## Preface

## Source details

**Canonical URL:** [Preface](https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024068-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tar/2024/english/tarea2024068-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/tar/2024/english/tarea2024068-print-pdf.pdf.json)

---

### Mission scope and purpose
- A Monetary and Capital Markets (MCM) Department technical assistance (TA) mission provided central bank risk management TA to the Central Bank of Samoa (CBS) from August 14 to 18, 2023.
- Mission team: Paul Woods (MCM expert, Central Bank of Ireland), Chris Aylmer (MCM expert, formerly with the Reserve Bank of Australia), backstopped by Ashraf Khan (MCM, Central Bank Operations Division).
- Objectives:
  - Continue assisting the CBS in establishing an Enterprise Risk Management (ERM) Framework.
  - Complete an independent review of the progress made by the CBS in implementing recommendations from an earlier virtual mission (August–October 2021).
  - Engage senior stakeholders to: (i) further the diagnostic of governance and operation of risk management; (ii) identify areas for further progress; (iii) provide guidance based on international best practice.
  - Provide specific guidance to enhance governance, operations, and incident response capabilities for Business Continuity Management (BCM).

### Methodology and engagement
- Approach:
  - Desktop review of CBS documentation (documents listed in Appendix I).
  - Onsite meetings with CBS officers and non-executive Board members.
- Key participants in discussions included:
  - Mrs. Maiava Atalina Ainu'ū-Enari (Governor)
  - Mr. Gilbert Wongsin (Assistant Governor, Operations Group)
  - Non-executive Board members: Mr. Tuala Pat Leota and Mr. Tuala Falani Chan Tung
- Appendices:
  - Appendix I: Documents reviewed or consulted by the mission.
  - Appendix II: List of people met.
  - Appendix III: Schedule of meetings.

### Observations on progress (summary)
- Notable progress:
  - Development of a Risk Appetite Statement (RAS).
  - Amendments to the Board Audit Committee (BAC) Terms of Reference (ToR) to include oversight of risk management.
  - Departments compiling risk registers and appointing risk champions.
- Areas of slow progress:
  - Establishing the Risk Management Committee (RMC): members identified but ToR not approved and RMC not convened.
  - Embedding the Three Lines Model: outlined in draft Risk Management Policy (RMP) but not communicated; Risk Management function under-resourced and co-located within Internal Audit.
  - Incident reporting: incident information not systematically captured across the CBS.
  - Downstream effects: insufficient executive and Board time allocated for risk oversight; Integrated Risk Reporting (IRR) not developed; lack of top-down risk identification; BCM governance and practices need improvement.
- Mission validation:
  - The onsite mission validated the original 2021 recommendations; they remain relevant.
  - Supplemental recommendations provided to support continued implementation and prioritization.

### Key recommendations (extract)
- Risk Governance
  - R-A. Re-weight BAC agenda to ensure ongoing and proportionate oversight of risk management, including monitoring implementation and embedding of recommendations and receiving a comprehensive IRR. Completion: Q2-2024. Priority: High.
  - R-B. Establish and embed the RMC by finalizing ToR and convening regular meetings. Completion: Q2-2024. Priority: High.
  - R-C. Second Line to prioritize development of an Integrated Risk Report (IRR) for quarterly presentation to RMC and BAC, progressively integrating reporting across material risk categories. Completion: Q3-2024. Priority: High.
  - R-D. Progressively expand the remit of RMC to cover all material categories of risk, including financial risks. Completion: Q4-2024. Priority: Medium.
- Embedding the Three Lines of Defense Model
  - R-E. Strengthen tone from the top via regular communications from executive leadership to promote adherence to ERM and clarify First Line responsibilities. Completion: Q4-2024. Priority: High.
  - R-F. Strengthen Second Line risk management capacity; co-location of Second Line within Internal Audit exacerbates resource constraints. Completion: Q4-2024. Priority: High.
  - R-G. Develop supporting training material to help management and staff understand First Line responsibilities. Completion: Q4-2024. Priority: Medium.
- Business Continuity Management/Critical Incident Management
  - R-G. Further enhance governance of BCM by incorporating periodic oversight of BCM into RMC and BAC agendas. Completion: Q4-2024. Priority: High.
  - R-H. Establish a critical Incident Management Team (IMT) and supportive BCM framework to standardize CBS-wide responses to business continuity incidents. Completion: Q2-2025. Priority: High.
  - R-I. Develop a Business Impact Assessment (BIA) template to standardize documenting and prioritizing critical business processes, dependencies, and alternate processes for critical incidents. Completion: Q2-2025. Priority: Medium.

