## Preface

## Source details

**Canonical URL:** [Preface](https://www.imf.org/-/media/files/publications/tar/2026/english/tarea2026021-source-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tar/2026/english/tarea2026021-source-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/tar/2026/english/tarea2026021-source-pdf.pdf.json)

---

### Mission context and leadership
- Mission conducted at the request of the Central Bank of Solomon Islands (CBSI).
- Monetary and Capital Markets Department (MCM) mission dates: July 21–25, 2025.
- Mission leaders: Paul Woods (MCM Short-Term Expert, Central Bank of Ireland) and Chris Aylmer (MCM Short-Term Expert, formerly with the Reserve Bank of Australia).
- Headquarters backstop: Ashraf Khan (MCM, Central Bank Operations Division).
- Mission purpose: provide technical support and guidance to CBSI on developing an Enterprise Risk Management (ERM) Framework and assess progress implementing prior recommendations.
- Prior related engagements: 2020 IMF Safeguards Assessment; virtual mission finalized in October 2021; onsite mission in August 2023; quarterly technical follow-ups by one of the short-term experts.

### Engagement approach and inputs
- Extensive engagement with senior CBSI stakeholders, including meetings with:
  - Dr. Luke Forau (Governor)
  - Mr. Raynold Moveni (Deputy Governor)
  - Mr. Joshua Tuasulia (Independent Member of the Board Audit and Risk Committee)
- Desktop review of documentation (list in Appendix III) and record of meetings (Appendix II).
- Quarterly technical follow-up calls summarized in Appendix IV.

### Objective of the July 2025 mission
- Independent assessment of CBSI’s progress implementing prior TA recommendations.
- Provide technical guidance on: Three Lines Model (TLM) implementation, business continuity management, and interaction with internal audit.
- Support maturation of ERM to safeguard the organization and inform strategic decision-making.

---

### Executive Summary

### Background and prior assistance
- CBSI requested IMF support to develop an enterprise-wide risk management framework following the 2020 IMF Safeguards Assessment.
- Prior TA: virtual mission August–October 2021; onsite mission in August 2023; two TA reports published in October 2022 and August 2024.
- Additional TA approved in 2024 and quarterly catch-up calls occurred between April 2024 and May 2025.

### Objectives of the July 2025 mission
- Review implementation of recommendations from the October 2022 and August 2024 reports and identify further progress required.
- Deliver targeted guidance on TLM implementation and business continuity management.

### Key progress milestones (selected)
- Risk Management Committee (RMC) inaugural meeting: September 2022.
- Board approved Enterprise Risk Management Policy (ERMP): December 2023.
- ERMP formally launched by the Governor: March 2024.
- Draft Business Continuity Management Plan (BCMP) prepared and reviewed by the RMC.
- Board Audit Committee charter amended and renamed Board Audit and Risk Committee (BARC).
- Board expanded BARC membership to include the Deputy Governor in August 2025 (identified as inconsistent with good governance practice and risking weakening separation between executive management and Board oversight).

### Remaining gaps in ERM (findings)
- Incident reporting: departments provide only basic incident information.
- Risk identification: absence of a top-down risk identification process.
- Risk Appetite Statement (RAS): draft contains an incomplete set of risk tolerances.
- Consequences:
  - Senior leadership lacks alignment on overall risk profile and most material enterprise risks.
  - No integrated risk report to support effective governance of risk.
  - Risk oversight by BARC limited and incident-focused due to insufficient quality risk information.

### Increasing importance of ERM (contextual events)
- SOLATS launched: April 2024.
- Cybersecurity incident: ransomware attack in May 2024 disrupted internal systems for up to two weeks.
- A three-year program to address identified gaps is underway.

### TA guidance provided (summary)
- Governance and implementation of the TLM, including:
  - Clarifying expectations for each line of defense.
  - Nominating the de facto Chief Risk Officer within CBSI.
- Defining and articulating risk tolerances as part of the RAS.
- Approaches to risk identification.
- Improvements to the incident reporting regime.

### Business continuity planning guidance (summary)
- BCMP should:
  - Clearly define governance arrangements and roles of the RMC, Risk Management Unit (RMU), and responsible departments.
  - Outline a structured approach to business continuity.
  - Establish a small critical Incident Management Team (IMT).
  - Embed testing and post incident reviews as core elements.
- Recommendation: keep the plan simple, prioritize high impact and more probable scenarios, and ensure regular testing.

### Commitment and recommended next steps
- RMU resourced with a team of three staff.
- Embedding the ERM framework requires:
  - Strong sponsorship at senior levels.
  - Effective risk governance by the RMC and BARC.
  - Consistent and frequent communication to foster desired risk culture.
  - Board reconsideration of BARC composition to preserve separation between executive management and Board oversight.
- Follow-up TA mission recommended within 18–24 months, including an Executive and Board workshop to assess progress.

