Operational Resilience Standard - Section 2 - Role Expectations

Question 1

Who holds BEAR accountability for Resilience following delegation from the Board?

Answer 1

The Group Executive T&EO

Question 2

Who is accountable for the ownership and operationalisation of this Standard and the execution of activities set out under this Standard?

Answer 2

The Executive Chief Controls Officer

Question 3

What is the Process Owner accountable for?

Answer 3

The resilience of the end-to-end NAB Critical Process.

• Document process
• Identify risks and threats
• Define impact tolerance
• Identify remediation actions
• Maintain workaround strategies

Question 4

What is the Resource Owner accountable for?

Answer 4

The resilience of resources that support the end-to-end NAB Critical Process.

• Resource mapping to process
• Identify substitutes
• Manage single points of failure, vulnerabilities, and concentration risks
• Set resource resilience thresholds
• Resilience assessments/ratings
• Execute remediation and TPs

Question 5

What are the 5 key related resilience disciplines?

Answer 5

1. Business Continuity Management
2. Service Continuity
3. Enterprise Security
4. Incident Management
5. Crisis Management

Question 6

What are 3 things Enterprise Controls and Processes (EC&P) conduct for all Operational Resilience activities?

Includes Enterprise Resilience Team

Answer 6

1. Allocate sufficient resources to support Line 1’s management of NAB’s resilience.
2. Support development, implementation, and testing of controls and processes related to management of resilience risks.
3. The Enterprise Resilience Team is responsible for developing, supporting, and advising the operationalisation of the business owned Operational Resilience standard and its supporting artefacts e.g., procedural documents and playbooks.

Question 7

What 3 things do Second Line of Accountability (Risk) conduct for all Operational Resilience activities?

Answer 7

1. Maintain BCM and other Risk policies, standards, and systems (e.g., GRACE).
2. Establish risk appetite relating to resilience risks.
3. Provide independent review and challenge of the management of resilience risks.

Question 8

Under the Operational Resilience Standard, do Resilience Disciplines have any actual accountability?

Answer 8

No, but they are responsible for scenario exercises and are consulted on nearly everything else.

Question 9

Under the Operational Resilience Standard, do Risk have any actual accountabilities or responsibilities?

Answer 9

No, but they are consulted on identification of risks/threats, defining impact tolerance statements, treatment plans and remediation, reporting, and playbooks.

Question 10

What are EC&P Accountable for?

Answer 10

• C3 Tier categorisation
• Reporting
• Conducting scenario exercises
• Maintaining list of ‘severe but plausible’ scenarios
• Responsible for more