Document ID: chunk:federal_register_of_legislation:F2016L01431:body:0:p4
Version: federal_register_of_legislation:F2016L01431
Segment Type: other
Provision Reference: 
Character Range: 8617–11327

exercise a power or discretion, this power or discretion is to be exercised in writing.
10.         For the purposes of this Prudential Standard:
'group' means a Level 2 group or a Level 3 group, as relevant;
'Head of a group' means a Level 2 Head or Level 3 Head, as relevant;
'Level 2 group' means the entities that comprise:
(a)          Level 2 as defined in APS 001; or
(b)          a Level 2 insurance group as defined in GPS 001;
'Level 2 Head' means:
(a)          where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;
(b)          where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or
(c)          the parent entity of a Level 2 insurance group as defined in GPS 001.

Additional requirements of the Head of a group
11.         The Head of a group must maintain business continuity management (BCM) for the group (see paragraphs 20 to 22) including a BCM policy for the group (see paragraphs 23 to 25).
12.         The Head of a group must apply BCM to risk assessments and risk processes at a functional level in the group, where appropriate.
13.         The Board of the Head of a group must:
(a)          ensure that the group's BCM is appropriate to the nature and scale of its operations and is consistent with the group's risk management strategy and  risk management framework;
(b)          oversee the appropriateness of BCM across the group; and
(c)          ensure that the group's business continuity plan (BCP) is reviewed at least annually by responsible senior management of the Head of the group.
14.         The Head of a group must notify APRA in accordance with paragraph 36 if the institution experiences a major disruption that has the potential to have a material impact on the institution's risk profile, or affect its financial soundness, except where an APRA-regulated institution within the group has otherwise notified APRA of that information.
15.         The group internal audit function, or an appropriate external expert, must periodically review the group BCP and provide an assurance to the Board of the Head of the group, or delegated management, on the matters in paragraph 38 on a group basis.
16.         Where an institution within the group that is not an APRA-regulated institution undertakes business operations critical to the group, the Head of the group must ensure that those business operations are undertaken in a way that complies with the group BCM policy.

The role of the Board and senior management
17.         An APRA-regulated institution must identify, assess, manage, mitigate and report on potential