necessary resources are readily available to withstand the impact of the disruption;
• an ADI must develop, implement and maintain a Business Continuity Plan (BCP) that documents procedures and information which enable the ADI to respond to disruptions and recover critical business functions. The BCP must be reviewed at least annually by responsible senior management and periodically reviewed through the ADI’s internal audit function or an external expert; and
• an ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors.

View image in the official source

Guidance Note AGN 232.1

Risk Assessment and Business Continuity Management

1. This Guidance Note provides further detail on matters authorised deposit-taking institutions (ADIs) should consider when addressing the requirements contained in Prudential Standard APS 232 Business Continuity Management.

Risk assessment

2. The risk assessment should be undertaken at least annually and more frequently if there have been significant operational changes at the ADI or new or changed external factors that would alter the ADI’s business continuity risk profile.

3. The worst case disruption scenario should be considered by an ADI and include, but not be limited to:

(a) loss of precinct;

(b) loss of building;

(c) denial of access to building for a limited time;

(d) loss of IT (data);

(e) loss of IT (voice);

(f) loss of vital (non-electronic) records;

(g) loss of key staff (temporary or permanent); and

(h) loss of key dependencies.

4. The critical interdependencies of the ADI’s Business Continuity Plan (BCP) that are not within the direct control of the ADI should be identified and the associated risks assessed. This includes, but is not limited to, dependencies on utilities, third party service providers and key suppliers.

Communication plan

5. The communication plan[5] should incorporate a list of contact names and numbers, including, but not limited to, staff, regulators, customers, counterparties, service providers, market authorities and media. Out-of-hours numbers (including primary/alternate contacts) should be included for all staff with BCP responsibility. The contact list should be reviewed regularly to ensure it is up-to-date.

6. The communication plan should clearly identify the staff authorised to deal with the media if the BCP is invoked.

Outsourcing

7. Business continuity should be considered as part of any proposed material outsourcing agreement with a critical service provider. The ADI should conduct due diligence in this regard as part of the decision making process when assessing service providers.

8. The contract between the ADI and the critical service provider should include a requirement that the service provider have a BCP and testing program in place and provide for regular, and not less than annual, reporting to the ADI.

9. The ADI should recognise that outsourcing a business function does not transfer the associated business continuity risk to the service provider. The ADI should not place undue reliance on the service provider’s BCP and should consider alternative contingency arrangements in the event that the service provider is unable to provide the agreed services. This is particularly important where there is no capability of bringing the outsourced business function back in-house (in either the short or medium term), or where an arrangement with an alternative service provider could not be implemented within an acceptably short time period.

10. The ADI’s BCP should consider the operational links and interdependencies with the critical service provider’s BCP and include arrangements for managing disruptions with the critical service provider.

11. ADIs should refer to APRA’s Prudential Standard APS 231 Outsourcing for additional requirements regarding outsourcing arrangements.

Alternate sites

12. Alternate site refers to a site used for the resumption of critical business functions.

13. Where an ADI’s BCP involves the use of an alternate site for the recovery of business and/or IT operations, this section applies regardless of whether the site is another operational site (e.g. inter-state office) owned by the ADI, or a disaster recovery site managed by the ADI or a specialist third party service provider.

14. Where the alternate site is also a primary operational site (e.g. inter-state office) of the ADI, an assessment should be made of the capacity of the site and the timeframe over which the site could operate in a combined business continuity and operational mode.

15. The alternate site(s) should be located at sufficient distance from the primary operational site(s) to minimise the risk of both sites being unavailable simultaneously.

16. ADIs should where possible ensure that the alternate sites are not on the same power grid or telecommunications network as the primary operational sites.

17. Where an ADI has its primary operations in the Central Business District (CBD) of a major capital city, APRA would normally expect the alternate site to be located outside that CBD in order to minimise the risk of both sites being impacted by a wide area disruption. Where the two sites are located in the same CBD, the ADI will need to demonstrate to APRA that it has adequate arrangements in place to manage the potential risk of both sites being impacted simultaneously.

