Prudential Standard APS 232 Business Continuity Management
EXPLANATORY STATEMENT
Issued by the authority of the Australian Prudential Regulation Authority (‘APRA’)
Banking Act 1959, section 11AF
Under section 11AF of the Banking Act 1959 (‘the Act’), APRA has the power to determine (in writing) standards in relation to prudential matters to be complied with by authorised deposit-taking institutions (‘ADIs’).
APRA has determined that this standard will come into effect from the date of registration on the Federal Register of Legislative Instruments.
Prudential Standard APS 232 Business Continuity Management
Effective business continuity management (‘BCM’) is an increasingly important component of the risk management framework of ADIs. The absence of appropriate BCM policies can lead to financial, legal, reputational and other material consequences for the ADI. Effective BCM increases resilience to disruptions and thereby assists in ensuring that ADIs can meet their financial and service obligations to depositors and other creditors.
The proposed new standard is intended to ensure that ADIs implement a whole of business approach to BCM appropriate to the nature and scale of the operations of the particular ADI. The standard will require an ADI to identify critical business functions, resources and infrastructure, address plausible disruption scenarios that could materially impact upon these, and develop, implement and maintain a Business Continuity Plan. The primary responsibility for BCM rests with the Board of Directors of the ADI or, in the case of a foreign branch, the senior officer outside Australia with delegated responsibility from the Board. The Board and senior management must consider the ADI’s business continuity risks and controls as part of its overall risk management framework.
A transitional period of 12 months will apply from when this standard takes effect. During this transitional period, all ADIs must report on their compliance with this standard and submit to APRA a plan and timeframe for rectifying areas of non-compliance.
The Office of Regulation Review has determined that a Regulation Impact Statement is required for the new standard. It has accordingly been prepared and is attached to this Explanatory Statement.
REGULATION IMPACT STATEMENT
This Regulation Impact Statement covers a proposal to determine a new Prudential Standard under section 11AF of the Banking Act 1959 (‘Banking Act’) on business continuity management (‘BCM’) that would apply to all authorised deposit-taking institutions (‘ADIs’). It is also proposed to determine a BCM prudential standard for general insurers at the same time, and one for life companies at a later stage. Both of these proposed prudential standards will be subject to their own Regulation Impact Statement.
Background
The Australian Prudential Regulation Authority (‘APRA’) was created out of the Government’s financial sector reforms that were implemented as a result of the Financial System Inquiry in 1997. APRA is primarily responsible for the safety and soundness of prudentially regulated financial sector institutions, including ADIs, general insurers, life companies, and superannuation funds. Each sector is subject to prudential requirements as set out in the industry Acts and the prudential standards, regulations and rules made under these Acts.[1] These industry-specific prudential regimes promote financial soundness, stability and appropriate risk management across APRA-regulated institutions.
Losses from disruptions to business discontinuity caused by internal or external events (including terrorism, computer crime and natural disasters) forms a core component of operational risk, a diverse range of risks that the Bank for International Settlements has defined as ‘the risk of loss resulting from inadequate or failed internal processes, people and systems from external events’.[2] BCM seeks to increase an ADI’s resilience to such business disruptions and reduce the impact on its business operations, reputation or profitability as well as ensuring it can meet its financial and service obligations to depositors and other creditors.
Problem identification
As business operations have become increasingly complex and vulnerable to disruption from external events, effective BCM has become an essential component of an ADI’s risk management framework. Both in Australia and internationally, there is a specialist industry providing information and support services to assist companies on BCM issues. Despite this, it has become evident to APRA that not all ADIs are developing and incorporating appropriate BCM practices into their risk management strategies. As ADIs may incur substantial losses and even fail as a result of not being able to recover from business disruptions and continue operations in a timely manner, APRA has identified current BCM practices as an area of the prudential framework requiring improvement. Examples of deficiencies found by APRA in the current BCM practices of ADIs include:
- instances where BCM is not included in an ADI’s risk management framework, leading to weaknesses in the oversight, reporting and monitoring processes of the Board of Directors (‘the Board’) and senior management;
- deficiencies in the BCM practices of ADIs, including incomplete risk assessments, business impact analyses and recovery strategies, poorly documented and out of date business continuity plans, and inadequate and incomplete testing programs. Individually or in combination, these increase the risk of significant disruption and/or loss to an ADI; and
- instances where an ADI’s BCM approaches are out of date as a result of not being subjected to regular internal review. For example, while much business continuity preparation for the Year 2000 date changeover was undertaken, little ongoing development or maintenance of business continuity plans has been done since. This is of concern, for while significant business disruptions in Australia have been rare to date, the business continuity risks, particularly from external threats (e.g. computer crime, terrorism, SARS), are ever changing and increasing. This highlights the need for ADIs to continually develop and regularly review their BCM approaches.
