Document ID: chunk:federal_register_of_legislation:F2012L02224:body:0:p4
Version: federal_register_of_legislation:F2012L02224
Segment Type: other
Provision Reference: 
Character Range: 8708–11816

the size, business mix and complexity of the RSE licensee's business operations.

Business continuity planning
    21.         An RSE licensee must maintain at all times a documented BCP that meets the objectives of the BCM Policy.[7]

    22.         An RSE licensee's BCP must document procedures and information that enable the RSE licensee to:

       (a)          manage an initial business disruption (crisis management); and

       (b)          recover critical business activities.

    23.         An RSE licensee's BCP must reflect the specific requirements of the RSE licensee and must identify:

       (a)          critical business activities;

       (b)          recovery levels and recovery times for each critical business activity;

       (c)          recovery strategies for each critical business activity;

       (d)          infrastructure and resources required to implement the BCP;

       (e)          roles, responsibilities and authorities to act in relation to the BCP; and

       (f)           communication plans with staff and external stakeholders.

    24.         Where material business activities are outsourced, an RSE licensee must satisfy itself as to the adequacy of the outsourced service provider's BCP and must consider any dependencies between the two BCPs.

Review and testing of the BCP
    25.         An RSE licensee must review and test its BCP at least annually, or more frequently if there are material changes to its business operations, to ensure that the BCP can meet the BCM objectives. The results of the testing must be formally reported to the Board or to delegated management.[8]

    26.         The BCP must be updated if shortcomings are identified as a result of the review and testing required under paragraph 25.

    27.         Where material business activities are outsourced, an RSE licensee must satisfy itself that the outsourced service provider adequately reviews and tests its BCP at least annually, or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives of the RSE licensee. The results of the testing, including any change to the service provider's BCP, must be formally reported to the RSE licensee by the outsourced service provider as soon as practicable.

Notification requirements
    28.         An RSE licensee must notify APRA as soon as possible, and no later than 24 hours, after experiencing a major disruption that has the potential to have a material impact on the interests, or reasonable expectations, of beneficiaries or the financial position of the RSE licensee, any of its RSEs or connected entities.[9] The RSE licensee must explain to APRA the nature of the disruption, the action being taken, the likely effect and the timeframe for returning to normal operations. The RSE licensee must notify APRA when normal operations resume.

    29.         The information or notifications required by this Prudential Standard must be given in such form, if any, and by such procedures, if any, as APRA determines and publishes