18. The transportation arrangements to the alternate site(s) should also be contained in the BCP. Alternate modes of transport to the alternate site(s) should be considered as a particular mode of transport may be unavailable as a result of the disruption.

19. The operational capacity of the alternate site(s) should satisfy the ADI’s business continuity objectives set out in the BCP. A review and assessment of the capacity of the alternate site(s) should be undertaken at least annually.

20. Where the alternate site(s) has contracted arrangements with a number of other organisations, including other parts of the ADI or its parent’s business, the contract between the ADI and the alternate site provider should clearly state the dedicated and shared functional and seating capacity available to the ADI.

21. The ADI should also assess the reliability of the shared capacity at the alternate site(s) provided by a service provider where the site is likely to be used for a longer duration.

Testing

22. The ADI’s testing program could include a range of test approaches from desk-top “walk-throughs”, individual component testing (e.g. IT equipment), through to fully integrated tests covering the whole ADI and including third party service providers. Testing scenarios, objectives and procedures should be developed and clearly documented.

23. The program of testing should be overseen by responsible senior management and involve all personnel with specific BCP responsibility.

24. Minimum testing requirements should include, but not be limited to:

(a) staff evacuation procedures;

(b) communication plans;

(c) alternate site activation;

(d) data back up and recovery;

(e) physical and computer security; and

(f) recovery of critical business functions.

25. For outsourcing arrangements, the ADI should involve itself in the critical service provider’s testing program or, where this is not possible, seek an independent assurance that the critical service provider’s BCP has been satisfactorily tested. The ADI should receive the critical service provider’s test results on an annual basis (at a minimum) and these should be reported to responsible senior management and the Board of Directors or its responsible Committee.

Training

26. An ADI should implement a training program to build the knowledge and awareness of the business continuity management program amongst staff.

27. Staff with specific responsibility for the business continuity management program at the ADI should undertake the necessary training to ensure they are able to competently fulfil their responsibilities. The training requirements should be included in the performance objectives of responsible individuals.

28. All staff should be familiar with the relevant BCP for their business unit.

Risk Assessment and Business Continuity Management

1. This Guidance Note provides further detail on matters authorised deposit-taking institutions (ADIs) should consider when addressing the requirements contained in Prudential Standard APS 232 Business Continuity Management.

Risk assessment

2. The risk assessment should be undertaken at least annually and more frequently if there have been significant operational changes at the ADI or new or changed external factors that would alter the ADI’s business continuity risk profile.

3. The worst case disruption scenario should be considered by an ADI and include, but not be limited to:

(a) loss of precinct;

(b) loss of building;

(c) denial of access to building for a limited time;

(d) loss of IT (data);

(e) loss of IT (voice);

(f) loss of vital (non-electronic) records;

(g) loss of key staff (temporary or permanent); and

(h) loss of key dependencies.

4. The critical interdependencies of the ADI’s Business Continuity Plan (BCP) that are not within the direct control of the ADI should be identified and the associated risks assessed. This includes, but is not limited to, dependencies on utilities, third party service providers and key suppliers.

Communication plan

5. The communication plan[5] should incorporate a list of contact names and numbers, including, but not limited to, staff, regulators, customers, counterparties, service providers, market authorities and media. Out-of-hours numbers (including primary/alternate contacts) should be included for all staff with BCP responsibility. The contact list should be reviewed regularly to ensure it is up-to-date.

6. The communication plan should clearly identify the staff authorised to deal with the media if the BCP is invoked.

Outsourcing

7. Business continuity should be considered as part of any proposed material outsourcing agreement with a critical service provider. The ADI should conduct due diligence in this regard as part of the decision making process when assessing service providers.

8. The contract between the ADI and the critical service provider should include a requirement that the service provider have a BCP and testing program in place and provide for regular, and not less than annual, reporting to the ADI.