### Business Continuity Management (BCM) findings
- Existing components and gaps:
  - Some BCM components exist, but critical elements are missing:
    - No formalized Incident Management Team (IMT) with clear roles and responsibilities.
    - No standardized Business Impact Assessments (BIAs) to identify and prioritize critical processes.
  - Given capacity constraints in the Second Line, additional resourcing for BCM should be considered.

### Strategic considerations and concluding observations
- Implementation approach:
  - Recommendations account for the relative scale of the CBS; implementation will embed risk management as a responsibility of all management and staff, reinforcing First Line responsibilities.
  - Establishing and operating the RMC and developing the IRR are key to strengthening risk governance and ensuring timely, accurate, actionable risk information to governance committees.
- External environment:
  - External trends: risk exposures are broadening and deepening for central banks internationally; combined with the CBS project pipeline, advancing and embedding a coherent ERM framework is critical.
- Culture and resourcing:
  - Management and staff endorse further maturation of risk culture, but resource constraints require prioritized action and appropriate organizational placement of the ERM Framework.

### Progress in implementing previous recommendations (Table 2 summary)
- Status of selected recommendations (as reported):
  - 1. Establish a Risk Management Committee. — Partial — High
  - 2. Develop Terms of Reference for the RMC. — Partial — High
  - 3. Draft a Risk Management Policy for approval by the Board. — Partial — High
  - 4. Clearly define risk management roles and responsibilities. — Partial — Not assigned
  - 5. Include risk oversight within the terms of reference (ToR) for the Board Audit Committee. — Completed — Not assigned
  - 6. Adopt the Three Lines Model of risk management. — Partial — Not assigned
  - 7. Identify a risk management expert (or champion) in each department. — Completed — High
  - 8. Include risk management as a recurring item on executive and Board agendas. — Incomplete — High
  - 9. Departments to complete risk reporting templates (in an accurate and timely manner). — Partial — High
  - 10. Risk management staff to develop a standard Integrated Risk Report (IRR). — Incomplete — Not assigned
  - 11. Consider having risk management staff work on risk management tasks only, with separate reporting lines. — Incomplete — Not assigned
- Additional items:
  - 12. Risk management staff to draft the methodology for risk identification and assessment (based on a bottom-up and top-down approach). — Incomplete (Top-down) — High
  - 13. RMC to review, input and endorse the final approach to risk identification. — Incomplete — High
  - 14. Align leadership and the Board on the frequency of Strategic Risk Assessments (SRA). — Incomplete — Not assigned
  - 15. Risk management staff to draft a first draft of a CBS Risk Appetite Statement (RAS). — Completed — High
  - 16. Risk management staff to engage departments to define appropriate tolerances and thresholds. — Completed — High
  - 17. Over time, each risk category in the RAS to be represented in the Integrated Risk Report (IRR). — Incomplete — High
  - 18. Risk management staff to document the output of departmental input to the RAS to ensure senior management alignment on the materiality of risks. — Partial — High
  - 19. Formalize the governance and procedures for business continuity management (BCM). — Incomplete — High
  - 20. Create a critical Incident Management Team (IMT). — Incomplete — High
  - 21. Cultivate a support risk management culture at all levels. — Incomplete — Not assigned
  - 22. Guide the Board, leadership and staff through ongoing risk seminars and training. — Incomplete — Not assigned
  - 23. Engage with peers and IORWG on risk management. — Partial — Not assigned

- Summary implementation findings:
  - BAC ToR amended to include risk oversight; revised charter approved August 2022.
  - Draft RAS completed and departmental engagement undertaken; placement within draft RMP appendix needs broader embedding.
  - Risk management champions identified in each department.
  - RMC exists with Assistant Governor, Operations Group as chair, but ToR not drafted and committee not convened.
  - Draft Risk Management Policy exists but requires further work, including possible separation of RAS as standalone and clarification of roles and responsibilities.
  - The Three Lines Model proposed in draft RMP but practical training and embedding lacking.
  - Risk reporting templates in use but early stage; risk registers require quality review by the Second Line.
  - Senior management alignment on materiality of risks remains a work-in-progress.

