APEX Group also has in place business resilience measures where the Business Continuity Management strategies, policies and procedures ensure continuity of critical operations in the event of major disruptions. The Technology Risk Management Framework addresses technology related risks by establishing and enforcing policies, processes and controls for the areas as follows: (i) IT security policies covering risk management in network security, anti-virus, patch management, accounts, privilege and passwords controls, cryptography standards, business and office terminal access controls, data centre security controls, refresh and disposal of storage media, etc. (ii) Service management policies and procedures covering change management, incident management, problem management, disaster recovery and contingency plans to ensure the quality and high availability of APEX Group’s services. (iii) IT project management framework to manage the risks in IT project life cycle covering project initializing, planning, executing, controlling and closing phases. (iv) Data Classification and Handling Guidelines covering proper classification and protection of confidential/highly sensitive data.
17.2	An FMI’s board of directors should clearly define the roles and responsibilities for addressing operational risk and should endorse the FMI’s operational risk-management framework. Systems, operational policies, procedures, and controls should be reviewed, audited, and tested periodically and after significant changes.
The Risk Management Committee (RMC) is a board level committee independent from the management and business relationships with APEX Group. It is comprised of the board of directors and is responsible to the board for the following: (i) independent oversight and guidance to APEX Group’s risk management frameworks; (ii) review, recommend, or approve the types and levels of risk that APEX Group undertake to achieve its business objectives, including operational risks; (iii) review, recommend or approve effective risk management frameworks, policies, systems, resources and risk limits that are consistent with APEX Group’s key risks and risk appetite. APEX Group’s risk management frameworks, policies and procedures, systems and controls are subjected to at least annual review or whenever there are material changes. They will also be subjected to internal audits based on the approved audit mandates and plans as well as regular external audits and regulatory inspections. APEX Clear also conducts regular testing of its clearing systems with its members for the purpose of testing new system connectivity as well as to test the resiliency of its systems, staff availability, operational processes in the event of technological and/or operational disruptions. APEX Clear has set up segregated development, simulation and production environments. Major changes to production, such as launching of new systems or services, upgrades of existing system feature or components, must first be deployed at the development environment for internal or third party testing. It is then followed by deployment to the simulation environment for testing by market participants for a stipulated period, which depends on the complexity of the changes. Only after the changes pass all required tests and stabilize in the simulation environment, the changes will be implemented to the production environment. A roll-back plan shall always be in place for rolling back the changes when it is necessary.