While it is difficult to quantity either the risks posed to ADIs by inadequate BCM given the low frequency of significant events,[3] the potential impact upon customers more generally from business disruption can be garnered from the following examples:
- of the 350 companies affected by the World Trade Center blast, 180 have ceased trading;
- 80 per cent of all firms suffering a major disaster cease business within 13 months; and
- businesses can be destroyed by the loss of a critical resource for more than 10 days.
Given the central position of ADIs in the payments system, there are also systemic risks to the financial system in the event of institutional failure by larger ADIs which BCM requirements can assist in reducing. This systemic risk is a key rationale for regulatory oversight of this sector above and beyond the market failure of asymmetric information which underpins the case for prudential supervision of other financial sectors such as insurance and superannuation.
Finally, Australia’s prudential framework is currently not fully compliant with the operational risk requirements contained in the international core principles that form the international standards on prudential regulation. The Core Principles for Effective Banking Supervision (issued by the Basel Committee on Banking Supervision in October 1999) specify, among other things, that banking supervisors should as part of their ongoing supervision of ADIs, determine that the risk-management of banks include ‘sound business-resumption plans’. In recent years, many offshore prudential regulators have introduced comprehensive guidance material and/or regulations relating to BCM.
While there is no compulsion to be compliant with every aspect of these international standards, these core principles provide an internationally accepted benchmark of minimum supervisory standards against which the quality of a country’s prudential supervision system can be measured and assessed.
Objective
Given the identified problems, it is proposed BCM requirements be applied to ADIs.
As part of the general objective of prudential supervision to reduce the risk of financial loss to depositors, the primary objectives of imposing BCM requirements on ADIs are to:
- reduce the impact of material disruptions on an ADI’s business operations, reputation or profitability caused by internal and external events;
- increase the protection provided to depositors through effective risk monitoring and control;
- promote confidence and stability in the financial system; and
- ensure Australia’s regulatory framework meets international core principles on prudential regulation.
Identification of options
Option 1 – Introduce a new prudential standard on BCM
Under this option, APRA would introduce a new prudential standard on BCM applying to ADIs. Because of the very different issues raised by BCM for individual ADIs (varying with the size and complexity of the business undertaken), the prudential standard would not be prescriptive at a detailed level, but rather set higher level statutory requirements. Its aim would be to ensure that the Board and senior management of an ADI have thought through the business continuity risks facing the ADI and are satisfied it has adequate risk management systems for identifying, monitoring and managing these risks.
Responsibility for business continuity would still rest primarily with the Board of a ADI, or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board. BCM requirements would also be tailored to the nature and scale of the ADI’s operations.
It is proposed the prudential standard would include the following key requirements:
- the Board and senior management of the ADI must consider the ADI’s business continuity risks and controls as part of its overall risk management framework when completing the risk management declaration provided to APRA on an annual basis;[4]
- each ADI must identify, on a whole of business basis, critical business functions, resources and infrastructure that would have a material impact if subject to disruption;
- each ADI must assess the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure, and have in place appropriate recovery strategies to ensure that all necessary resources are readily available to withstand the impact of the disruption;
- each ADI must develop, implement and maintain a Business Continuity Plan (BCP) that documents procedures and information which enable the ADI to respond to disruptions and recover critical business functions. The BCP must be reviewed at least annually by responsible senior management and periodically reviewed through the ADI’s internal audit function or an external expert; and
- an ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors.
A transition period of 12 months would apply from the time the prudential standard is determined. During this transitional period, all ADIs would be required to assess their compliance with the BCM requirements in the prudential standard in their annual risk management declaration and have submitted to APRA a plan and timeframe (which may be longer than the 12 month transition period) for rectifying areas of non-compliance.
Option 2 – No prudential standard on BCM is introduced
This option would mean that no new prudential requirements on BCM would be applied to ADIs.
Impact analysis
Impact group identification
The two options identified above would impact upon the following three groups: APRA, ADIs, and depositors.
Assessment of costs and benefits
Option 1 – Introduce a new prudential standard imposing BCM requirements
APRA
Benefits
The introduction of new requirements covering BCM would strengthen APRA’s prudential oversight of ADIs, significantly reducing the risks (including financial, operational and reputational) posed by disruptions to business continuity.
By placing BCM requirements into a prudential standard, which can be amended as necessary (after public consultation), APRA can ensure the requirements remain relevant to industry and reflect sound practice in this area. This would also provide the basis for more appropriate and targeted supervision.