### Observations on governance and capability
- Risk exposures widening, driven by major projects:
  - Samoan Automated Transfer System (SATS)
  - Central Securities Depository (CSD)
  - Establishment of a central credit bureau
  - Implementation of a revised AML/CTF regime
  - Building of a new disaster recovery site
- Governance shortfalls:
  - RMC ToR outstanding, weakening executive-level risk coordination and oversight.
  - Second Line co-located within Internal Audit, capacity constrained, insufficiently delineated from Internal Audit.
  - Incident reporting not systematic, causing loss of risk intelligence and impeding Internal Audit prioritization.
  - No developed top-down Strategic Risk Assessment (SRA) approach; lack of Integrated Risk Reporting (IRR) hampers transparency for executive and Board oversight.
  - Training and peer engagement limited; no observed provision of risk seminars and training at Board, executive, management, and staff levels, nor evidence of peer engagement with other central banks or the IORWG.

### Priority recommendations and required actions
- Reweight BAC agenda and embed an effective RMC:
  - Ensure proportionate agenda time for risk oversight (R-A).
  - Finalize the RMC Terms of Reference (R-B).
  - Ensure risk management is a recurring agenda item on executive and Board agendas (R8).
- Produce a standard Integrated Risk Report (IRR) as a priority for the Second Line:
  - Provide a clear, objective quarterly update on each category of risk relative to approved risk appetite thresholds (R-C).
  - Use the IRR to support RMC and BAC in constructive challenge and oversight.
- Bolster resourcing and independence of the Second Line function:
  - Review resource capacity for Second Line duties (R-F).
  - Consider establishment of an independent Second Line separate from Internal Audit in the medium to longer-term (R11).
- Expand the RMC role to include financial risk oversight:
  - RMC to provide executive-level risk guidance on financial risk matters such as limits frameworks, concentration, credit, and market risk (R-D).
- Embed the Three Lines Model and risk culture:
  - Communicate benefits and requirements of the Three Lines Model to management and staff to cultivate “every staff member being a risk manager” (R-G).
  - Provide ongoing training to First Line departments on their risk management responsibilities.
  - Ensure rewarding or acknowledging staff who raise issues to promote a healthy risk culture (R-E).
- Business Continuity Management (BCM) and Incident Management:
  - Define risk appetite for business continuity, including sub-statements such as acceptable recovery time for critical processes (example given: within four hours) and disaster recovery time for IT (DR).
  - Apply the Three Lines Model to BCM, coordinate BCM in the Second Line or another area within operations, and ensure broader departmental participation.
  - Implement Business Impact Analysis (BIA), risk assessment, development of business continuity plans including Incident Management Team formation, training/exercises/testing, and monitoring/updating/reporting.
  - Create and formalize a critical Incident Management Team (IMT) (R20).

### Oversight and governance of Business Continuity Management (paragraphs 26–33)
- Oversight and governance:
  - Business continuity represents one specialized category of risk but requires considerable co-ordination to ensure effective response readiness across the CBS.
  - RMC and BAC should maintain oversight and periodically seek assurance that the approach to BCM is appropriate (R-G).
  - Recommendation: Ensure RMC and BAC jointly maintain periodic oversight and assurance activities focused on BCM (R-G).
- Develop a CBS-wide approach to BCM:
  - Recommendation: Develop a CBS-wide approach to BCM, reflected in a Business Continuity Management Policy (R-H).
  - Recommendation: Formalize an Incident Management Team (IMT) to support co-ordination and response.
  - Recommendation: Provide regular updates on BCM “response readiness” in the Integrated Risk Report (IRR) (R-H).
- Business Impact Analysis (BIA):
  - Recommendation: Undertake a Business Impact Analysis (BIA) to:
    - identify what business processes exist;
    - determine the criticality of each process as it relates to achieving the CBS’s operational and strategic priorities;
    - identify what resources each process requires to function effectively, including dependencies on third parties;
    - assess the impact to CBS should the process become unavailable (R-I).
  - Benefits: better identification of interdependencies, development of appropriate recovery plans, and improved decision-making.
- Risk governance and culture recommendations (paragraphs 29–30):
  - Departmental management teams should periodically present on their risks once the RMC is established to reinforce risk ownership and embed the Three Lines Model; presentations should cover departmental risk profiles, priorities for risk mitigation, and learnings from recent incidents.
  - The Board, BAC, executive, and RMC play core roles in cultivating appropriate risk culture through consistent assertive and supportive tone, timely flow of relevant and accurate risk information, and constructive challenge from governance committees.
  - Emphasis: “All staff being risk managers” is important when resources are constrained.
- Concluding remarks and follow-up (paragraphs 31–33):
  - Status and priorities:
    - The CBS is on a journey to enhance and embed enterprise risk management practices (paragraph 31).
    - Further work is required to enhance risk governance—particularly the Executive’s ability to manage risk within approved risk appetite and the Board’s oversight of material risk exposures (paragraph 31).
    - Operationally establishing the Risk Management Committee and developing Integrated Risk Reporting are required (paragraph 31).
  - Importance:
    - Effective risk management will help safeguard the CBS in discharging its mandate amid increasing complexity of risk exposures (paragraph 32).
    - Embedding the Three Lines Model is especially important under constrained resources to cultivate “all staff being risk managers” (paragraph 32).
    - Effective risk governance and oversight help safeguard reputation, credibility, and independence by demonstrating governance, accountability, and transparency (paragraph 32).
  - Follow-up TA:
    - Recommendation: Actively monitor progress via a quarterly virtual review, followed by a more comprehensive on-site review after a period of one year (paragraph 33).

