Document ID: chunk:federal_register_of_legislation:F2016L01431:body:0:p5
Version: federal_register_of_legislation:F2016L01431
Segment Type: other
Provision Reference: 
Character Range: 11063–14197

group must ensure that those business operations are undertaken in a way that complies with the group BCM policy.

The role of the Board and senior management
17.         An APRA-regulated institution must identify, assess, manage, mitigate and report on potential business continuity risks to ensure that the institution is able to meet its financial and service obligations to its depositors, policyholders and other stakeholders.
18.         The Board is ultimately responsible for the business continuity of the institution. The Board remains ultimately responsible for BCM of the institution whether or not business operations are outsourced or are part of a corporate group.[4]
19.         The Board must ensure that the business continuity risks and controls are taken into account as part of the institution's risk management strategy and when completing a risk management declaration required to be provided to APRA.[5]

Business continuity management
20.         BCM is a whole-of-business approach that includes policies, standards and procedures for ensuring that critical business operations can be maintained or recovered in a timely fashion, in the event of a disruption. Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.
21.         Critical business operations are the business functions, resources and infrastructure that may, if disrupted, have a material impact on the institution's business functions, reputation, profitability, depositors and/or policyholders.
22.         BCM must, at a minimum, include:
(a)          a BCM policy in accordance with paragraphs 23 to 25;
(b)          a business impact analysis (BIA) including risk assessment in accordance with paragraphs 26 and 27;
(c)          recovery objectives and strategies; in accordance with paragraphs 28 and 29;
(d)          a BCP in accordance with paragraphs 30 to 33; and
(e)          programs for:
(i)            review and testing of the BCP in accordance with paragraphs 34 and 35; and
(ii)         training and ensuring awareness of staff in relation to BCM.

Business continuity management policy
23.         The Board must approve the institution's BCM policy.
24.         The BCM policy must be up-to-date, documented and must set out the objectives and approach in relation to BCM.
25.         The BCM policy must clearly state the roles, responsibilities and authorities to act in relation to the BCM policy.

Business impact analysis
26.         A BIA involves identifying all critical business functions, resources and infrastructure of the institution and assessing the impact of a disruption on these.
27.         When conducting the BIA, the APRA-regulated institution must consider:
(a)          plausible disruption scenarios over varying periods of time;
(b)          the period of time for which the institution could not operate without each of its critical business operations;
(c)          the extent to which a disruption to the critical business operations might have a material impact on the interests of depositors and/or policyholders of