Document ID: chunk:federal_register_of_legislation:F2016L01431:body:0:p6
Version: federal_register_of_legislation:F2016L01431
Segment Type: other
Provision Reference: 
Character Range: 13933–17154

time for which the institution could not operate without each of its critical business operations;
(c)          the extent to which a disruption to the critical business operations might have a material impact on the interests of depositors and/or policyholders of the institution; and
(d)          the financial, legal, regulatory and reputational impact of a disruption to the institution's critical business operations over varying periods of time.

Recovery objectives and strategies
28.         Recovery objectives are pre-defined goals for recovering critical business operations to a specified level of service (recovery level) within a defined period (recovery time) following a disruption.
29.         An APRA-regulated institution must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size and complexity of the institution.

Business continuity planning
30.         An APRA-regulated institution must maintain at all times a documented BCP for the institution that meets the objectives of the institution's BCM policy.[6]
31.         The BCP must document procedures and information that enable the institution to:
(a)          manage an initial business disruption (crisis management); and
(b)          recover critical business operations.
32.         The BCP must reflect the specific requirements of the institution and must identify:
(a)          critical business operations;
(b)          recovery levels and time targets for each critical business operation;
(c)          recovery strategies for each critical business operation;
(d)          infrastructure and resources required to implement the BCP;
(e)          roles, responsibilities and authorities to act in relation to the BCP; and
(f)           communication plans with staff and external stakeholders.
33.         Where material business activities are outsourced, an APRA-regulated institution must satisfy itself as to the adequacy of the outsourced service provider's BCP and must consider any dependencies between the two BCPs.

Review and testing of the Business Continuity Plan
34.         An APRA-regulated institution must review and test the institution's BCP at least annually, or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives. The results of the testing must be formally reported to the Board or to delegated management.[7]
35.         The BCP must be updated if shortcomings are identified as a result of the review and testing required under paragraph 34.

Notification requirements
36.         An APRA-regulated institution must notify APRA as soon as possible and no later than 24 hours after the institution experiences a major disruption that has the potential to have a material impact on the institution's risk profile, or affect its financial soundness. The APRA-regulated institution must explain to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The APRA-regulated institution must notify APRA when normal operations resume.
37.         The information or notifications required by this