Document ID: chunk:federal_register_of_legislation:F2012L02224:body:0:p3
Version: federal_register_of_legislation:F2012L02224
Segment Type: other
Provision Reference: 
Character Range: 5674–8983

provided to APRA.[6]

Business continuity management
    12.         BCM is a whole-of-business approach that includes policies, standards and procedures for ensuring that critical business activities can be maintained or recovered in a timely fashion, in the event of a disruption. Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.

    13.         'Critical business activities' are the business functions, resources and infrastructure that may, if disrupted, have a material impact on the interests, or reasonable expectations, of beneficiaries or the financial position of the RSE licensee, any of its RSEs or connected entities.

    14.         An RSE licensee's BCM must, at a minimum, include:

       (a)          a BCM Policy in accordance with paragraphs 15 and 16;

       (b)          a business impact analysis (BIA) including risk assessment in accordance with paragraphs 17 and 18;

       (c)          recovery objectives and strategies in accordance with paragraphs 19 and 20;

       (d)          a business continuity plan (BCP) including crisis management and recovery in accordance with paragraphs 21 to 24 inclusive; and

       (e)          programs for:

           (i)            review and testing of the BCP in accordance with paragraph 25; and

           (ii)         training and ensuring awareness of staff in relation to BCM.

Business Continuity Management Policy
    15.         An RSE licensee must have an up-to-date and documented Business Continuity Management Policy (BCM Policy) that is approved by the Board.

    16.         An RSE licensee's BCM Policy must clearly state the roles, responsibilities and authorities to act in relation to the BCM Policy.

Business impact analysis
    17.         A BIA involves identifying all critical business activities of an RSE licensee and assessing the impact of a disruption on these.

    18.         When conducting the BIA, an RSE licensee must consider:

       (a)          plausible disruption scenarios over varying periods of time;

       (b)          the period of time for which the RSE licensee could not operate without each of its critical business activities;

       (c)          the extent to which a disruption to the critical business activities might have a material impact on the interests, or reasonable expectations, of beneficiaries; and

       (d)          the financial, legal, regulatory and reputational impact of a disruption to an RSE licensee's critical business activities over varying periods of time.

Recovery objectives and strategies
    19.         Recovery objectives are pre-defined goals for recovering critical business activities to a specified level of service (recovery level) within a defined period (recovery time), following a disruption.

    20.         An RSE licensee must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size, business mix and complexity of the RSE licensee's business operations.

Business continuity planning
    21.         An RSE licensee must maintain at all times a documented BCP that meets the objectives of the BCM Policy.[7]

    22.         An RSE licensee's BCP