Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p8
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 20807–23958

a communications strategy to support execution of the plan.
41.         An APRA-regulated entity must maintain the capabilities required to execute the BCP, including access to people, resources and technology.[13] An APRA-regulated entity must monitor compliance with its tolerance levels and report any failure to meet tolerance levels, together with a remediation plan, to the Board.
42.         An APRA-regulated entity must notify APRA as soon as possible, and not later than 24 hours after, if it has suffered a disruption to a critical operation  outside tolerance. The notification must cover the nature of the disruption, the action taken, the likely impact on the entity's business operations and the timeframe for returning to normal operations.

Testing and review
43.         An APRA-regulated entity must have a systematic testing program for its BCP that covers all critical operations and includes an annual business continuity exercise. The program must test the effectiveness of the entity's BCP and its ability to meet tolerance levels in a range of severe but plausible scenarios.
44.         The testing program must be tailored to the material risks of the APRA-regulated entity and include a range of severe but plausible scenarios, including disruptions to services provided by material service providers and scenarios where contingency arrangements are required. APRA may require the inclusion of an APRA-determined scenario in a business continuity exercise for an APRA-regulated entity, or a class of APRA-regulated entities.
45.         An APRA-regulated entity must update, as necessary, its BCP on an annual basis to reflect any changes in legal or organisational structure, business mix, strategy or risk profile or for shortcomings identified as a result of the review and testing of the BCP.
46.         An APRA-regulated entity's internal audit function must periodically review the entity's BCP and provide assurance to the Board that the BCP sets out a credible plan for how the entity would maintain its critical operations within tolerance levels through severe disruptions and that testing procedures are adequate and have been conducted satisfactorily.

Management of service provider arrangements
47.         An APRA-regulated entity must maintain a comprehensive service provider management policy. The policy must cover how the entity will identify material service providers and manage service provider arrangements, including the management of material risks associated with the arrangements.
48.         The policy must include:
       (a)          the entity's approach to entering into, monitoring, substituting and exiting agreements with material service providers;
       (b)          the entity's approach to managing the risks associated with material service providers; and
       (c)          the entity's approach to managing the risks associated with any fourth parties that material service providers rely on to deliver a critical operation to the APRA-regulated entity.[14]

Material service providers
49.         An APRA-regulated entity must identify and maintain a register of its material