*The Central Bank of Samoa — IMF TA mission on central bank risk management (August 14–18, 2023); follow-up to virtual TA (August–October 2021) and the final TA report provided September 2022.*

### Preface.................................................................................................................

### Preface

### Mission scope and purpose
- A Monetary and Capital Markets (MCM) Department technical assistance (TA) mission provided central bank risk management TA to the Central Bank of Samoa (CBS) from August 14 to 18, 2023.
- Mission team: Paul Woods (MCM expert, Central Bank of Ireland), Chris Aylmer (MCM expert, formerly with the Reserve Bank of Australia), backstopped by Ashraf Khan (MCM, Central Bank Operations Division).
- Objectives:
  - Continue assisting the CBS in establishing an Enterprise Risk Management (ERM) Framework.
  - Complete an independent review of the progress made by the CBS in implementing recommendations from an earlier virtual mission (August–October 2021).
  - Engage senior stakeholders to: (i) further the diagnostic of governance and operation of risk management; (ii) identify areas for further progress; (iii) provide guidance based on international best practice.
  - Provide specific guidance to enhance governance, operations, and incident response capabilities for Business Continuity Management (BCM).

### Methodology and engagement
- Approach:
  - Desktop review of CBS documentation (documents listed in Appendix I).
  - Onsite meetings with CBS officers and non-executive Board members.
- Key participants in discussions included:
  - Mrs. Maiava Atalina Ainu'ū-Enari (Governor)
  - Mr. Gilbert Wongsin (Assistant Governor, Operations Group)
  - Non-executive Board members: Mr. Tuala Pat Leota and Mr. Tuala Falani Chan Tung
- Appendices:
  - Appendix I: Documents reviewed or consulted by the mission.
  - Appendix II: List of people met.
  - Appendix III: Schedule of meetings.

### Observations on progress (summary from Executive Summary)
- Notable progress:
  - Development of a Risk Appetite Statement (RAS).
  - Amendments to the Board Audit Committee (BAC) Terms of Reference (ToR) to include oversight of risk management.
  - Departments compiling risk registers and appointing risk champions.
- Areas of slow progress:
  - Establishing the Risk Management Committee (RMC): members identified but ToR not approved and RMC not convened.
  - Embedding the Three Lines Model: outlined in draft Risk Management Policy (RMP) but not communicated; Risk Management function under-resourced and co-located within Internal Audit.
  - Incident reporting: incident information not systematically captured across the CBS.
  - Downstream effects: insufficient executive and Board time allocated for risk oversight; Integrated Risk Reporting (IRR) not developed; lack of top-down risk identification; BCM governance and practices need improvement.

### Validation and supplemental guidance
- The onsite mission validated the original 2021 recommendations; they remain relevant.
- The mission provided supplemental recommendations to support continued implementation and prioritization.

