BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS …

1 BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS DIRECTORATE OF BANKING SUPERVISIONAUGUST 20092 TABLE OF of the of the CONTINUITY MANAGEMENT CONTINUITY MANAGEMENT Duties and Impact Analysis (BIA).. CONTINUITY CONTINUITY , Maintenance and BCM Awareness and 17 Appendix 1: 17 Appendix 2: Examples of BUSINESS CONTINUITY and financial institutions are susceptible to operational disruptions caused by internal and external threats such as fire, earthquakes, wars, terrorist attacks, system failures, etc. Such disasters may lead to severe operational disruptions and sometimes threaten the solvency and BUSINESS CONTINUITY of institutions, which could adversely impact the financial system as a whole.

2 In today s world, BUSINESS CONTINUITY MANAGEMENT (BCM) is becoming increasingly important. In issuing these GUIDELINES , Bank of Tanzania recognizes the need for BANKS and financial institutions to have in place an effective BCM that will ensure their ability to operate on an ongoing basis and limit losses in the event of an operationaldisruption. TheGuidelines set minimum requirements for establishing sound and effective BCM practices in BANKS and financial has to be comprehensive in such a way as to include policies, strategies, plans, procedures and standards for ensuring that specified operations can be maintained or recovered in a timely manner in the event of a disruption and,by extension, ensures that the functionality of the financial system as a whole is preserved.

3 One of the tangible evidence that an institution has embraced BCM is the formulation of an effective and workable BUSINESS CONTINUITY Plan (BCP). A BCP sets out procedures, processes and systems necessary to continue or restore the operation of an organization in the event of a disruption. Itprovides detailed guidance for implementing the recovery plan and outlines the roles, responsibilities and succession in managing operational disruptions. It also defines triggers for activating the BCP and establishes businessresumption teams for core BUSINESS processes. The resilience of a financial system to major operational disruptions will be determined by therobustness of the BCPs of all participants within the GUIDELINES shall be cited as BUSINESS CONTINUITY ManagementGuidelines for BANKS and Financial Institutions These GUIDELINES are issued under Section 71 of the Banking and Financial Institutions Act, 2006, which empowers the Governor of the Bank of Tanzania to issue GUIDELINES in addition to regulations, directives and circulars expressly mentioned under the of the GuidelinesThese GUIDELINES shall apply to all BANKS and financial institutions licensed by the Bank to carry on banking BUSINESS .

4 Of the GuidelinesThe GUIDELINES aim at achieving the following objectives:(i)Define major elements and highlight the role of BUSINESS CONTINUITY within an institution;(ii)Outline the duties of the Board, Senior MANAGEMENT , employees and the internal audit function with regard to BUSINESS CONTINUITY ;(iii)Provide guidance to BANKS and financial institutions on how to develop aneffective BCP given the scope and size of their operations;(iv)Guide BANKS and financial institutions in making adequate preparations to deal with possible BUSINESS interruption scenarios; and(v)Provide guidance to BANKS and financial institutions on how to evaluate the adequacy of their BCPs.

5 CONTINUITY MANAGEMENT CONTINUITY MANAGEMENT PolicyEvery bank or financial institution shall establish a BCM policy to govern formulation and maintenance of all aspects of BUSINESS CONTINUITY . The BCM policy of an institution must be approved by the Board and shall be communicated to all relevant levels of the institution in a timely manner. It should take into account appropriate structures including the institution s BUSINESS CONTINUITY objectives, plans, scope, limitations and exclusion. Any significant deviation from the policies must be communicated to Senior MANAGEMENT /Board for corrective measures. The BCM policy should provide for formation of various BCM teams and description of their roles such as BCM Steering Committee, BUSINESS CONTINUITY MANAGEMENT Team, Crisis MANAGEMENT Team, BUSINESS Recovery Team etc.

6 Furthermore, it should provide for policy reviews at regular intervals and when significant changes Duties and ResponsibilitiesBanks and financial institutions should have effective and comprehensive approaches to BUSINESS CONTINUITY MANAGEMENT . Board of Directors and Senior MANAGEMENT are responsible for the organization s BUSINESS CONTINUITY . Additionally, Internal Audit and all employees of an organization have a role in BUSINESS CONTINUITY of Directors Responsibilities The responsibility for BUSINESS CONTINUITY MANAGEMENT of an institution ultimately lies with the Board of Directors. Specific responsibilities of the Board include approving BUSINESS CONTINUITY MANAGEMENT policies, standards and principles developed by Senior MANAGEMENT and ensuring compliance with regulatory and legal requirements for BUSINESS CONTINUITY MANAGEMENT ResponsibilitiesSenior MANAGEMENT is responsible for steering BCM, developing the BCP and strategies necessary for the CONTINUITY of critical BUSINESS functions.

7 They must ensure that at minimum, the necessary administrative support functions in the recovery effort, such as human resources, insurance, legal and security are in place. They should also ensure that all levels of staff are cognizant of the importance of BCPs and the BUSINESS recovery objectives. Specifically, senior MANAGEMENT shall be responsible for the following:(i)Assigning the overall MANAGEMENT of the BUSINESS CONTINUITY function to a BUSINESS CONTINUITY MANAGEMENT Team. Such Team shall draw its membership from the following:1. Senior MANAGEMENT (Coordinator)2. Functional Departmental Heads3. Line Managers4. Risk MANAGEMENT Officer.

8 (ii)Establishing a Crisis MANAGEMENT Team, consisting of key executives and functional heads of critical operational areas, which will be responsible for dealing with crisis MANAGEMENT and BUSINESS CONTINUITY during a crisis. The roles and responsibilities of each individual member should be clearly defined;(iii)Ensuring that there is a plan for BUSINESS CONTINUITY in line with the institutional BUSINESS strategy and plan;(iv)Allocating sufficient human and financial resources for the development and maintenance of the BCP;6(v)Preparing policies by determining how the institution will manage and control BUSINESS CONTINUITY risks;(vi)Reviewing BCP test results on regular basis;(vii)Keeping the BCP up to date and reviewing it at least annually;(viii)Ensuring that employees are trained and are fully aware of their roles in the implementation of BCM.

9 (ix)Ensure that there is a framework for reporting to the Board and Senior MANAGEMENT on matters related to BCM;(x)Ensuring that, at least annually, the institution s BCM is subject to review by an independent party, such as internal or external auditor; (xi)Ensuring that roles as well as responsibilities and authority to act, andsuccession plans are clearly articulated in institutions BCM policies to avoid confusion in the event of a disruption;(xii)Ensuring that the BCP not only consider BUSINESS processes and technical aspects, but also recognizes and addresses the human element. The overriding consideration in formulating an institution s BCP should be the preservation of human life; and(xiii)Demonstrating that they have sufficient awareness of the risks, mitigating measures and state of readiness by way of a statement to the Board of Directors.

10 Such statement should be updated at least once a year or more frequently should there be material change within the ResponsibilitiesEach employee of a bank or financial institution should be aware of his/her role in the BCP, the importance of having a BCP and the role it plays in ensuring the continuous functioning of the institution and preserving the functionality of the financial system as a Audit Responsibilities The internal audit function of a bank or financial institution should conduct periodic reviews of the BCP to determine whether the plan is realistic and remains relevant, and whether it adheres to the policies and standards established by the Board.