Back Custom print Link Text Only Rich Text Print

  • Testing & Rehearsal

    • OM-5.9.1

      A BCP is not complete if it has not been subject to proper testing. Testing is needed to ensure that the BCP is operable. Testing verifies the awareness of staff and the preparedness of differing departments/functions of the bank.

      October 07

    • OM-5.9.2

      Licensees must test their BCPs at least annually. Senior management must participate in the annual testing, and demonstrate their awareness of what they are required to do in the event of the BCP being involved. Also, the recovery and alternate personnel must participate in testing rehearsals to familiarise themselves with their responsibilities and the back-up facilities and remote sites (where applicable).

      October 07

    • OM-5.9.3

      All of the BCP's related risks and assumptions must be reviewed for relevancy and appropriateness as part of the annual planning of testing. The scope of testing must be comprehensive enough to cover the major components of the BCP as well as coordination and interfaces among important parties. A testing of particular components of the BCP or a fully integrated testing must be decided or depending on the situation. The following points must be included in the annual testing:

      (a) Staff evacuation and communication arrangements (e.g. call-out trees) must be validated;
      (b) The alternate sites for business and technology recovery must be activated;
      (c) Important recovery services provided by vendors or counterparties must form part of the testing scope;
      (d) Licensees must consider testing the linkage of their back up IT systems with the primary and back up systems of service providers;
      (e) If back up facilities are shared with other parties (e.g. subsidiaries of the licensee), the licensee needs to verify whether all parties can be accommodated concurrently; and
      (f) Recovery of vital records must be performed as part of the testing.
      Amended: July 2011
      October 07

    • OM-5.9.4

      Formal testing reviews of the BCP must be performed to assess the thoroughness and effectiveness of the testing. Specifically, a post-mortem review report must be prepared at the completion of the testing stage for formal sign-off by Licensees' senior management. If the testing results indicate weaknesses or gaps in the BCP, the plan and recovery strategies must be updated to remedy the situation.

      Amended: July 2011
      October 07