---

### I. Introduction

### Background and earlier IMF engagement
- CBSI seeks to enhance ERM framework, practices, processes, and risk culture.
- Under the CBSI Act, the Board is responsible for “assessing risk and formulating contingency plans for the ongoing operations and security of the central bank.”
- 2020 IMF Safeguards Assessment concluded CBSI needed to strengthen risk management practices.
- Subsequent IMF TA: virtual August–October 2021; onsite August 2023.

### TA reports and follow-up
- Two TA reports: October 2022 and August 2024.
  - October 2022: recommendations to improve risk governance, ERM components, and risk culture.
  - August 2024: reviewed progress, provided further advice, and detailed guidance on business continuity management.
- Quarterly catch-up calls with IMF short-term experts between April 2024 and May 2025 summarized back to the IMF.

### July 2025 mission objectives and approach
- Two interrelated goals:
  - Review implementation of previous recommendations and identify areas for further progress.
  - Deliver targeted advice on TLM, business continuity management, and effective engagement with internal audit.
- Approach combined desktop review and extensive engagement with CBSI officers to assess current practices and provide practical guidance.

---

### II. Progress Evaluation

### CBSI mandate and transformation agenda
- CBSI responsibilities include: monetary policy, exchange rate management, holding and management of foreign exchange reserves, currency issuance, collection and publication of statistics, promoting a safe and efficient payment system, supervising financial institutions, acting as banker, financial adviser, and fiscal agent to the Government, and advancing financial inclusion.
- Transformation priorities: leadership capacity, addressing key-person dependencies, required skillsets, knowledge transfer, productivity improvements for approximately 170 staff, and reducing health-related absenteeism.
- Digital transformation spans payments infrastructure, financial inclusion, and modernization of internal systems.

### Digital transformation and IT modernization (facts)
- SOLATS (real-time gross settlement system) launched: April 2024.
- Retail payments module planned as next step.
- Partnership with Solomon Islands National Provident Fund (SINPF) to roll out a digital loan product in 2024.
- Modernization roadmap for IT systems developed with support from the US Trade and Development Agency.
- ICT Department staffing: nine staff; plans to expand the workforce over the coming year.
- Parallel IT projects: upgrades to SWIFT system, new data center as part of headquarters project, rebuilding production and disaster recovery servers, advising departments on updating/automating manual processes.

### Cybersecurity incident and resilience measures
- Cyber incident: May 2024; malware exploiting a zero-day vulnerability linked to staff VPN access compromised multiple systems and network services; encrypted data prevented operation of many processes.
- Internal systems unavailable for up to two weeks due to absence of a cyber incident response plan.
- Response support: Australian Government and CyberCX helped contain the incident.
- Post-incident measures:
  - Introduced a plan to reduce vulnerabilities.
  - Enhanced access controls across systems and applications.
  - Instituted quarterly IT reports to the Management Committee.
  - Scheduled regular penetration and backup testing.
  - Runs quarterly staff seminars on phishing, cyber hygiene, and common cyber threats.

### ERM framework observations
- ERM framework under development consists of ten interconnected components (referenced in Figure 1).
- Effective ERM requires all components to work in harmony and be supported by strong risk leadership.
- Preliminary observations indicated gaps across components.

---

### 11. Strengthening risk governance at CBSI

### Recent institutional developments (timeline items)
- RMCCD created: 2018, with two staff dedicated to risk management.
- Governor’s Office introduced enterprise-wide incident register template: 2021.
- BARC mandate expanded and renamed: August 2022.
- RMC ToR approved: August 2022; first meeting: September 2022; RMC chaired by the Deputy Governor.
- ERMP approved by the Board: late 2023; launched: March 2024.
- Membership of the International Operational Risk Working Group approved: December 2024.
- Mapping of selected critical processes completed with USAID support: 2025.

### Clarifying board vs executive roles (finding and recommendation)
- Board approved expansion of BARC membership to include Deputy Governor: August 2025.
- Recommended practice:
  - Preserve separation between executive management and oversight functions.
  - BARC should meet in private session at both the start and end of each meeting.
  - Deputy Governor should not be a formal member of BARC but could attend in an observer capacity or during open portions.

### RMC and ERM instruments (status)
- RMC actions: ToR approved August 2022; drafted ERMP; reviewed draft Business Continuity Management Policy.
- ERMP:
  - Approved late 2023; launched March 2024.
  - Revised draft includes a more detailed RAS covering 23 categories of risk and an appendix with tolerances for key risk indicators in selected categories (tolerances require further development).
- Risk Champion network:
  - RC ToRs approved: February 2024.
  - Department RCs appointed: March 2024.
  - Tailored risk training: December 2024; second exercise Q1-2025.
- RMU resourcing:
  - RMU fully staffed with a manager and two analysts (risk and compliance, and middle office).
  - Additional Risk and Compliance Analyst earmarked for recruitment in 2025 from graduate rotation program.
  - RMU staff trained in Power BI.

