Risk Assessment and Business Continuity Management

1. This Guidance Note provides further detail on matters authorised deposit-taking institutions (ADIs) should consider when addressing the requirements contained in Prudential Standard APS 232 Business Continuity Management.

Risk assessment

2. The risk assessment should be undertaken at least annually and more frequently if there have been significant operational changes at the ADI or new or changed external factors that would alter the ADI’s business continuity risk profile.

3. The worst case disruption scenario should be considered by an ADI and include, but not be limited to:

(a) loss of precinct;

(b) loss of building;

(c) denial of access to building for a limited time;

(d) loss of IT (data);

(e) loss of IT (voice);

(f) loss of vital (non-electronic) records;

(g) loss of key staff (temporary or permanent); and

(h) loss of key dependencies.

4. The critical interdependencies of the ADI’s Business Continuity Plan (BCP) that are not within the direct control of the ADI should be identified and the associated risks assessed. This includes, but is not limited to, dependencies on utilities, third party service providers and key suppliers.

Communication plan

5. The communication plan[5] should incorporate a list of contact names and numbers, including, but not limited to, staff, regulators, customers, counterparties, service providers, market authorities and media. Out-of-hours numbers (including primary/alternate contacts) should be included for all staff with BCP responsibility. The contact list should be reviewed regularly to ensure it is up-to-date.

6. The communication plan should clearly identify the staff authorised to deal with the media if the BCP is invoked.

Outsourcing

7. Business continuity should be considered as part of any proposed material outsourcing agreement with a critical service provider. The ADI should conduct due diligence in this regard as part of the decision making process when assessing service providers.

8. The contract between the ADI and the critical service provider should include a requirement that the service provider have a BCP and testing program in place and provide for regular, and not less than annual, reporting to the ADI.

9. The ADI should recognise that outsourcing a business function does not transfer the associated business continuity risk to the service provider. The ADI should not place undue reliance on the service provider’s BCP and should consider alternative contingency arrangements in the event that the service provider is unable to provide the agreed services. This is particularly important where there is no capability of bringing the outsourced business function back in-house (in either the short or medium term), or where an arrangement with an alternative service provider could not be implemented within an acceptably short time period.