FFIEC IT Examination Handbook BCM-II.A: II.A Board and Senior Management Responsibilities (Business Continuity Management)

The board and senior management govern business continuity by setting the tone at the top across the whole operation including affiliates and third-party providers, evaluating continuity risk, setting short- and long-term continuity objectives, adopting policies and procedures, evaluating performance and adjusting operations to test results and events; the board assigns BCM responsibility and accountability, allocates resources, aligns BCM with strategy and risk appetite, adopts policies and plans, reviews results through reporting, testing and audit and provides credible challenge, while management defines roles, responsibilities and succession, allocates knowledgeable personnel and funding, validates that personnel understand their roles and builds resilience into business functions and the design of new products and services.