### Remaining gaps in the ERM framework (findings and consequences)
- Departments not consistently providing basic risk information.
- Only two departments currently maintain and regularly review risk registers.
- No top-down risk identification process to establish priority strategic risks.
- Departmental risk information often gathered through incident reports focused on low-level incidents.
- Draft RAS aligns tolerances with performance management framework designed for strategy execution rather than risk insights.
- Consequences:
  - Senior leadership lacks a shared view of CBSI’s overall risk profile and most material risks.
  - RMC unable to adopt a strategic role.
  - Development of an integrated risk report (IRR) hindered by limited and low-quality risk information.
  - Oversight narrow and incident-focused.

### Risk culture and reporting issues
- Risk culture gradually improving but uneven.
- Some departments prepared risk registers and departmental RAS; others have limited familiarity with ERMP and role of risk champions beyond incident reporting.
- Inconsistencies in incident reporting: significant incidents omitted, minor issues recorded.
- Delays in approving risk-related policies and templates.

### Oversight committees (recommendations)
- RMC should:
  - Move beyond summary incident reports and IT updates to strategic focus on overall risk profile.
  - Review assessments against the Bank’s risk appetite and use insights to inform decisions.
  - Adopt an enterprise-wide perspective.
- BARC should:
  - Re-balance agendas to allow more time for challenge.
  - Monitor implementation of outstanding recommendations.
  - Ensure access to a comprehensive Integrated Risk Report (IRR).

### Progress achieved and milestones
- Key milestones:
  - Establishing RMC.
  - Revising BARC ToR to include risk oversight.
  - Defining roles per the Three Lines Model.
  - Introducing incident and near-miss reporting framework.
  - Securing membership in International Operational Risk Working Group: December 2024.
- Integrated Risk Reporting progress:
  - Incident report produced for Management Committee and RMC.
  - March 2025: RMU Manager presented annual incident review and IRR outline to BARC.
  - Planned IRR to include: a risk appetite compliance assessment; CBSI’s most material risks; key risk indicators; updates on risk assessments and mitigation activities.

### Areas of slow progress and future priorities (recommendations and timelines)
- Prioritize development of RAS and IRR, supported by annual governance oversight cycle.
- Adopt a top-down process for identifying strategic risks; enhance IRR to capture cross-departmental risks.
- Regular staff communication to reinforce risk awareness and culture.
- Specific actions and timelines:
  - Finalize risk thresholds (tolerances) with departmental input: task expected in Q4-2025 and part of the Bank’s RAS.
  - Roll out phased consultation to map risk appetite to the Bank’s risk register over a phased project of 6 – 8 months with deadline Q1-2026.
  - Complete methodology for top-down and bottom-up risk identification and endorse risk assessment methodology by the RMC.
  - Improve BC framework: finalize BCM policy and establish IMT/Incident Response Taskforce with clearer governance (RMC review and Board approval processes referenced with Q2-2025 and Q3-2025 milestones noted in prior recommendations).

### Summary assessment
- Overall: Progress has moved from red to yellow since the last onsite mission; foundational steps completed but significant work remains.
- Key remaining challenges: inconsistent departmental risk reporting; lack of top-down strategic risk identification; incomplete RAS tolerances and alignment; limited IRR; uneven risk culture adoption.

---

### 23. Progress achieved, but critical priorities still lagging

### Summary findings
- One completed recommendation: reduce frequency of RMC meetings from monthly to bi-monthly; RMU reports improved productivity.
- Progress slow relative to suggested timeframes.
- Momentum has not focused on highest-priority initiatives: comprehensive RAS (including risk tolerances), improved risk identification processes, completion of the IRR.
- Resourcing issues partly resolved; stronger prioritization needed.

### Implementation of the Three Lines Model (observations and recommendations)
- Governance alignment: CBSI’s governance framework is aligned with TLM; clarity of governance reduces duplication and accountability gaps.
- To realize benefits, each line must take full ownership and actively carry out responsibilities.
- Enhancing BARC’s role:
  - BARC agenda should ensure sufficient time for risk at every meeting.
  - Key priorities: monitor ERM recommendation implementation; provide informed challenge; proactively engage with staff to assure priority risks are identified and managed.
  - Information should flow bidirectionally via departmental submissions and constructive challenge from RMU.
- BARC membership considerations:
  - Independence of members from day-to-day management is important.
  - International best practice: many central banks exclude executives from audit committee membership; executives may attend sessions without voting rights.
  - Deputy Governor as a BARC member could create perceived or actual conflict of interest.
- Keeping RMC strategic:
  - Near-term priorities: oversee setting of risk tolerances within RAS; identify priority risks; advance IRR development; strengthen first-line accountability by inviting departments to present risk profiles.
- Clarifying CRO role:
  - CBSI should clarify who performs the CRO function.
  - Option: Deputy Governor could assume CRO responsibilities given role as RMC chair.
- Strengthening second–third line communication:
  - Better communication between RMU (second line) and Internal Audit (third line) needed to avoid duplication and ensure coordinated oversight.
  - Second line: design and operation of the framework; Third line: independent assurance.