### Key recommendations (extracted from Table 1)
- Risk Governance
  - R-A. Re-weight BAC agenda to ensure ongoing and proportionate oversight of risk management, including monitoring implementation and embedding of recommendations and receiving a comprehensive IRR. Completion: Q2-2024. Priority: High.
  - R-B. Establish and embed the RMC by finalizing ToR and convening regular meetings. Completion: Q2-2024. Priority: High.
  - R-C. Second Line to prioritize development of an Integrated Risk Report (IRR) for quarterly presentation to RMC and BAC, progressively integrating reporting across material risk categories. Completion: Q3-2024. Priority: High.
  - R-D. Progressively expand the remit of RMC to cover all material categories of risk, including financial risks. Completion: Q4-2024. Priority: Medium.
- Embedding the Three Lines of Defense Model
  - R-E. Strengthen tone from the top via regular communications from executive leadership to promote adherence to ERM and clarify First Line responsibilities. Completion: Q4-2024. Priority: High.
  - R-F. Strengthen Second Line risk management capacity; co-location of Second Line within Internal Audit exacerbates resource constraints. Completion: Q4-2024. Priority: High.
  - R-G. Develop supporting training material to help management and staff understand First Line responsibilities. Completion: Q4-2024. Priority: Medium.
- Business Continuity Management/Critical Incident Management
  - R-G. Further enhance governance of BCM by incorporating periodic oversight of BCM into RMC and BAC agendas. Completion: Q4-2024. Priority: High.
  - R-H. Establish a critical Incident Management Team (IMT) and supportive BCM framework to standardize CBS-wide responses to business continuity incidents. Completion: Q2-2025. Priority: High.
  - R-I. Develop a Business Impact Assessment (BIA) template to standardize documenting and prioritizing critical business processes, dependencies, and alternate processes for critical incidents. Completion: Q2-2025. Priority: Medium.

### Business Continuity Management (BCM) findings
- Some components for BCM exist, but critical elements are missing:
  - No formalized Incident Management Team (IMT) with clear roles and responsibilities.
  - No standardized Business Impact Assessments (BIAs) to identify and prioritize critical processes.
- Given capacity constraints in the Second Line, additional resourcing for BCM should be considered.

### Strategic considerations and concluding observations
- Recommendations account for the relative scale of the CBS; implementation will embed risk management as a responsibility of all management and staff, reinforcing First Line responsibilities.
- Establishing and operating the RMC and developing the IRR are key to strengthening risk governance and ensuring timely, accurate, actionable risk information to governance committees.
- External trends: risk exposures are broadening and deepening for central banks internationally; combined with the CBS project pipeline, advancing and embedding a coherent ERM framework is critical.
- Culture: Management and staff are aware of the benefits of structured risk management and endorse further maturation of risk culture, but resource constraints require prioritized action and appropriate organizational placement of the ERM Framework.

_The Central Bank of Samoa — IMF TA mission on central bank risk management (August 14–18, 2023); follow-up to virtual TA (August–October 2021) and the final TA report provided September 2022._

### 5.      Progress in implementing the recommendations is shown in Table 2 below.

### 5. Progress in implementing the recommendations is shown in Table 2 below.

### Table 2. Recommendations from the Previous Report
- 1. Establish a Risk Management Committee. — Partial — High
- 2. Develop Terms of Reference for the RMC. — Partial — High
- 3. Draft a Risk Management Policy for approval by the Board. — Partial — High
- 4. Clearly define risk management roles and responsibilities. — Partial — Not assigned
- 5. Include risk oversight within the terms of reference (ToR) for the Board Audit Committee. — Completed — Not assigned
- 6. Adopt the Three Lines Model of risk management. — Partial — Not assigned
- 7. Identify a risk management expert (or champion) in each department. — Completed — High
- 8. Include risk management as a recurring item on executive and Board agendas. — Incomplete — High
- 9. Departments to complete risk reporting templates (in an accurate and timely manner). — Partial — High
- 10. Risk management staff to develop a standard Integrated Risk Report (IRR). — Incomplete — Not assigned
- 11. Consider having risk management staff work on risk management tasks only, with separate reporting lines. — Incomplete — Not assigned

Risk Identification and Assessment
- 12. Risk management staff to draft the methodology for risk identification and assessment (based on a bottom-up and top-down approach). — Incomplete (Top-down) — High
- 13. RMC to review, input and endorse the final approach to risk identification. — Incomplete — High
- 14. Align leadership and the Board on the frequency of Strategic Risk Assessments (SRA). — Incomplete — Not assigned

Risk Appetite Statement
- 15. Risk management staff to draft a first draft of a CBS Risk Appetite Statement (RAS). — Completed — High
- 16. Risk management staff to engage departments to define appropriate tolerances and thresholds. — Completed — High
- 17. Over time, each risk category in the RAS to be represented in the Integrated Risk Report (IRR). — Incomplete — High
- 18. Risk management staff to document the output of departmental input to the RAS to ensure senior management alignment on the materiality of risks. — Partial — High

