Document ID: chunk:federal_register_of_legislation:F2016L01431:body:0:p7
Version: federal_register_of_legislation:F2016L01431
Segment Type: other
Provision Reference: 
Character Range: 16880–19902

to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The APRA-regulated institution must notify APRA when normal operations resume.
37.         The information or notifications required by this Prudential Standard must be given in such form, if any, and by such procedures, if any, as APRA determines and publishes on its website from time to time.

Audit arrangements
38.         An institution's internal audit function, or an appropriate external expert, must periodically review the BCP and provide an assurance to the Board or to delegated management that:
(a)          the BCP is in accordance with the institution's BCM policy and addresses the risks it is designed to control; and
(b)          testing procedures are adequate and have been conducted satisfactorily.
39.         APRA may request the external auditor of the institution, or another appropriate external expert, to provide an assessment of the institution's BCM arrangements. Any such report must be paid for by the institution and must be made available to APRA.[8]

Adjustments and exclusions
40.         APRA may adjust or exclude a specific requirement in this Prudential Standard in relation to an APRA-regulated institution.[9]

Determinations made under previous prudential standards
41.         An exercise of APRA's discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard. For the purposes of this paragraph, 'a previous version of this Prudential Standard' includes any versions of:
(a)          Prudential Standard APS 232 Business Continuity Management (including Guidance Note AGN 232.1 Risk Assessment and Business Continuity Management);
(b)          Prudential Standard GPS 222 Business Continuity Management (including Guidance Note GGN 222.1 Risk Assessment and Business Continuity Management);
(c)          Prudential Standard LPS 232 Business Continuity Management; and
(d)          Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221), to the extent that GPS 221 related to business continuity management.
[1] Note, for the purposes of this Prudential Standard, an RSE licensee is not treated as an 'APRA-regulated institution'. Refer to Prudential Standard SPS 232 Business Continuity Management (SPS 232) for requirements relating to business continuity management for an RSE licensee.
[2] Where a Level 2 group operates within a Level 3 group, a requirement expressed as applying to a Head of a group is to be read as applying to the Level 3 Head.
[3] A reference to the Board in the case of a foreign ADI is a reference to the senior officer outside Australia.
[4] Refer to Prudential Standard CPS 231 Outsourcing (CPS 231) for further information on requirements relating to outsourcing.
[5] For details of the risk management