Further, APRA requirements for BCM would ensure compliance with international standards of best practice in prudential regulation. Aside from the benefits of drawing on this pooled knowledge, compliance ensures Australia’s regulatory framework continues to meet international requirements.
Costs
The introduction of a BCM prudential standard requires the development of a new BCM framework. APRA would also incur associated one-off costs, including public consultation about the proposals and training staff on the new requirements. APRA would also incur ongoing costs in monitoring compliance with the proposed requirements, although these would be mitigated by utilising existing operational risk requirements as a platform on which to add supplementary BCM requirements.
While it is difficult to quantify the additional costs for APRA associated with this option, APRA would not expect these to be significant. The extra supervision required as a result of implementing a new BCM prudential standard, as well as the additional collection of information and ongoing compliance monitoring, could be largely accommodated by APRA’s existing systems and supervisory processes.
ADIs
Benefits
A sound approach to BCM increases the resilience of ADIs to business disruptions arising from internal and external events and reduces the impact on the ADI’s business operations, reputation or profitability (benefiting both the customers and shareholders of ADIs). This leads to the additional benefit of improving the overall stability of the financial system.
ADIs would also benefit from a prudential framework that APRA considers current good practice with respect to BCM requirements and governance more generally. APRA is in the unique position of reviewing all operational risk areas across the regulated financial sector (largely undertaken by a specialist consulting unit within APRA dedicated to Operational Risk), allowing APRA to provide advice and guidance on the basis of this experience.
Costs
Because Option 1 proposes a qualitative standard (i.e. it is primarily about risk management practices) that provides for flexibility at operational practice level based on the size and complexity of the ADI, it is impossible to quantify the costs of these requirements. APRA is of the view that the proposed prudential standard largely formalises arrangements that are already common practice within the financial sector, at least for well run ADIs that would already have in place BCM arrangements as part of their operational risks systems. Furthermore, the application of these requirements would be commensurate to the nature and scale of an ADI’s operations. This will avoid excessive compliance costs being imposed upon smaller and/or lower risk ADIs. ADIs would incur some ongoing maintenance costs, including costs of reporting to APRA in regard to their ongoing compliance with the requirements.
For ADIs currently below sound BCM practice, there is the potential for transitional compliance costs as resourcing is directed toward establishing a sound BCM strategy and implementing the underlying components (e.g. testing). These costs are not readily quantifiable, and would vary based on the size and complexity of each ADI. As already mentioned, the prudential standard seeks to avoid detailed prescriptive requirements. It is not a ‘one size fits all’ approach, although it does insist that all ADIs must think through these risks and establish adequate risk management systems to monitor and manage these risks. Some ADIs will have very complex ‘state of the art’ systems, while others may have very simple systems.
Depositors
Benefits
Depositors would benefit from the new prudential framework as BCM requirements should serve to strengthen the overall ability of ADIs to respond effectively to disruptions to business continuity arising from various internal and external events. While it is difficult to quantity these benefits given the often low frequency of events, experience has shown that business disruption can have significant impacts for customers.
Another benefit for depositors is reducing the possibility that they may be made to pay for losses incurred from disruptions to business continuity either through increased fees, or else by reduced service levels.
Costs
Depositors may be adversely affected if new BCM requirements were to lead to additional costs passed on as increased fees, although this seems unlikely given the compliance costs for the new requirements are not expected to be material relative to the overall operating costs of individual ADIs.
Option 2 – No prudential standard on BCM is introduced
APRA
Benefits
The main benefit for APRA in leaving the current regulatory framework unchanged would be the avoidance of costs that would be incurred in developing and administering new BCM requirements.
Costs
There would be no direct costs to APRA under this option as there would be no change to the existing framework. Intangible costs, however, would result because APRA would be unable to satisfy itself that ADIs have sufficiently addressed the material risks to business continuity arising from various internal and external events. This undermines the effectiveness of APRA’s operational risk prudential framework, jeopardising the position of depositors as well as the ADIs themselves. Serious events could also impact on the overall stability of the financial system if key ADIs were seriously impacted (for example through contagion effects).
ADIs
Benefits
Under this option, ADIs would face no additional costs as they would not have to meet any new BCP requirements, or enhance current procedures that might already be in place.
Costs
ADIs may incur substantial costs, whether to their business operations, reputation and/or profitability, if their current BCM policies and procedures result in an inadequate response and inability to maintain business continuity in the event of a major disruption.
Depositors
Benefits
The benefits to depositors under this option would be unchanged from the present. Since ADIs would not be required to comply with additional prudential requirements, no extra costs would be incurred that could potentially be passed onto depositors through increased fees.
Costs
Retaining the status quo would involve intangible costs for depositors in that the potential for improvement in the overall quality of risk management in ADIs would not be realised. Depositors could potentially be made to pay for losses incurred from disruptions to business continuity either through increased fees, or else by reduced service levels.