Business Continuity Management
- 19. Formalize the governance and procedures for business continuity management (BCM). — Incomplete — High
- 20. Create a critical Incident Management Team (IMT). — Incomplete — High

Other
- 21. Cultivate a support risk management culture at all levels. — Incomplete — Not assigned
- 22. Guide the Board, leadership and staff through ongoing risk seminars and training. — Incomplete — Not assigned
- 23. Engage with peers and IORWG on risk management. — Partial — Not assigned

### Summary of implementation and key findings
- Changes to the CBS Board Audit Committee terms of reference to include risk oversight (recommendation five). The revised charter of the BAC was approved by the CBS Board in August 2022.
- A draft Risk Appetite Statement (R15) has been completed and departments engaged to define tolerances and thresholds (R16). This material is placed within an appendix of the draft Risk Management Policy; further embedding across CBS is required.
- Risk management champions have been identified in each department (R7); these are the department managers who serve as designated representatives on the Risk Management Committee.
- The Risk Management Committee exists with the Assistant Governor, Operations Group as chair (R1) but the Committee’s terms of reference have not been drafted and the Committee has yet to be convened (R2).
- A draft Risk Management Policy exists (R3) but requires further work, including consideration to separate the RAS into a standalone document and to clarify roles and responsibilities from the Board down (R4).
- The Three Lines Model is proposed within the draft RMP (R6) but practical training and embedding across management and staff is lacking.
- Risk reporting templates are in use but are at an early stage of maturity; risk registers require quality review by the Second Line (R9).
- Senior management alignment on the materiality of risks (follow-up to RAS; R18) remains a work-in-progress.

### Observations on governance and capability
- There is an increasing breadth and depth of risk exposures, including information technology, cybersecurity, and third-party risks, driven by major projects such as:
  - Samoan Automated Transfer System (SATS)
  - Central Securities Depository (CSD)
  - Establishment of a central credit bureau
  - Implementation of a revised AML/CTF regime
  - Building of a new disaster recovery site
- Governance arrangements currently do not adequately support risk oversight or management. The RMC ToR remains outstanding, weakening executive-level risk coordination and oversight.
- The Second Line risk function is co-located within the Third Line internal audit team, is capacity constrained, and is insufficiently delineated from internal audit responsibilities.
- Incident reporting is limited; incidents are not identified and registered systematically (R9), causing loss of risk intelligence and impeding Internal Audit prioritization.
- There is no developed top-down Strategic Risk Assessment (SRA) approach (R12, R14), and the lack of Integrated Risk Reporting (IRR) (R10, R17) hampers transparency of the risk profile for executive and Board oversight.
- Training and peer engagement are limited; there was no observed provision of risk seminars and training at Board, executive, management, and staff levels (R22), nor evidence of peer engagement with other central banks or the IORWG (R23).

### Priority recommendations and required actions
- Reweight BAC agenda and embed an effective RMC:
  - Ensure proportionate agenda time for risk oversight (R-A).
  - Finalize the RMC Terms of Reference (R-B).
  - Ensure risk management is a recurring agenda item on executive and Board agendas (R8).
- Produce a standard Integrated Risk Report (IRR) as a priority for the Second Line:
  - Provide a clear, objective quarterly update on each category of risk relative to approved risk appetite thresholds (R-C).
  - Use the IRR to support RMC and BAC in constructive challenge and oversight.
- Bolster resourcing and independence of the Second Line function:
  - Review resource capacity for Second Line duties (R-F).
  - Consider establishment of an independent Second Line separate from internal audit in the medium to longer-term (R11).
- Expand the RMC role to include financial risk oversight:
  - RMC to provide executive-level risk guidance on financial risk matters such as limits frameworks, concentration, credit, and market risk (R-D).
- Embed the Three Lines Model and risk culture:
  - Communicate benefits and requirements of the Three Lines Model to management and staff to cultivate “every staff member being a risk manager” (R-G).
  - Provide ongoing training to First Line departments on their risk management responsibilities.
  - Ensure rewarding or acknowledging staff who raise issues to promote a healthy risk culture (R-E).
- Business Continuity Management (BCM) and Incident Management:
  - Define risk appetite for business continuity, including sub-statements such as acceptable recovery time for critical processes (example given: within four hours) and disaster recovery time for IT (DR).
  - Apply the Three Lines Model to BCM, coordinate BCM in the Second Line or another area within operations, and ensure broader departmental participation.
  - Implement Business Impact Analysis (BIA), risk assessment, development of business continuity plans including Incident Management Team formation, training/exercises/testing, and monitoring/updating/reporting (key BCM elements as listed).
  - Create and formalize a critical Incident Management Team (IMT) (R20).

