Business Continuity
What this domain tests
The bank's ability to keep critical operations running and recover from disruption: BIA, RTO/RPO, DR strategy, crisis management, testing and regulatory expectations. Expect questions that differentiate BCP from disaster recovery and test recovery sequencing.
Core rules
- BIA identifies critical business functions, dependencies (people, premises, technology, vendors) and maximum tolerable downtime; it sets RTO (time to restore) and RPO (acceptable data loss).
- BCP covers business processes, alternate sites, manual workarounds, call trees, crisis communication and vendor dependencies; DR focuses on technology recovery.
- A sound DR strategy may use a hot standby, warm site or active-active architecture; backups should be encrypted, tested, immutable where possible, and stored offline or at a distance.
- Test at least annually, including tabletop exercises and full failover; record actual RTO/RPO achieved, issues and corrective actions.
- RBI expectations include board-approved BCP, periodic testing, cyber-resilience scenarios and reporting of material disruptions.
Worked example
The primary data centre loses power; the CBS RTO is four hours and RPO is 15 minutes. Correct sequence: declare a crisis, activate the crisis management team, confirm replication lag and data loss window, fail over to DR, validate balances and last successful transaction, switch channels, run reconciliation with payment files, and communicate to customers and RBI as required. Restoring the primary site immediately, before validating DR data integrity, is a trap.
Traps that cost marks
- Treating BCP as only IT DR.
- Storing backups on the same SAN or with the same credentials as production.
- Assuming a vendor's BCP covers the bank's obligations.