### Risk Appetite (observations and actions)
- Role: risk appetite and tolerances fundamental to ERM.
- Current ERMP coverage: limited. Latest draft introduces RAS addressing 23 risk categories; for each category the draft: describes the risk, nominates a risk appetite, identifies a risk owner, and assigns responsibility to Bank committees.
- Developing risk tolerances:
  - Current draft includes tolerances for selected key risk indicators across a subset of categories; require further development.
  - Effective tolerances should be quantifiable, objective, forward-looking, integrated into regular reporting, and periodically reviewed.
- Potential metrics discussed:
  - Data from CyberCX vulnerability assessment following the 2024 ransomware attack.
  - Staff participation in cyber awareness training.
  - Business continuity recovery time objective validated through scheduled tests (e.g., every six months).
  - Import coverage in months for foreign exchange reserves.
- Embedding tolerances:
  - Begin discussions with departmental management before organization-wide review.
  - RMC support required for departmental engagement.
  - Annual review of appropriateness built into governance timetables.

### Risk Identification (observations and recommendations)
- Need combined approach: institute top-down led by senior executives combined with bottom-up processes to capture operational risks.
- Standardize bottom-up processes:
  - All departments to complete risk registers using standard RMU template, reviewed after incidents or at least annually.
  - Template streamlined and focused on priority risks (e.g., departments nominate no more than 10).
  - RMU may specify common risks (e.g., fraud) for every department to assess.
  - Guidance on framing risk statements: “an event (), caused by (), with consequences for CBSI ()”.
- Managing increased risk data and tools:
  - RMU to manage larger information volumes using standardized templates and data analytics tools.
  - CBSI started training staff to use Microsoft Power BI and is considering an off-the-shelf risk management system.
  - TA advice: defer purchase until ERM more firmly embedded.

### Incident Reporting (observations and guidance)
- Current issues:
  - Confusion on distinction between risk register and incident register.
  - Not all serious events or material near misses reported.
  - Some reports capture business-as-usual issues better suited to help desks.
  - Perception that RMU plays a policing role.
- Purpose:
  - Incident and near-miss reporting designed as real-time feedback loop to strengthen awareness and resilience.
  - Near misses act as early warnings; incidents reveal risks not captured in registers.
- Guidance updates:
  - Revised guidance should explain why RMC values incident information, connection to risk registers, and importance of capturing unplanned events that result in—or have potential to result in—harm, damage, or loss.
  - Exclude minor business-as-usual events; special arrangements may be required for highly sensitive cases.
  - RMC discussion of incidents should focus on broader risk insights beyond case reviews.

### Business Continuity (findings and framework)
- Renewed focus after May 2024 ransomware attack.
- Draft BCMP prepared and reviewed by RMC; plan outlines objectives, examples of continuity events, planning framework using BIAs, incident response taskforce, committee roles, testing/reporting requirements.
- Clarifying governance roles:
  - RMC (supported by RMU) provides executive oversight; RMU could coordinate BCM but would need additional resources.
  - Implementation typically assigned to a specific department (often corporate services or IT).
- Structured BC framework components:
  - (i) Identify critical processes through a Business Impact Analysis (BIA) with a standard RMU template.
  - (ii) Conduct risk assessments to evaluate likelihood and impact.
  - (iii) Develop and document continuity plans informed by BIA and risk assessment.
  - (iv) Conduct training, exercises, and testing.
  - (v) Ensure ongoing monitoring, updating, and reporting.
  - Keep plan simple and flexible.
- Incident Management Team (IMT):
  - IMT should coordinate rapid responses with defined roles, activation criteria, communication channels, and regular drills.
  - Operations should align with IT recovery timelines and resource allocations; led by a senior staff member with authority to mobilize resources.
  - Post-incident reviews to capture lessons learned.
- Testing:
  - Testing and learning from events are essential.
  - Tests must reflect risk environment: natural disasters high probability; reputational risks acute if disruption is CBSI-sourced.

---

### V. Next Steps

### Prioritization and governance actions
- BARC must:
  - Dedicate focused time at each meeting to risk discussions, initially on ERM implementation progress, BC arrangements, and remedial actions following May 2024 ransomware attack.
  - Provide robust challenge to material and ensure clear accountability for follow-up actions.
- RMC priorities:
  - Align stakeholders on CBSI’s highest priority risks (supported by departmental presentations).
  - Approve the RAS and risk tolerances.
  - Shift discussions from operational detail to strategic insights.
  - Decide how to resource BCM and integrate governance into RMC remit.
  - Provide leadership communication reinforcing that all staff are risk managers.
  - Clarify who is responsible for the Chief Risk Officer function.
- RMU priorities:
  - Develop risk tolerances for each sub-category in the RAS in consultation with departments, the Board, and the RMC.
  - Provide templates and guidance for departmental risk registers.
  - Generate insights from departmental inputs and communicate to RMC, Board, and BARC.
  - Gradually build out the IRR.
- Departmental responsibilities:
  - Complete risk registers using RMU’s standard template and review after incidents or at least annually.
  - Ensure all incidents are included in these registers.
  - Identify and map critical business processes to allow BIAs and identify positions and systems most critical to CBSI operations.

