Back Custom print Link Text Only Rich Text Print

  • Testing & Rehearsal

    • OM-4.8.1

      Licensees must test their BCPs at least annually. Senior management must participate in the annual testing, and demonstrate their awareness of what they are required to do in the event of the BCP being involved. Also, the recovery and alternate personnel must participate in testing rehearsals to familiarise themselves with their responsibilities and the back-up facilities and remote sites (where applicable).

      January 2014

    • OM-4.8.2

      All of the BCP's related risks and assumptions must be reviewed for relevancy and appropriateness as part of the annual planning of testing. The scope of testing must be comprehensive enough to cover the major components of the BCP as well as coordination and interfaces among important parties. A testing of particular components of the BCP or a fully integrated testing must be decided depending on the situation. The following points must be included in the annual testing:

      (a) Staff evacuation and communication arrangements (e.g. call-out trees) must be validated;
      (b) The alternate sites for business and technology recovery must be activated;
      (c) Important recovery services provided by vendors or counterparties must form part of the testing scope;
      (d) Licensees must consider testing the linkage of their back up IT systems with the primary and back up systems of service providers;
      (e) If back up facilities are shared with other parties (e.g. subsidiaries of the licensee), the licensee needs to verify whether all parties can be accommodated concurrently; and
      (f) Recovery of vital records must be performed as part of the testing.
      January 2014

    • OM-4.8.3

      Formal testing reviews of the BCP must be performed to assess the thoroughness and effectiveness of the testing. Specifically, a post-mortem review report must be prepared at the completion of the testing stage for formal sign-off by licensees' senior management. If the testing results indicate weaknesses or gaps in the BCP, the plan and recovery strategies must be updated to remedy the situation.

      January 2014