Business Continuity Planning and Disaster Recovery Management in the Banking Sector of the Bailiwick of Guernsey (2008-10)

Summary

This is a thematic report published by the Guernsey Financial Services Commission in October 2008 summarising the findings of a review into business continuity planning (BCP) and disaster recovery management (DRM) across licensed banks in the Bailiwick of Guernsey. It is an informational and advisory document rather than a binding rule, intended to highlight good practice and shortcomings observed during an industry-wide survey and on-site visits to a sample of banks.

• Overall finding: BCP and DRM standards across the industry were generally satisfactory, with only a small number of exceptions identified at the banks visited.
• Exceptions identified: Common weaknesses included business continuity plans with too narrow a scope, absence or staleness of business impact analyses and recovery priority lists, insufficient testing of call trees, and lack of a secondary muster point for staff.
• Good practice noted: Examples included active monitoring of events that could invoke a plan, use of colour coded role specific cards and contact lists, regular independent review of plans, and dedicated or embedded budgeting for BCP/DRM.
• Island wide concentration risk: A significant proportion of banks' primary and disaster recovery sites are concentrated in the St Peter Port area or with a small number of third party disaster recovery service providers, creating a geographic and provider concentration risk for the whole industry.
• Commission actions taken: Exceptions letters were issued to four of the five banks visited, requiring them to address identified issues within a defined timescale; the Association of Guernsey Banks was asked to consider how to address the industry-wide concentration risk.

The report does not impose new formal rules, but the Commission expects senior management of all Bailiwick banks to review the findings and, where the described exceptions apply to their own business, take steps to rectify them to reduce operational risk. It also signals that BCP/DRM will continue to be reviewed as part of the Commission's ongoing on-site supervision programme.

Key obligations

• Banks identified with exceptions during on-site visits must address the issues raised in their exceptions letter within the timescale specified by the Commission
• Senior management of all Bailiwick banks are expected to review the report's findings and rectify any similar exceptions in their own business continuity and disaster recovery plans
• Banks relying on group or external parties for key functions should understand and document the business continuity and disaster recovery arrangements and recovery times of those parties
• Banks should maintain an up to date business impact analysis and list of business recovery priorities
• Banks should regularly test their business continuity plans and call trees and formally record testing events and outcomes

Applies to

banks, licensed banks in the Bailiwick of Guernsey