---

### 52. Follow-up support and Board engagement

### Follow-up TA mission and Executive/Board workshop (recommendation)
- Recommendation: CBSI schedule a short follow-up TA mission within 18–24 months.
- Purposes:
  - Culminate in a risk management seminar and workshop for the Executive and Board.
  - Assess progress in embedding ERM framework.
  - Review lessons from incident reporting and business continuity testing.
  - Evaluate effectiveness of RAS, risk tolerances, and IRR.
- Suggested workshop content:
  - Case studies from peer central banks.
  - Scenario-based exercises to strengthen strategic risk identification.
  - Dedicated session on evolving role of the Board in risk oversight.
- Expected benefits:
  - Sustain momentum in ERM implementation.
  - Reinforce accountability.
  - Strengthen CBSI’s overall risk culture.

### Strengthening governance and risk culture (policy recommendations)
- Strengthen governance:
  - Apply the Three Lines Model with clear separation between management and Board oversight.
  - Ensure RMC and BARC provide visible, sustained leadership during implementation.
- Build supportive risk culture:
  - Address weaknesses: limited review/challenge, reluctance to report incidents, siloed first-line practices, lack of strategic appreciation for ERM benefits.
- Maintain momentum:
  - Advance initiatives: revised ERMP, departmental risk register template, business continuity management policy.
  - Requirements: clear organizational priorities, defined accountability, visible support from senior leadership and the Board.
- Business continuity as a test:
  - Readiness measured by ability to minimize impact on CBSI and the wider Solomon Islands community.
  - Credibility depends on demonstrating learning from past experiences and effective response capability.

### Summary policy recommendations (concise list)
- Schedule follow-up TA mission within 18–24 months including an Executive and Board workshop.
- Use the workshop to assess ERM embedding and incident/business continuity lessons; review RAS, risk tolerances, and IRR effectiveness; deliver case studies and scenario-based exercises; clarify the Board’s evolving role.
- Strengthen governance by applying the Three Lines Model and ensuring RMC and BARC provide visible leadership.
- Strengthen risk culture by addressing identified weaknesses (review/challenge, incident reporting, first-line integration, strategic appreciation).

*Content unit "tarea2026021-source-pdf - Preface" from the provided PDF content.*

### Preface ................................................................................................................

### Preface

### Mission context and leadership
- Mission conducted at the request of the Central Bank of Solomon Islands (CBSI).
- Monetary and Capital Markets Department (MCM) mission dates: July 21–25, 2025.
- Mission leaders: Paul Woods (MCM Short-Term Expert, Central Bank of Ireland) and Chris Aylmer (MCM Short-Term Expert, formerly with the Reserve Bank of Australia).
- Headquarters backstop: Ashraf Khan (MCM, Central Bank Operations Division).
- Mission purpose: provide technical support and guidance to CBSI on developing an Enterprise Risk Management (ERM) Framework and assess progress implementing prior recommendations.
- Prior related engagements: 2020 IMF Safeguards Assessment; virtual mission finalized in October 2021; onsite mission in August 2023; quarterly technical follow-ups by one of the short-term experts.

### Engagement approach and inputs
- Extensive engagement with senior CBSI stakeholders, including meetings with:
  - Dr. Luke Forau (Governor)
  - Mr. Raynold Moveni (Deputy Governor)
  - Mr. Joshua Tuasulia (Independent Member of the Board Audit and Risk Committee)
- Desktop review of documentation (list in Appendix III) and record of meetings (Appendix II).
- Quarterly technical follow-up calls summarized in Appendix IV.

### Objective of the July 2025 mission
- Independent assessment of CBSI’s progress implementing prior TA recommendations.
- Provide technical guidance on: Three Lines Model (TLM) implementation, business continuity management, and interaction with internal audit.
- Support maturation of ERM to safeguard the organization and inform strategic decision-making.

### _Source: Preface section of the content unit_

---

### Executive Summary

### Background and prior assistance
- CBSI requested IMF support to develop an enterprise-wide risk management framework following the 2020 IMF Safeguards Assessment.
- Prior TA: virtual mission August–October 2021; onsite mission in August 2023; two TA reports published in October 2022 and August 2024.
- Additional TA approved in 2024 and quarterly catch-up calls occurred between April 2024 and May 2025.

### Objectives of the July 2025 mission
- Review implementation of recommendations from the October 2022 and August 2024 reports and identify further progress required.
- Deliver targeted guidance on TLM implementation and business continuity management.

### Progress since previous TA
- Risk Management Committee (RMC) inaugural meeting: September 2022.
- Board approved Enterprise Risk Management Policy (ERMP): December 2023.
- ERMP formally launched by the Governor: March 2024.
- A revised draft ERMP under review includes a strengthened Risk Appetite Statement.
- Draft Business Continuity Management Plan (BCMP) prepared and reviewed by the RMC.
- Board Audit Committee charter amended to include risk oversight and renamed Board Audit and Risk Committee (BARC).
- Board expanded BARC membership to include the Deputy Governor in August 2025 (identified as inconsistent with good governance practice and risking weakening separation between executive management and Board oversight).