### Conclusions from the onsite mission
- The onsite mission validated the September 2022 TA recommendations and emphasized that ERMF components should self-reinforce one another.
- Key areas requiring urgent focus are: finalization and convening of the RMC (including ToR), development of a standard IRR, strengthening and possibly separating the Second Line function, embedding the Three Lines Model with training, and formalizing BCM and critical incident response.

*IMF | SAMOA Central Bank Risk Management*

### 26. There is a need to ensure oversight of BCM by RMC and BAC. Business continuity

### 26. There is a need to ensure oversight of BCM by RMC and BAC. Business continuity

### Oversight and governance of Business Continuity Management (BCM)
- Business continuity represents one specialized category of risk but requires considerable co-ordination to ensure effective response readiness across the CBS.
- It is important that both the RMC and BAC maintain oversight and periodically seek assurance that the approach to BCM is appropriate (R-G).
- Recommendation: Ensure RMC and BAC jointly maintain periodic oversight and assurance activities focused on BCM (R-G).

### Develop a CBS-wide approach to BCM
- Recommendation: Develop a CBS-wide approach to BCM, reflected in a Business Continuity Management Policy (R-H).
- A co-ordination capacity should be built that does not negatively impact other risk management initiatives.
- Recommendation: Formalize an Incident Management Team (IMT) to support co-ordination and response.
- Recommendation: Provide regular updates on BCM “response readiness” in the Integrated Risk Report (IRR) (R-H).

### Business Impact Analysis (BIA)
- Recommendation: Undertake a Business Impact Analysis (BIA) to:
  - identify what business processes exist;
  - determine the criticality of each process as it relates to achieving the CBS’s operational and strategic priorities;
  - identify what resources each process requires to function effectively, including dependencies on third parties;
  - assess the impact to CBS should the process become unavailable (R-I).
- Benefits noted: better identification of interdependencies, development of appropriate recovery plans, and improved decision-making.

### Other observations on risk governance and culture (paragraphs 29–30)
- Recommendation: Departmental management teams should periodically present on their risks once the RMC is established to reinforce risk ownership and embed the Three Lines Model.
  - Presentations should cover departmental risk profiles, priorities for risk mitigation, and learnings from recent incidents.
  - These presentations support embedding the role of the RMC and reinforce a supportive tone from the top (paragraph 29).
- Recognize the interlinkage between risk governance and risk culture:
  - The Board, BAC, executive, and RMC play core roles in cultivating appropriate risk culture.
  - Requires a consistent assertive and supportive tone to clarify material risks, underlying trends, and mitigation priorities.
  - Requires timely flow of relevant and accurate risk information up and down the organization, and constructive challenge from governance committees (paragraph 30).
  - Note: “All staff being risk managers” is emphasized as important when resources are constrained.

### Concluding remarks and follow-up (paragraphs 31–33)
- Status and priorities:
  - The CBS is on a journey to enhance and embed enterprise risk management practices (paragraph 31).
  - Positive steps have been taken since previous technical assistance, but further work is required to enhance risk governance—particularly the Executive’s ability to manage risk within approved risk appetite and the Board’s oversight of material risk exposures (paragraph 31).
  - Work required includes operationally establishing the Risk Management Committee and developing Integrated Risk Reporting (paragraph 31).
- Importance:
  - Effective risk management will help safeguard the CBS in discharging its mandate amid increasing complexity of risk exposures (paragraph 32).
  - Embedding the Three Lines Model is especially important under constrained resources to cultivate “all staff being risk managers” (paragraph 32).
  - Effective risk governance and oversight help safeguard reputation, credibility, and independence by demonstrating governance, accountability, and transparency (paragraph 32).
- Follow-up TA:
  - Recommendation: Actively monitor progress via a quarterly virtual review, followed by a more comprehensive on-site review after a period of one year (paragraph 33).

*IMF | SAMOA Central Bank Risk Management — Extract covering paragraphs 26–33*

---


_Source: https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024068-print-pdf.pdf_