Business Continuity Policy

• critical operations, and the people, technology, information, facilities and service providers they depend on, are identified and documented;
• the Board sets clear, measurable tolerance levels for disruption to each critical operation;
• credible business continuity plans exist, are kept up to date and can be activated quickly;
• plans are tested against severe but plausible scenarios, including the failure of material service providers, and weaknesses are fixed;
• the Board and APRA are told when a critical operation is disrupted outside tolerance; and
• customers, beneficiaries and the wider financial system are protected from the harm a prolonged disruption would cause.

The Policy supports [Organisation]'s obligations, where they apply, under APRA Prudential Standard CPS 230 Operational Risk Management (2026), which requires an APRA-regulated entity to maintain its critical operations within tolerance levels through severe disruptions (para 11(b)) and to have business continuity plans that are regularly tested with severe but plausible scenarios (para 15(e)). It follows APRA's guidance in CPG 230 Operational Risk Management (July 2026) and is aligned to ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements.

ISO 22301 is a voluntary standard. [Organisation] [does / does not] seek certification. Meeting ISO 22301 does not on its own show compliance with CPS 230: CPS 230 adds specific requirements, such as Board-approved tolerance levels, the 24-hour APRA notification and an annual business continuity exercise.

At a minimum, the following must be classified as critical operations unless [Organisation] can justify otherwise (CPS 230 para 35):

• Critical functions determined under CPS 900 Resolution Planning are also classified as critical operations (CPG 230 para 17).
• Where [Organisation] decides that an operation on APRA's minimum list is not critical, the reasons are documented, approved by an accountable person and reviewed at least annually (CPG 230 para 18).
• APRA may require [Organisation] to classify a business operation as critical (CPS 230 para 36).
• The register is reviewed at least [annually], and whenever a new product, service, geography, technology or service provider arrangement is approved (CPS 230 para 25).

The register records for each critical operation at least: its name and description, the accountable owner, the tolerance levels, and the material service provider arrangements that support it (CPG 230 para 31), together with the date of the last BIA, test and review.

• describe the operation end to end, from the customer or beneficiary back through every internal process and service provider;
• identify and document the processes and resources needed to deliver the operation: people, technology, information (data), facilities and service providers, the interdependencies across them, and the associated risks, obligations, key data and controls (CPS 230 para 26(b));
• assess the impact of disruption over time (for example at [1 hour, 4 hours, 1 day, 3 days, 1 week, 1 month]) across the six RiskFA impact categories: financial; customers; regulatory and legal; operations and critical operations; information security and privacy; and reputation;
• identify the point at which the impact becomes unacceptable, which informs the proposed maximum period of disruption;
• identify the data that must be preserved and how far back it could be reconstructed, which informs the proposed maximum data loss;
• identify the minimum service the operation must deliver under alternative arrangements, and the minimum people and resources needed to deliver it;
• identify peak periods and time-critical dates (for example month end, payroll, rollover dates, claims surges after a natural catastrophe); and
• record single points of failure, key person dependencies and concentration risk (for example several critical operations relying on one data centre, cloud region or provider).

BIAs are refreshed at least every [12 months] and when the operation, its systems or its service providers change materially. Second line reviews and challenges each BIA.

• Tolerances are proposed by the critical operation owner from the BIA, challenged by second line, recommended by the [Board Risk Committee] and approved by the Board (CPS 230 para 21(b)). The Board ensures the BCP aligns with its tolerances (CPG 230 para 10).
• In setting tolerances, [Organisation] considers the impact on customers and other stakeholders, the financial and reputational impact on [Organisation] and the broader financial system (including flow-on effects and contagion), legal and regulatory requirements (including any tolerance set by APRA), and recovery objectives (CPG 230 para 32).
• Tolerances are set from the customer's point of view and apply to the critical operation end to end, including any part performed by a service provider.
• Tolerances must be specific and measurable, so that it is clear during a disruption whether the operation is within or outside tolerance.
• Tolerances are reassessed at least [annually] and as lessons are learned from actual disruptions, testing, scenario analysis and industry practice (CPG 230 para 33). APRA may require tolerances to be reviewed and changed, or may set them (CPS 230 para 38).
• Each critical operation has a tolerance statement using the template in Appendix B.

• the risks to each critical operation are assessed and rated under the RiskFA Risk Management Framework, and key controls (for example resilience in system design, redundancy, backups, physical security, capacity management, change controls and service provider oversight) are tested for design and operating effectiveness;
• [Organisation] undertakes scenario analysis to identify and assess the potential impact of severe operational risk events, test its operational resilience and identify the need for new or amended controls and other mitigation strategies (CPS 230 para 26(c));
• the impact on operational resilience of new products, services, geographies, technologies and strategic decisions is assessed before approval (CPS 230 para 25); and
• information and technology capability is maintained to support critical operations, including monitoring the age and health of information assets (CPS 230 para 24).

The scenario library is reviewed at least [annually] by second line and includes, where relevant:

Strategies must be credible: [Organisation] must maintain the capabilities required to execute the BCP, including access to people, resources and technology. These capabilities may be held internally or through an agreement with another party, which must then meet CPS 230's service provider requirements (CPS 230 para 40 and footnote 13).