Consultation
Consultation on Option 1 took place from July 2004 to the end of September 2004 as submissions were invited from the public on a draft BCM prudential standard. A draft of the prudential standard was placed on APRA’s website and a media statement released announcing the public release of the document. As APRA proposes to apply, over the longer term, BCM requirements to general insurers and life companies as well as ADIs, submissions were invited from all three industries.
The majority of submissions were supportive of the draft prudential standard in principle, particularly those from the ADI sector. Some respondents in the general insurance sector felt the draft standard overly prescriptive. Specific concerns (and APRA’s response in brackets) included:
- the need for detailed procedures for the ‘return to normal’ phase in the BCP (APRA deems this phase no less important phase of business continuity planning);
- assigning operational responsibility to the Board (the prudential standard already allows the Board to delegate operational responsibility);
- certain requirements may require contractual changes in outsourcing agreements that will be difficult to renegotiate (the requirements are consistent with existing outsourcing requirements already contained in Prudential Standard APS 231 Outsourcing);
- that APRA would require a fully integrated test of the BCP (the requirement is only for an annual program of testing of the BCP, although this may include a fully integrated test. In practice an ADI would test selected critical areas which would vary each year); and
- uncertainty over whether compliance would be required immediately (ADIs have 12 months in which to report on their compliance and provide to APRA a plan and timeframe for rectifying areas of non-compliance transitional period).
Aside from one submission which talked of regulation costs in general, no concerns were raised over the compliance costs of the proposed BCM requirements.
APRA clarified certain aspects of the requirements in response to these and more minor concerns, as well as accepting a number of suggested changes to the draft prudential standard. However, no substantive changes have been made to the key requirements contained in the draft prudential standard as a result of consultation.
Conclusion and recommended option
Option 1 is the preferred option
Option 1 provides an enhanced framework for managing the risks from disruptions to business continuity caused by various internal or external events, such as acts of terrorism or IT failures. Recent experiences have raised awareness of the seriousness of these risks and highlighted the need for effective BCM practices. Australia’s prudential regulatory framework for ADIs is clearly deficient in this regard. This option provides a transparent benchmark against which ADI’s can assess their risk management procedures, with the proposed prudential standard outlining the minimum BCM requirements that APRA expects ADIs to meet. This will help to promote confidence in the ADI sector and increase protection for depositors. Prudential standards are supported by a legislative framework that enables APRA to issue a direction for non-compliance with these requirements, and further enforcement actions if an ADI fails to comply with the direction.
This option is likely to involve some additional costs for APRA and ADIs, although the use of existing supervisory platforms should mitigate these costs for APRA, while most well run ADIs should have no trouble in meeting the requirements of the prudential standard given they formalise current market best practice. The additional costs incurred by ADIs are unlikely to be of a magnitude that impacts on depositors. Overall, the benefits accruing from BCM requirements are expected to far outweigh any associated costs.
Option 2 fails to meet the desired objectives or address the identified problem. By imposing no statutory BCM framework for ADIs, this option would make APRA’s supervisory task more difficult, and would not afford adequate protection to depositors. The status quo is not a reflection of best practice risk management, whether as practised within financial markets themselves, or through internationally recognised core principles of prudential regulation.
Implementation and review
It is proposed that APRA determine a new prudential standard under section 11AF of the Banking Act to be called Prudential Standard APS 232 Business Continuity Management.
The Prudential Standard would come into immediate effect. Over a 12 month transitional period, ADIs would report on compliance with the Prudential Standard in their next annual risk management declaration (already required for ADIs under existing prudential requirements). Details of any areas of non-compliance would be reported to APRA, along with a plan and timeframe for their rectification.
There has been no discussion to date in regard to the ongoing review of the proposed BCM prudential standard, although APRA monitors on an ongoing basis the effectiveness of all prudential standards determined under the industry Acts.
[1] The industry Acts are comprised of the Banking Act 1959, the Insurance Act 1973, the Life Insurance Act 1995 and the Superannuation Industry (Supervision) Act 1993 (although the latter Act does not provide for the determination of prudential standards).
[2] Basel Committee on Banking Supervision (February 2003), Sound practices for the management and supervision of operational risk, Bank for International Settlements, Basel.
[3] Although evidence suggests a significant proportion of companies will suffer major disruption through fire, flood, storm, power failures, terrorism, or hardware/software failures over a five year period.
[4] Prudential Standard APS 310 Auditing and Related Arrangements for Prudential Reporting requires the Board and senior management of all ADIs to complete and provide to APRA on an annual basis a risk management declaration which details the risk management systems of the ADI.