9. The ADI should recognise that outsourcing a business function does not transfer the associated business continuity risk to the service provider. The ADI should not place undue reliance on the service provider’s BCP and should consider alternative contingency arrangements in the event that the service provider is unable to provide the agreed services. This is particularly important where there is no capability of bringing the outsourced business function back in-house (in either the short or medium term), or where an arrangement with an alternative service provider could not be implemented within an acceptably short time period.

10. The ADI’s BCP should consider the operational links and interdependencies with the critical service provider’s BCP and include arrangements for managing disruptions with the critical service provider.

11. ADIs should refer to APRA’s Prudential Standard APS 231 Outsourcing for additional requirements regarding outsourcing arrangements.

Alternate sites

12. Alternate site refers to a site used for the resumption of critical business functions.

13. Where an ADI’s BCP involves the use of an alternate site for the recovery of business and/or IT operations, this section applies regardless of whether the site is another operational site (e.g. inter-state office) owned by the ADI, or a disaster recovery site managed by the ADI or a specialist third party service provider.

14. Where the alternate site is also a primary operational site (e.g. inter-state office) of the ADI, an assessment should be made of the capacity of the site and the timeframe over which the site could operate in a combined business continuity and operational mode.

15. The alternate site(s) should be located at sufficient distance from the primary operational site(s) to minimise the risk of both sites being unavailable simultaneously.

16. ADIs should where possible ensure that the alternate sites are not on the same power grid or telecommunications network as the primary operational sites.

17. Where an ADI has its primary operations in the Central Business District (CBD) of a major capital city, APRA would normally expect the alternate site to be located outside that CBD in order to minimise the risk of both sites being impacted by a wide area disruption. Where the two sites are located in the same CBD, the ADI will need to demonstrate to APRA that it has adequate arrangements in place to manage the potential risk of both sites being impacted simultaneously.

18. The transportation arrangements to the alternate site(s) should also be contained in the BCP. Alternate modes of transport to the alternate site(s) should be considered as a particular mode of transport may be unavailable as a result of the disruption.

19. The operational capacity of the alternate site(s) should satisfy the ADI’s business continuity objectives set out in the BCP. A review and assessment of the capacity of the alternate site(s) should be undertaken at least annually.

20. Where the alternate site(s) has contracted arrangements with a number of other organisations, including other parts of the ADI or its parent’s business, the contract between the ADI and the alternate site provider should clearly state the dedicated and shared functional and seating capacity available to the ADI.

21. The ADI should also assess the reliability of the shared capacity at the alternate site(s) provided by a service provider where the site is likely to be used for a longer duration.

Testing

22. The ADI’s testing program could include a range of test approaches from desk-top “walk-throughs”, individual component testing (e.g. IT equipment), through to fully integrated tests covering the whole ADI and including third party service providers. Testing scenarios, objectives and procedures should be developed and clearly documented.

23. The program of testing should be overseen by responsible senior management and involve all personnel with specific BCP responsibility.

24. Minimum testing requirements should include, but not be limited to:

(a) staff evacuation procedures;

(b) communication plans;

(c) alternate site activation;

(d) data back up and recovery;

(e) physical and computer security; and

(f) recovery of critical business functions.

25. For outsourcing arrangements, the ADI should involve itself in the critical service provider’s testing program or, where this is not possible, seek an independent assurance that the critical service provider’s BCP has been satisfactorily tested. The ADI should receive the critical service provider’s test results on an annual basis (at a minimum) and these should be reported to responsible senior management and the Board of Directors or its responsible Committee.

Training

26. An ADI should implement a training program to build the knowledge and awareness of the business continuity management program amongst staff.

27. Staff with specific responsibility for the business continuity management program at the ADI should undertake the necessary training to ensure they are able to competently fulfil their responsibilities. The training requirements should be included in the performance objectives of responsible individuals.

28. All staff should be familiar with the relevant BCP for their business unit.