The financial implications of business continuity planning in financial institutions

Abstract

Business continuity planning (BCP) is an ongoing process to ensure risk reduction and to resume key business operations, thus reducing the possibility of incurring unacceptable impacts and losses. The core document supporting BCP is the business continuity plan. The development of a business continuity plan is a long-term process that requires substantial human and financial resources. An organisation should have in place arrangements appropriate to the nature, scale and complexity of its business to ensure that it can continue to operate and meet its regulatory obligations in the event of an unforeseen interruption to operations. The objective of this dissertation is twofold. Initially a research was carried out to determine the level of knowledge and utilisation of BCP in Maltese banks. Secondly, a review on the BCP of Bank of Valletta plc and HSBC Bank Malta plc was made. This mainly focused on identifying and assessing the BCP associated to the banks' key business processes. 67% of the financial institutions interviewed have a business continuity plan in place, whilst the business continuity plan of the remaining 33% is still in progress. Up to two years ago, only 8% of Maltese financial institutions deemed BCP to be extremely urgent. However, today BCP is deemed to be extremely urgent for 75% of Maltese financial institutions. The majority of the banks believe to have an excellent level of protection for their critical business information. The main constraint to effective BCP is resource priorities and the most common cause of unscheduled outages is telecommunications failure. BCP within Bank of Valletta plc and HSBC Malta Ltd is present both for the bank as a whole and also for each of their critical business areas. It is extremely important that the business continuity plan is written and tested regularly. BCP should mitigate the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events.