Cyclone outage, DR location and outsourced ATM switch
A co-operative bank with 180 branches serves 1.4 million customers. Its primary data centre is in a coastal city and its disaster recovery site is 12 km away in the same flood zone. The ATM switch and mobile banking platform are outsourced to a vendor whose contract promises 99.9% availability but does not specify recovery time, data location, or audit rights. Last year's cyclone caused a 72-hour outage; branches used manual vouchers and customers could not access ATMs. The bank's BIA says core banking RTO is 4 hours and RPO 30 minutes, but the last DR test was 19 months ago and failed to restore the ATM switch. The board asks whether the bank can meet its own BIA, what to change in the outsourcing contract, and how to handle customer compensation and regulatory communication during the next outage.
1. Can the bank meet its own BIA? Explain the gaps and what the board should treat as the current capability.
Read the worked answer
The bank cannot credibly meet its own BIA. A DR site 12 km away in the same flood zone is not geographically independent; a single cyclone can affect both. The last DR test was 19 months ago and failed to restore the ATM switch, so the 4-hour RTO and 30-minute RPO are unproven. Manual vouchers may keep branches partially open but do not restore ATMs, mobile banking or real-time balances.
The BIA should distinguish critical processes, maximum tolerable downtime and dependencies. The bank needs an out-of-region recovery capability or a contracted alternate site, tested at least annually, plus manual workaround capacity and clear invocation authority. Until then, the board should treat the BIA as a target, not a current capability.
2. What changes should the bank make to the outsourcing contract and vendor governance?
Read the worked answer
Amend the contract to specify RTO and RPO per service, recovery testing frequency and evidence, data location and protection, audit and inspection rights, incident notification timelines, subcontracting controls, service credits, termination and exit assistance, and access to logs. Require the vendor to participate in the bank's DR tests and to provide business continuity plans and cyber incident history. Add concentration risk reporting.
The 99.9% availability promise is not enough because it does not say how quickly service returns after a disaster. Set a right to step in or use an alternate provider, and assign a named vendor risk owner inside the bank.
3. How should the bank handle customer compensation and regulatory communication during an outage?
Read the worked answer
Adopt a customer communication and compensation policy before the next outage: notices through branches, SMS and media; expected restoration times; fee waivers; complaint handling; and compensation for direct losses under a published framework. Report the incident to the regulator within the bank's policy and applicable timelines, with facts and remediation. Avoid promising that services will never fail.
Track complaints and payouts as operational risk losses. After the outage, test the plan, update the BIA and report lessons to the board. The board should also require a geographic separation strategy for the DR site and evidence that the ATM switch can actually be restored.