Prudential Standard GOI 3.2 (Business Continuity Management - BCM)

Question 1

BCM

Answer 1

An enterprise-wide approach that includes policies, standards and procedures for ensuring that critical business operations can be maintained or recovered in a timely fashion in the event of a disruption.

Its purpose is to minimise the financial, legal, regulatory, reputational and other material consequences arising from a disruption.

Question 2

Critical business operations

Answer 2

• business functions
• resources
• infrastructure

that may, if disrupted, have a material impact on an insurer’s:

• business functions
• reputation
• profitability
• policyholders

Question 3

An insurer’s BCM framework must, at minimum include: (5)

Answer 3

• a BCM Policy
• a regular business impact analysis
• recovery objectives and strategies
• a Business Continuity Plan that include crisis management and recovery plans
• programs for:
• – review and testing of the Business Continuity Plan
• – training and ensuring awareness of staff in relation to BCM

Question 4

Business Impact Analysis

Answer 4

Involves an insurer identifying all its critical business operations (functions, resources and infrastructure) and assessing the impact of a material disruption on each of these.

Question 5

When conducting the business impact analysis the insurer must consider: (4)

Answer 5

• plausible disruption scenarios over varying periods of time
• the period of time for which the insurer could not operate without each of its critical business operations
• the extent to which a disruption to the critical business operations might have a material impact on the interests of the insurer’s policyholders
• the financial, legal, regulatory and reputational impact of a disruption on the insurer’s critical business operations over varying period of time.

Question 6

Recovery objectives

Answer 6

Pre-defined goals for recovering critical business operations
… to a specified level of service (recovery level)
… within a defined period (recovery time)
following a disruption.

Question 7

The Business Continuity Plan must document procedures and information that enable the insurer to: (2)

Answer 7

• manage an initial business disruption (crisis management)

- recover critical business operations

Question 8

The Business Continuity Plan must reflect the specific operational requirements of the insurer and must identify: (6)

Answer 8

• critical business operations
• recovery levels and time targets for each critical business operation
• recovery strategies for each critical business operation
• infrastructure and resources required to implement the Business Continuity Plan
• roles, responsibilities and authorities to act in relation to the Business Continuity Plan
• communication plans with staff and external stakeholders.