Explainer: R8 Business Continuity Management Policy Part B Requirement 8

Disclaimer

This article is provided for general informational and educational purposes only. It summarises publicly available regulatory guidance issued by Bank Negara Malaysia.

BCM Institute is not affiliated with, endorsed by, or acting on behalf of Bank Negara Malaysia. The name “Bank Negara Malaysia” is used strictly for descriptive and reference purposes.

Explainer: R8 Business Continuity Management Policy

Responsibilities of the Board and Senior Management

Part B Policy Requirements 8, "Responsibilities of the Board and senior management", highlights the following key responsibilities that the boards and senior management of banks are expected to consider when developing their business continuity management.

Click the button to access the official BCM policy document (December 2022 release). A sample table of contents is provided below for reference.

BNM BCM Policy TOC Part B 8-9 Part C 10

Clear Commitment

The board and senior management should clearly commit to business continuity management by setting the tone from the top.

They should actively promote a culture of resilience, ensuring that BCM receives appropriate attention and resources within the organisation.

Establishing a Governance Structure

The board should establish a governance structure that provides oversight and guidance for the BCM program.

This involves designating a senior executive or a committee responsible for driving the BCM efforts and ensuring compliance with BCM requirements.

Policy Development and Approval

The board should approve a comprehensive BCM policy that outlines the organisation's approach, principles, and standards for BCM. This policy should align with the organisation's objectives, risk appetite, and regulatory requirements.

Assigning Responsibilities

The board should assign clear responsibilities to senior management and ensure they have the authority and resources to fulfil their roles. This includes designating a BCM coordinator or manager responsible for implementing and maintaining the BCM program.

Resource Allocation

The board should allocate sufficient resources to develop and maintain an effective BCM program. This includes providing funding, staffing, and necessary infrastructure to support the implementation and ongoing management of BCM activities.

Monitoring and Reporting

The board should establish mechanisms to monitor the effectiveness of the BCM program. Regular reports on BCM performance, progress, and key risk indicators should be provided to the board, enabling them to assess the organisation's resilience and make informed decisions.

Review and Testing

The board should ensure regular reviews, tests, and exercises of the BCM program are conducted. This includes assessing the adequacy of recovery strategies, conducting tabletop exercises, and participating in simulation drills to validate the effectiveness of the BCM program.

Training and Awareness

The board should ensure appropriate training and awareness programs to educate staff on BCM policies, procedures, and their respective roles and responsibilities during disruptions. This helps to enhance the organisation's overall preparedness and response capabilities.

Conclusion

Policy Requirement 8 of the Business Continuity Management Guidelines highlights the board's and senior management's crucial responsibilities in developing effective business continuity management strategies within banks.

By considering and fulfilling these responsibilities, boards and senior management can provide guidance, oversight, and resources to establish a robust BCM program. This program ensures the organisation is well-prepared to manage disruptions, protect critical business functions, and safeguard stakeholders' interests.

Compliance with these guidelines enhances Malaysia's banking sector's resilience and contributes to maintaining financial stability even in challenging circumstances.

This article is an independent informational summary for educational purposes. It is not affiliated with, endorsed by, or officially representing any regulatory authority.