Prudential Guideline No. 10 on Business Continuity Management

CENTRAL BANK OF SOLOMON ISLANDS
Financial Market Supervision Department

Prudential Guideline No. 10
On Business Continuity Management

Applicability

The Prudential Guideline is applicable to financial institutions licensed and deemed licensed by the Central Bank of Solomon Islands (CBSI).

Purpose of Prudential Guideline

The Prudential Guideline aims to provide Financial Institutions (FI) with a minimum framework for Business Continuity Management (BCM), to ensure that Critical Business operations can be maintained or recovered in a timely fashion through the period of disruption caused by disaster events.
The Prudential Guideline also aims to ensure that each FI implements a whole-of-business approach to Business Continuity Management, relative, and appropriate to the nature and scale of its operations. BCM increases resilience to Business Disruption arising from internal and external events and may reduce the impact on the FI’s operations, reputation, profitability, depositors, and other stakeholders.
The key requirements include:
a. Board and Proxy Board-approved and documented BCM Policy that sets out its objectives and approaches in relation to BCM; b. Business Continuity Plan (BCP) that documents procedures and information which enable FIs to manage business disruption in accordance with the BCM policy;
c. Review and test the BCP on an annual basis or more frequently as required as well as periodic review by the internal audit function or an external expert; and
d. Notify CBSI in the event of certain disruptions and provide certain reports.

Definition

As used in this Prudential Guideline the following terms, unless otherwise clearly indicated by the context, have the meanings specified below.

“Business Continuity Management (BCM)” – means the development, implementation, and maintenance of strategies, plans, resources, and actions to ensure specific operations can be maintained or recovered in a timely fashion in the event of a significant, untoward, crisis event.

“Business Continuity Planning (BCP)” – means a financial institution’s risk management strategy for threats that may terminate or significantly disrupt core business. It involves mitigation activities and contingency planning for response and recovery actions. BCP necessarily embraces disaster recovery planning.

“Critical Business” – means business functions, resources, and infrastructure that may, if disrupted, have a material impact on the financial institution’s business functions, operations, reputation, profitability, depositors and other stakeholders.

“Country Head”– means a Chief Executive Officer, a Country Manager, a General Manager, or any similar designation accorded to an officer who heads the branch or a subsidiary of a foreign incorporated financial institution in Solomon Islands.

“Event” – means occurrence of a particular set of circumstances that creates an actual or potential emergency or disaster or other crisis situation.

“Business Impact Analysis (BIA)” – means the process of analyzing business functions and the effect that a business disruption might have upon them.

“Business Disruption” – means an event that interrupts normal business, functions, operations, or processes, whether anticipated or unanticipated.

“Risk Assessment” – means a formal but often subjective process of risk identification, risk analysis, and risk evaluation.

“Recovery Strategy” – means an approach taken by a financial institution to restore its critical functions, operations, and systems to their normal status and ensure continuity following a disaster event.

“Disaster Recovery Plan” – means a documented structured plan with instructions for how to respond to loss of, and restore, IT systems or other functions that are critical to business operations.

“Infrastructure” – means technology and equipment, and facilities used in BCM activities or impacted by the incident.

“Proxy Board” – means the Country Head of a branch of a foreign incorporated financial institution.

“Senior Management”- means the Country Head and senior departmental managers of the financial institution

Business Continuity Guideline Requirements

Each FI is required to develop a Board-approved or Proxy Board-approved BCM policy. This would allow the financial institution to identify, assess, and manage potential business continuity risks to be able to meet its financial and service obligations.
Each FI’s BCM must be documented, appropriate to its nature, size, and complexity, and at a minimum include:
a. BCM policy that sets out its objectives and approaches in relation to BCM; b. recovery objectives and strategies;
c. a BCP that includes crisis management, critical business management and recovery; and
d. programs for reviewing and testing of BCP and for training and awareness of staff in relation to BCM.
Each FI must consider in its BCM different types of likely Events to which it may be vulnerable, and identify Critical Business functions, including those where there is dependence on external vendors, or other third parties, for which rapid resumption would be essential.
At a minimum, an FI’s BCM must include Business Impact Analysis (BIA), Risk Assessment, Recovery Strategy, BCP and Disaster Recovery Plan (DRP) for IT and a regular review, testing, and maintenance of the BCM.

