Principles, Regulations & Standards for Business Continuity Management. Richard Bale, Head of BCM, London IBM BC&RS User Group 7 February 2007

Transcription

1 Principles, Regulations & Standards for Business Continuity Management Richard Bale, Head of BCM, London IBM BC&RS User Group 7 February

2 Agenda Principles Regulations Other Regulatory Activities Standards 2

3 Joint Forum, Basle Committee Financial Stability Forum and the Bank of England co-hosted a symposium on business continuity issues. Financial Stability Forum asked the Joint Forum to review & consider: approaches to business continuity across countries & financial sectors potential high-level principles that could apply across the financial system globally. Formal working group of the Joint Forum established (Nov. 2004), and paper published (Dec. 2005). Paper sets out seven high level principles and provides some case studies (SARS, 7 July London, Japan Earthquake, Eastern US Power Outage). BCM 02/2007 Principles 3

4 High Level Principles Principle 1: Board and senior management responsibility Financial industry participants and financial authorities should have effective and comprehensive approaches to business continuity management. An organisation s board of directors and senior management are collectively responsible for the organisation s business continuity. Principle 2: Major operational disruptions Financial industry participants and financial authorities should incorporate the risk of a major operational disruption into their approaches to business continuity management. Financial authorities business continuity management also should address how they will respond to a major operational disruption that affects the operation of the financial industry participants or financial system for which they are responsible. Principle 3: Recovery objectives Financial industry participants should develop recovery objectives that reflect the risk they represent to the operation of the financial system. As appropriate, such recovery objectives may be established in consultation with, or by, the relevant financial authorities. BCM 02/2007 Principles 4

5 High Level Principles Principle 4: Communications Financial industry participants and financial authorities should include in their business continuity plans procedures for communicating within their organisations and with relevant external parties in the event of a major operational disruption. Principle 5: Cross border communications Financial industry participants and financial authorities communication procedures should address communications with financial authorities in other jurisdictions in the event of major operational disruptions with cross-border implications. Principle 6: Testing Financial industry participants and financial authorities should test their business continuity plans, evaluate their effectiveness, and update their business continuity management, as appropriate. Principle 7: Business Continuity reviews by financial authorities Financial authorities should incorporate business continuity management reviews into their frameworks for the ongoing assessment of the financial industry participants for which they are responsible. BCM 02/2007 Principles 5

6 Agenda Principles Regulation Other Regulatory Activities Standards 6

7 Regulatory Background UK financial services firms regulated by Financial Services Authority (FSA) Non-prescriptive, principles based approach, in contrast to other regulators e.g. Fed in US Increased focus by FSA on core and significant firms, with requirement for evidence based oversight of continuity arrangements. BCM part of FSA s Corporate Governance Handbook, updated November 2006 (SYSC ), A firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. must employ appropriate and proportionate systems, resources and procedures. BCM 02/2007 Regulation 7

8 Business Continuity Policy Firms must establish, implement and maintain an adequate business continuity policy aimed at: Preferably - loss limitation; preservation of essential data/functions, and maintenance of regulated activities Or timely recovery of data and functions, with timely resumption of regulated activities Business Continuity Policy should include: Resource requirements and arrangements for obtaining resources Recovery priorities for the firm s operations Communication arrangements (internal and external) Escalation and invocation plans, with contact information Processes to validate the integrity of information Regular testing in an appropriate and proportionate manner, and must take appropriate measures to address any deficiencies. BCM 02/2007 Regulation 8

9 Agenda Principles Regulation Other Regulatory Activities Standards 9

10 Arrow is the Risk Assessment Framework used by FSA Periodic review undertaken by FSA Supervisor Sets level and nature of supervision going forward Reviews frequency dependent upon findings max. 3 yrs Mitigating actions can be requested, with due dates Rectification notices can be issued if firms fail to meet due dates Ultimate sanction is withdrawal of Banking Operations licence activity has to stop! Risk Assessment Framework BCM 02/2007 Risk Assessment 10

11 Resilience Benchmarking Resilience Benchmarking Exercise undertaken by Tripartite Authorities (FSA, HM Treasury and Bank of England) in 2005 Over 60 of UK s most significant firms & infrastructure providers volunteered to participate, answering around 1000 questions each Exercise assessed how resilient the UK financial services sector would be in event of a major operational disruption (e.g. terrorist attack or natural disaster); how quickly it could recover; areas to strengthen. Actions to improve resilience: Taking more account of key interdependencies during planning & testing Mitigating geographical concentration risk Reducing dependency risk Improving security arrangements Benchmarking Light made available 2006 for smaller firms, un-scored Next benchmarking exercise, September 2007 BCM 02/2007 Other Regulatory Activities 11

12 BCM Practice Guide FSA has issued BCM Practice Guide based on observed standard and leading practice in firms that participated in the benchmarking exercise. Practice Guide covers: Corporate Continuity Corporate Crisis Management Corporate Systems Corporate Facilities Corporate People Guide does not form part of FSA s formal rules & guidance Yet will be used by FSA supervisors as a basis for their discussions! Available from BCM 02/2007 Other Regulatory Activities 12

13 Agenda Principles Regulations Other Regulatory Activities Standards 13

14 BS New UK BCM Standard Published as UK standard at end 2006 (replaces PAS 56) Establishes the processes, principles and terminology for BCM Provides a basis for implementing BC in an organization and for measuring the organization's BCM capability Designed to be applicable to all organization types and sizes BS Will support BS (during 2007) Detailed specification Used for certification Purchase from BCM 02/2007 Standards 14

15 PAS 77:2006 ITSCM Code of practice, complementing BS 25999, covering: IT Service Continuity Management (ITSCM) Service Continuity Strategy Understanding risks and impacts Conducting business criticality & risk assessments Service Continuity Plan Rehearsing an ITSC plan Solutions architecture and design considerations Buying Continuity Services Purchase from BCM 02/2007 Standards 15

16 THANK YOU, ANY QUESTIONS? 16