• The register of material service providers (CPS 230 para 48) is linked to the register of critical operations, so that the providers that each critical operation depends on are known.
• Before entering into or materially changing a material arrangement, [Organisation] assesses the provider's ability to provide the service on an ongoing basis, including its business continuity arrangements and geographic or concentration risk (CPS 230 para 52).
• Formal agreements include a force majeure provision stating which parts of the contract continue in a force majeure event (CPS 230 para 53(f)) and should set out the provider's BCP and DR obligations, recovery times consistent with [Organisation]'s tolerance levels, notification of disruptions within [2–4 hours], and the right to receive test results and join tests.
• For each material arrangement, [Organisation] must ensure it can execute its BCP if needed and can conduct an orderly exit (CPS 230 para 55(c) and (d)).
• [Organisation] seeks to confirm that material service providers maintain robust BCP testing, and considers joint testing (CPG 230 para 39). The testing program includes disruptions to services provided by material service providers (CPS 230 para 43).
• The [Service Provider Management Policy] covers the risks from fourth parties that material service providers rely on to deliver a critical operation (CPS 230 para 47(c)). Business continuity analysis considers these dependencies.

CPG 230 para 34 expects the BCP to cater for all stages of a disruption: triggers and identification, initial actions (such as alternative arrangements), further actions, assessment and communications. Appendix C is the BCP content checklist. Plans must be written so that a capable deputy who has not written them can follow them.

• Triggers. Each BCP sets clear triggers, for example: a critical operation is disrupted or likely to be disrupted for more than [50%] of its maximum period of disruption; data loss approaching the maximum data loss tolerance; loss of a site, a key system or a material service provider; or a forecast event (such as a severe weather warning) likely to cause disruption.
• Authority. The critical operation owner, the [Chief Operating Officer] or their deputies may activate a BCP. Activation does not need to wait for the full facts: activate early and stand down if the disruption is contained.
• Incident management. Every disruption is recorded, rated and escalated as an incident under the RiskFA Incident & Issues Management Standard. A disruption to a critical operation within tolerance is rated at least High; one outside tolerance is rated Critical.
• Crisis management. A disruption to a critical operation outside tolerance (a Critical incident) activates the Crisis Management Team under the RiskFA Crisis Management Plan, as every Critical incident does under the RiskFA Incident & Issues Management Standard; a disruption likely to go outside tolerance may activate it. The Crisis Management Team makes the strategic decisions; BCP teams run the recovery of each critical operation.
• Cyber. Where the cause is a cyber security incident, the RiskFA Cyber Incident Response Plan runs the technical response, and the BCP keeps critical operations going. Recovery from a cyber incident must not restore compromised systems or data before the incident response team agrees it is safe.
• Tolerance clock. From the start of a disruption, the critical operation owner records the time and tracks the disruption against each tolerance level (section 19).

• who is told, by whom, how and when: staff, customers and beneficiaries, material service providers, regulators, the Board, intermediaries and, where relevant, the media and the market;
• pre-approved templates and holding statements for likely scenarios, including customer messages about alternative ways to get service;
• out-of-band channels (for example a mass notification tool, personal mobile phones and an offline contact list) that do not rely on systems that may be disrupted;
• support for vulnerable customers and customers in financial hardship during the disruption; and
• approval of all external communications by [CEO / Head of Communications / General Counsel].

• All critical operations are tested within a multi-year cycle of no more than [3 years] (CPG 230 para 37), with higher-risk operations tested more often.
• Tests should be realistic and should measure results against each tolerance level, not just whether a step was completed. Testing only the easy case does not show the plan is credible.
• The annual testing schedule is approved by the [Board Risk Committee] at the start of each year.
• Each test produces a report using Appendix D, covering the scope (including the critical operations and tolerance levels tested and excluded), what was demonstrated (including whether tolerance levels were met), and the issues, root causes and remediation with owners and due dates (CPG 230 para 38).
• Issues are recorded and tracked under the RiskFA Incident & Issues Management Standard. Test results and the execution of findings are reported to and reviewed by the Board (CPS 230 para 21(b); CPG 230 para 38).
• Where scenarios overlap, exercises are coordinated with cyber incident response testing (CPS 234 para 26) and recovery and exit plan testing.

• The APRA notification under para 41 must cover the nature of the disruption, the action taken, the likely impact on [Organisation]'s business operations and the timeframe for returning to normal operations. APRA notifications are made electronically using the form on APRA's website (CPG 230 para 14).
• [Head of Compliance] decides and records whether each notification is required. The 24-hour clock starts when the disruption goes outside tolerance. Do not wait for the disruption to end before notifying.
• Other notifications (for example ASIC, the OAIC, ASD under the SOCI Act, AUSTRAC or ASX) are assessed under the RiskFA Incident & Issues Management Standard and the RiskFA Crisis Management Plan.

• confirm the cause is resolved and that it is safe to return (for a cyber incident, with the incident response team's agreement);
• move back from alternative arrangements in a controlled way, including reconciling, validating and re-keying data, and clearing backlogs;
• confirm that customers affected by the disruption are identified and, where they have suffered loss, remediated under the RiskFA Incident & Issues Management Standard;
• stand down teams formally and record the time of return to normal operations; and
• complete a post-incident review for every disruption to a critical operation outside tolerance, and for others at the CRO's discretion, with lessons fed into the BCP, the BIA, the tolerances and the testing program.

• Internal Audit reviews business continuity at least every [2–3 years], with the audit program assessing all aspects of business continuity capability over time (CPG 230 para 43).
• Additional reviews may be triggered by changes to services, processes, information assets, the business environment or stakeholder expectations (CPG 230 para 43).
• The Board may seek assurance from expert opinion or other means to complement internal audit (CPG 230 para 42).
• Second line reviews a sample of BIAs, plans and test reports each year and reports the results to the [Board Risk Committee].

• the register of critical operations and any changes, and tolerance levels for Board approval;
• disruptions to critical operations, performance against tolerance and any APRA notifications;
• results of tests and exercises, whether tolerances were met, and the execution of findings;
• critical operations whose recovery capability does not yet meet tolerance, with the remediation plan and interim measures;
• open business continuity issues and overdue actions; and
• the status of material service provider business continuity and testing.