### Remaining gaps in ERM
- Incident reporting: departments provide only basic incident information.
- Risk identification: absence of a top-down risk identification process.
- Risk Appetite Statement (RAS): draft contains an incomplete set of risk tolerances.
- Consequences:
  - Senior leadership lacks alignment on overall risk profile and most material enterprise risks.
  - No integrated risk report to support effective governance of risk.
  - Risk oversight by BARC limited and incident-focused due to insufficient quality risk information.

### Increasing importance of ERM
- Digital transformation and an increasingly complex operating environment heighten ERM importance.
- Key milestone: launch of the Solomon Islands Automated Transfer System (SOLATS), a real-time gross settlement system, in April 2024.
- Cybersecurity incident: ransomware attack in May 2024 disrupted internal systems for up to two weeks.
- A three-year program to address identified gaps is underway.

### Risk culture and oversight challenges
- Risk culture showing signs of improvement but uneven across the Bank.
- Limited challenge from RMC and BARC; incident and risk registers incomplete; slow approval of risk policies and templates.
- Some staff unclear about roles and responsibilities under the TLM.
- Need to strengthen committee discussions and ensure risk oversight bodies actively drive initiatives.

### TA guidance provided
- Governance and implementation of the TLM, including:
  - Clarifying expectations for each line of defense.
  - Nominating the de facto Chief Risk Officer within CBSI.
- Defining and articulating risk tolerances as part of the RAS.
- Approaches to risk identification.
- Improvements to the incident reporting regime.

### Business continuity planning guidance
- BCMP under review; to be effective it should:
  - Clearly define governance arrangements and roles of the RMC, Risk Management Unit (RMU), and responsible departments.
  - Outline a structured approach to business continuity.
  - Establish a small critical Incident Management Team (IMT).
  - Embed testing and post incident reviews as core elements.
- TA recommended keeping the plan simple, prioritizing high impact and more probable scenarios, and ensuring regular testing.

### Commitment and recommended next steps
- CBSI has allocated resources, established structure, and resourced its second-line function with a team of three staff.
- Embedding the ERM framework requires:
  - Strong sponsorship at senior levels.
  - Effective risk governance by the RMC and BARC.
  - Consistent and frequent communication to foster desired risk culture.
  - Board reconsideration of BARC composition to preserve separation between executive management and Board oversight.
- Follow-up TA mission recommended within 18–24 months, including an Executive and Board workshop to assess progress in embedding the ERM framework.

### _Source: Executive Summary section of the content unit_

---

### I. Introduction

### Background and earlier IMF engagement
- CBSI seeks to enhance ERM framework, practices, processes, and risk culture.
- Under the CBSI Act, the Board is responsible for “assessing risk and formulating contingency plans for the ongoing operations and security of the central bank.”
- 2020 IMF Safeguards Assessment concluded CBSI needed to strengthen risk management practices.
- Subsequent IMF TA: virtual August–October 2021; onsite August 2023.

### TA reports and follow-up
- Two TA reports: October 2022 and August 2024.
  - October 2022: recommendations to improve risk governance, ERM components, and risk culture.
  - August 2024: reviewed progress, provided further advice, and detailed guidance on business continuity management.
- Quarterly catch-up calls with IMF short-term experts between April 2024 and May 2025 summarized back to the IMF.

### July 2025 mission objectives and approach
- Two interrelated goals:
  - Review implementation of previous recommendations and identify areas for further progress.
  - Deliver targeted advice on TLM, business continuity management, and effective engagement with internal audit.
- Approach combined desktop review and extensive engagement with CBSI officers to assess current practices and provide practical guidance.

### _Source: I. Introduction section of the content unit_

---

### II. Progress Evaluation

### CBSI mandate and transformation agenda
- CBSI responsibilities include: monetary policy, exchange rate management, holding and management of foreign exchange reserves, currency issuance, collection and publication of statistics, promoting a safe and efficient payment system, supervising financial institutions, acting as banker, financial adviser, and fiscal agent to the Government, and advancing financial inclusion.
- Bank’s mandate expected to broaden as Government reviews legislation on AML/CFT, credit reporting, and financial supervision.
- Transformation priorities include leadership capacity, addressing key-person dependencies, required skillsets, knowledge transfer, productivity improvements for approximately 170 staff, and reducing health-related absenteeism.
- Digital transformation spans payments infrastructure, financial inclusion, and modernization of internal systems.

### Digital transformation and IT modernization
- SOLATS (real-time gross settlement system) launched: April 2024.
- Retail payments module planned as next step.
- Partnership with Solomon Islands National Provident Fund (SINPF) to roll out a digital loan product in 2024.
- Modernization roadmap for IT systems developed with support from the US Trade and Development Agency.
- ICT Department staffing: nine staff; plans to expand the workforce over the coming year.
- Parallel IT projects: upgrades to SWIFT system, new data center as part of headquarters project, rebuilding production and disaster recovery servers, advising departments on updating/automating manual processes.

