As the late 2000s Financial Crisis demonstrated, risk in just one financial institution can spill over, endangering the viability of the sector (and the wider economy) at large. That’s why since then, financial regulators have imposed tough measures on the entities they oversee.
But these common-sense measures aren’t just applicable to financial institutions; all organisations, irrespective of industry, should consider taking them up. What are some examples to consider?
Business Continuity Management standards in the financial sector
The Australian Prudential Regulation Authority (APRA) supervises financial and related institutions across the banking, insurance, and superannuation sectors. Its mandate includes maintaining the safety and soundness of the financial industry. And as a result, APRA is obliged to maintain a low incidence of failure among the entities it regulates.
Business continuity falls under this rubric. For this reason, APRA released Prudential Standard CPS 232 Business Continuity Management. What does it say?
For starters, the standard lays out the purpose of business continuity, which is to minimise the financial, legal, regulatory, reputational, and other material consequences arising from a disruption to critical business operations.
Critical business operations are those business functions, resources, and infrastructure that may, if disrupted, have a material impact on an organisation’s business functions, reputation, profitability, depositors, and/or policyholders.
According to the standard, the components of business continuity management (BCM) that help to ensure that these critical business operations can be maintained or recovered in a timely fashion in the event of a disruption include the following:
- BCM policy
- Business impact analysis (BIA) including risk assessment
- Recovery objectives and strategies
- Business continuity plan (BCP)
- Programs for review and testing of the BCP and training and ensuring awareness of staff in relation to BCM
Who’s in charge of executing Business Continuity Management standards?
That’s all well in good. But who’s in charge of making this all happen. The benefit of business continuity management standards like CPS 232 (and sector-agnostic standards like ISO 22301) is that they stipulate who should be responsible for getting the BCM program up and running and ensuring major organisational priorities get done.
In the case of CPS 232, specifically, Board members must see to it that their institutions comply. The requirements for which those Board members are on the hook include:
- Maintain a business continuity management policy for the institution or group that is approved by the Board
- Identify, assess, and manage potential business continuity risks to ensure that the institution can meet its financial and service obligations to its depositors, policyholders, and other stakeholders
- Consider business continuity risks and controls as part of its risk management framework
- Maintain a business continuity plan documenting procedures and information that enables the institution to manage business disruptions
- Review the business continuity plan annually and periodically arrange for its review by the internal audit function or an appropriate external expert
- Notify APRA in the event of certain disruptions
Timely notification requirements included in Business Continuity Management standards
Though a sectoral standard, CPS 232 lays out requirements that can be applied broadly. For instance, its timely notification requirements aren’t that dissimilar to what one sees in other major industries.
A regulated institution must notify APRA as soon as possible and no later than 24 hours after it experiences a disruption that has the potential to have a material impact on the institution’s risk profile or affect its financial soundness.
What’s more, that entity must also explain to APRA the nature of the disruption, the action being taken, its likely effect, and the timeframe for returning to normal operations.
If your industry regulator doesn’t currently compel you to notify them expeditiously after a disruption (of whatever kind), it’s likely they will soon. As crises increase in kind, cost, and severity, most regulators are stepping up.
Having the capability to address these kinds of requirements, which often means procuring business continuity platform, should be an organisational priority. To get you on the road, read up on some of the similarities between CPS 232 and ISO 22301 in our Guide to Understanding CPS 232:
.svg)
.svg)
.svg)