Hello Using the below Assist to draft the BCM policy statement and the procedure for review. 

The below is CIO Email today, 

Regarding the Audit finding on BCM policy;


We had a discussion regarding prolonged system downtime, and we agreed to add a clause to our BCM policy stating that during such periods, we should be able to provide cash-in and cash-out services to our customers through branches, referencing the last recorded balance from the report.

I understand that the likelihood of this scenario occurring is very low, but let's include it to address and close the audit exception.

Absence of Manual Contingency Processes in DTBT -BCP

During the review of BCM, IAD observed the following exceptions;

A) The current Business Continuity Plan (BCP) does not include documented manual processes to ensure the continuation of critical operations during emergencies caused by technology defaults or failures. There are no well-documented and easily accessible manual processes, including step-by-step instructions for critical operations such as transaction processing, customer service, and compliance checks. For instance, during a core banking system downtime lasting more than a week, there should be an accessible and adequate backup of customer details and balance information to coordinate effective Business Continuity Management (BCM).

Manual Processes as a Backup: Despite the rapid advancements in banking technology, banks still maintain manual processes as a backup for when systems go down. This is part of their business continuity planning to ensure they can continue operations during technology outages.

B) Business Continuity Plan (BCP) and BCM policy do not include specific processes to address the loss of information that is not available from backup data. This gap poses a significant risk to the bank's ability to recover critical customer data and maintain operational continuity during extended system downtimes. BOT -BCP: 17 (V, VI) 
• (v) Processes to deal with the loss of information that are not available from backup data;
• VI) Manual processes for continuing operations until technology is repaired,
Cause Implication/Risk
Nonexistence of procedures to be followed in the event of a prolonged outage of the technology infrastructure. Risk Rating High
 Medium
 Low

 • Regulatory Non-Compliance: may result in penalties, increased regulatory scrutiny, or reputational damage to the organization.
• The absence of manual contingency processes could lead to significant disruptions in critical operations during technology failures, impacting service delivery and customer trust.
• Without predefined manual procedures, recovery efforts may be delayed, prolonging downtime and increasing financial and operational risks.
 Value/ Amount at Risk
 N/A

Recommendation Management Comment
• Update the DTBT BCP to include comprehensive manual processes for continuing critical operations during technology outages, in line with BOT regulatory requirements.
• Include specific processes to address the loss of information expected to be in backups and means of accessing them through data reconstruction, manual data entry, data recovery tools, redundant systems, regular audits, employee training, incident response plan, and legal and regulatory compliance. The existing BCM policy and procedures are sufficient to ensure business continuity and are tested annually. The recommendations provided by IAD are not practical in the current technological era and are not supported by industry practices; therefore, management does not recommend their implementation.

Regarding data recovery, the current solutions, including the primary data center, which replicates data to the secondary data center, along with daily tape backups, are sufficient to address the risk of data loss.