### Cybersecurity incident and resilience measures
- Cyber incident: May 2024; malware exploiting a zero-day vulnerability linked to staff VPN access compromised multiple systems and network services; encrypted data prevented operation of many processes.
- Internal systems unavailable for up to two weeks due to absence of a cyber incident response plan.
- Response support: Australian Government and CyberCX (private security firm) helped contain the incident.
- Post-incident measures:
  - Introduced a plan to reduce vulnerabilities.
  - Enhanced access controls across systems and applications.
  - Instituted quarterly IT reports to the Management Committee.
  - Scheduled regular penetration and backup testing.
  - Runs quarterly staff seminars on phishing, cyber hygiene, and common cyber threats.

### ERM framework observations
- ERM framework under development consists of ten interconnected components (referenced in Figure 1).
- Effective ERM requires all components to work in harmony and be supported by strong risk leadership.
- Preliminary observations indicated gaps across components (Figure 1 marked observations in grey).

### _Source: II. Progress Evaluation section of the content unit_

---

*Italic source attribution: Content unit "tarea2026021-source-pdf - Preface" from the provided PDF content.*

### 11. Strengthening risk governance at CBSI. The Central Bank of Solomon Islands (CBSI) has

### 11. Strengthening risk governance at CBSI

### Recent institutional developments
- In 2018, a Risk Management and Corporate Communications Department (RMCCD) was created, with two staff dedicated to risk management.
- In 2021, the Governor’s Office introduced an enterprise-wide incident register template to support systematic reporting of risk events.
- In August 2022, the Board Audit Committee’s mandate was expanded to include oversight of CBSI’s risk management practices and the committee was renamed the Board Audit and Risk Committee (BARC).
- In August 2022, the RMC’s terms of reference were approved by the Board; the RMC held its first meeting in September 2022 and is chaired by the Deputy Governor.
- The ERMP was approved by the Board in late 2023 and formally launched by the Governor in March 2024.
- In December 2024, CBSI’s application for membership of the International Operational Risk Working Group was approved.
- With support from the USAID TA program for ICT modernization, CBSI completed the mapping of selected critical processes in 2025.

### Clarifying board vs executive roles
- In August 2025, the Board approved the expansion of the BARC’s membership to include the Deputy Governor.
- Good practice guidance in the report: preserve separation between executive management and oversight functions. Recommended practice:
  - BARC should continue to meet in private session at both the start and end of each meeting to consider agenda items and reflect on issues raised.
  - The Deputy Governor should not be a formal member of the BARC but could be invited to attend specific discussions in an observer capacity or to participate only during the open portions of the meeting.

### Risk Management Committee (RMC) and ERM instruments
- RMC key actions:
  - Chaired by the Deputy Governor; ToR approved August 2022; first meeting September 2022.
  - One of its initial tasks was to draft the Bank’s ERMP.
  - RMC reviewed a draft Business Continuity Management Policy.
- Enterprise Risk Management Policy (ERMP):
  - Approved by the Board in late 2023; launched March 2024.
  - Outlines approach to managing risk, defines roles and responsibilities, and introduces common terminology.
  - Each department nominated a risk champion to support implementation.
  - A revised draft ERMP is under review; significant addition is a more detailed RAS (not included in original policy).
  - The latest draft of the ERMP includes a RAS covering 23 categories of risk and an appendix that sets out tolerances for key risk indicators in selected categories (these tolerances require further development).
- Risk Champion network:
  - Risk Champion (RC) ToRs approved by the Management Committee in February 2024.
  - Department RCs appointed in March 2024.
  - RMU arranged tailored risk training workshop for RCs in December 2024; a second training exercise organized in Q1-2025.
- RMU resourcing:
  - RMU is now fully staffed with a manager and two analysts (risk and compliance, and middle office).
  - An additional position - Risk and Compliance Analyst - has been earmarked for recruitment in 2025 from the graduate rotation program.
  - Staff in RMU have undertaken training in Power BI.

### Remaining gaps in the ERM framework
- Incomplete or inconsistent practices:
  - Departments are not consistently providing basic risk information.
  - Only two departments currently maintain and regularly review risk registers.
  - There is no top-down risk identification process to establish priority risks with a strategic focus.
  - Much departmental risk information is gathered through incident reports submitted by risk champions; these reports are often focused on low level and less impactful incidents.
  - Clearer expectations are needed regarding reporting requirements and the role of risk champions.
  - The draft RAS aligns tolerances with indicators from the Bank’s performance management framework, which is designed to monitor strategy execution rather than generate risk insights and assurance.
- Consequences:
  - Senior leadership lacks a shared and aligned view of CBSI’s overall risk profile and its most material risks.
  - RMC has been unable to adopt a more strategic role or fully realize the benefits of an effective ERM framework.
  - Development of an integrated risk report (IRR) has been hindered by limited and low-quality risk information.
  - Oversight has tended to be narrow, focusing mainly on individual incidents (example: BARC January meeting reviewed only the annual summary of incidents and discussed future implementation of the ERM framework).