Roles and Responsibilities

The Board, as in the case of a locally incorporated FI or a subsidiary of a foreign incorporated FI, or the Proxy Board of Directors, as in the case of a branch of a foreign incorporated FI, is responsible for the risk management of potential business continuity risks to ensure that the FI is able to meet its financial and service obligations to its depositors and other creditors.
The Board or its proxy remains responsible for BCM whether or not business operations are outsourced or are provided as part of a group.
Senior Management must similarly establish clear lines of accountability and reporting for individuals with BCM responsibility.

Business Impact Analysis

A BIA involves identifying, and addressing the impact of a disruption on all Critical Business functions, resources, and Infrastructure of the financial institution.

When conducting the BIA, the FI must consider:
a. plausible disruption scenarios and or Events over varying periods of time; b. the period of time for which the FI could not operate without each of its Critical Business operations;
c. the extent to which a disruption to the Critical Business operations might have a material impact on the interests of depositors of the financial institution; and
d. the financial, legal, regulatory, and reputational impact of a disruption to a FI’s Critical Business operations over varying periods of time.

Recovery strategy

Each FI must identify and document appropriate recovery objectives and implementation strategies based on the results of the BIA and the size and complexity of the FIs.

Business continuity planning

Each FI must maintain at all times a documented BCP that meet the objectives of the BCM Policy.
The BCP must document the procedures and information that enable the FI to:
a. manage an initial Business Disruption (crisis management); and b. recovers Critical Business operation.
The BCP must reflect the specific requirements of the FI and must identify:
a. Critical Business operations; b. recovery levels and time targets for each Critical Business operation;
c. recovery strategies for each Critical Business operation;
d. Infrastructure and resources requires to implement the BCP; e. roles, responsibilities, and authorities to act in relation to the BCP; and f. communication plans with staff and external stakeholders.

Review and testing of the BCP

FIs must review and test their BCP at least annually or more frequently if there are material changes to business operations, to ensure that the BCP can meet the BCM objectives.
Test reports must be formally reported to the Board or Proxy Board.
The BCM and BCP must be amended to reflect any deficiencies and enhancement identified as a result of the review and testing required under paragraph 19.
To facilitate its understanding of a FI’s BCM and BCP measures, CBSI may send observers to an FI’s BCP testing exercise.

Notification requirements

FIs must notify CBSI as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to have a material impact on the FI’s risk profile or affect its financial soundness. The notification must address the nature of the disruption, the action being taken or are likely to be taken, the likely effect and timeframe for return to normalcy of operations. CBSI may require or request additional reporting or updates from FIs during the disruption and recovery phase.
FIs must notify CBSI when BCP is removed and normal operations resume and provide a report on the disruption identifying problem and incident, root cause(s), any action or remediation efforts undertaken and amendments made to policy and procedures as a result of the incident; and testing.

External audit

FI’s internal audit function, or an external expert, or a duly approved external auditor, must periodically review the BCP and provide an assurance to the Board or the Proxy Board that:

a. the BCP is in accordance with the FI’s BCM Policy and addresses the risks it is designed to control; and b. testing procedures are adequate and have been conducted satisfactorily.

Reporting Requirements to the CBSI

Each FI must submit to the CBSI a copy of the test results reported to the Board or its proxy under paragraph 20.

Implementation

FIs have a transition period of ninety (90) calendar days from the effective date to complete the following:
a. Report on their compliance with this Prudential Guideline. b. Submit to CBSI a plan and timeframe for rectifying areas of non-compliance with this Prudential Guideline.

Enforcement and Corrective Measures

A FI, which fails to comply with the requirements contained in this Prudential Guideline or to submit certain reports to the CBSI, which are materially inaccurate, will be considered in breach guideline and therefore, may be subject to a monetary penalty.
The CBSI may pursue any or all corrective measures as provided in section 16 of the Financial Institutions Act 1998 (as amended) to enforce the provisions of this Prudential Guideline including:
a. Issuance of an order to cease and desist from the unsound and unsafe practices and b. Action to replace or strengthen the management of the financial institution.

Effective Date

The effective date of this Prudential Guideline is December 1, 2017.

Issued this 31st day of October 2017.

[Signature]
Governor Denton Rarawa
Central Bank of Solomon Islands