Business continuity, outsourcing, people and compliance risk
Business continuity, outsourcing, people and compliance risk
This domain tests resilience planning, third-party risk, and the human and compliance dimensions of operational risk.
Business continuity
The Business Impact Analysis identifies critical processes, dependencies and maximum tolerable downtime. It sets the Recovery Time Objective (RTO), how quickly a process must be restored, and the Recovery Point Objective (RPO), how much data loss is tolerable. Plans cover alternate sites, remote working, crisis communication and vendor failure; they are board-approved and tested at least annually, with results reported to the Risk Management Committee.
Outsourcing
Arrangements are classified as material or non-material. Material outsourcing needs due diligence, a written SLA with measurable service levels, a right to audit, confidentiality and data-location safeguards, a tested exit strategy and concentration-risk monitoring. Banks remain accountable to the regulator and to customers; core management, decision-making and compliance functions cannot be outsourced, and material IT outsourcing must be intimated to RBI.
People and compliance risk
People risk covers key-person dependency, inadequate training, poorly designed incentives, employee fraud and attrition in critical roles. Compliance risk is the risk of regulatory sanctions, financial loss or reputational damage from failure to comply with laws and regulations. It is managed through an independent compliance function, a compliance risk assessment, regulatory change tracking, and whistleblower channels.
Worked example
A bank outsources ATM switching. The vendor suffers ransomware; service is not restored within the four-hour RTO and the incident must be reported. Lessons: the exit strategy was never tested, the RTO was never validated at the vendor's site, and the SLA carried no recovery-time penalty. The bank stays answerable to RBI despite the vendor's failure.
Traps
- Confusing RTO (time to restore) with RPO (data loss tolerated).
- Believing outsourcing transfers regulatory accountability.
- Treating compliance risk as merely legal risk.
- Skipping annual BCP testing because the previous test passed.
- Overlooking concentration risk when several services sit with one vendor.