### Risk culture and reporting issues
- Risk culture:
  - Gradually improving; risk considerations are beginning to feature in some day-to-day departmental discussions.
  - Progress is inconsistent across the organization.
  - One department compiled its own risk register and explored a departmental risk appetite statement; other departments showed limited familiarity with the ERMP and the role of risk champions beyond incident reporting.
  - Inconsistencies in risk reporting: some significant incidents omitted while minor issues recorded.
  - Delays in approving new risk-related policies and templates reflect uneven uptake.
- Oversight committees:
  - RMC should move beyond summary incident reports and periodic IT updates to a more strategic focus on CBSI’s overall risk profile.
  - RMC should review assessments against the Bank’s risk appetite and use insights to inform risk, investment, and policy decisions.
  - Members should adopt an enterprise-wide perspective rather than a departmental one.
  - Oversight could be improved by streamlining the information provided to the Management Committee and the RMC due to current overlap.
  - BARC should re-balance agendas to allow more time for challenge, monitor implementation of outstanding recommendations, and ensure access to a comprehensive Integrated Risk Report (IRR).

### Progress achieved and milestones
- Key milestones completed:
  - Establishing the RMC.
  - Revising the BARC’s terms of reference to incorporate oversight of risk management.
  - Defining risk management roles and responsibilities in line with the Three Lines Model.
  - Introducing an incident and near-miss reporting framework.
  - Securing membership in the International Operational Risk Working Group in December 2024.
- Specific progress areas:
  - Integrated Risk Reporting: One component of the IRR, the incident report, is now produced for both the Management Committee and the RMC. In March 2025, the RMU Manager presented an annual incident review and an outline of the proposed IRR to the BARC. The planned IRR will include:
    - a risk appetite compliance assessment,
    - CBSI’s most material risks,
    - key risk indicators,
    - updates on risk assessments and risk mitigation activities.
  - Risk Appetite: Latest draft ERMP includes a RAS covering 23 categories of risk; an appendix sets out tolerances for key risk indicators in selected categories (further development required).
  - Risk Identification: ERMP incorporates standardized risk rating matrices and detailed coverage of risk identification; no formal top-down process for identifying strategic risks yet. RMU prepared a template and guidance materials pending approval.
  - Business Continuity Management: A draft Business Continuity Management Policy is under active review by the RMC; proposed establishment of an incident response taskforce as part of the plan.
  - Resourcing: RMU now fully staffed with a manager and two analysts after prior under-staffing due to extended study leave.

### Areas of slow progress and future priorities (recommendations summarized)
- Priorities reiterated from previous TA reports:
  - Prioritize development of the Risk Appetite Statement (RAS) and Integrated Risk Report (IRR), supported by an annual governance oversight cycle.
  - Adopt a top-down process for identifying strategic risks and enhance the IRR to capture cross-departmental risks.
  - Regular staff communication to reinforce risk awareness and culture.
- Specific items from assessment tables and prior recommendations:
  - Embed the Three Lines Model fully (work in progress; RMU and Internal Audit developing charters).
  - Improve effectiveness of the BARC and RMC: re-weight BARC agenda to focus more on strategic risk oversight; RMC to shift from incident-focused reporting to enterprise-wide risk profiling.
  - Align leadership on risk materiality and calibrate integrated risk reporting to reflect the structure of the final RAS.
  - Cultivate the risk champion network and set clearer expectations for reporting and roles.
  - Finalize risk thresholds (tolerances) with departmental input: task expected to be undertaken in Q4-2025 and part of the Bank’s RAS.
  - Roll out phased consultation to map risk appetite to the Bank’s risk register over a phased project of 6 – 8 months with a deadline of Q1-2026.
  - Complete methodology for top-down and bottom-up risk identification and endorse risk assessment methodology by the RMC.
  - Improve the Business Continuity Management framework: finalize BCM policy and establish Incident Management Team/Incident Response Taskforce with clearer governance (RMC review and Board approval processes referenced with Q2-2025 and Q3-2025 milestones noted in prior recommendations).

### Summary assessment
- Overall view: Progress has moved from red to yellow since the last onsite mission, with important foundational steps completed, but significant work remains to build a strategic, enterprise-wide ERM capability.
- Key remaining challenges: inconsistent departmental risk reporting, lack of top-down strategic risk identification, incomplete RAS tolerances and alignment, limited integrated risk reporting, and uneven risk culture adoption.

*IMF Technical Assistance Report*

### 23. Progress achieved, but critical priorities still lagging. The overlap between the two TA

### 23. Progress achieved, but critical priorities still lagging

### Summary findings
- One completed recommendation: reduce frequency of RMC meetings from monthly to bi-monthly, which the RMU reports has improved productivity by freeing up time to implement the framework.
- Progress has been made in several areas, but it remains slow and has not kept pace with suggested timeframes.
- Momentum has not focused on highest-priority initiatives: development of a comprehensive Risk Appetite Statement (including risk tolerances), improved risk identification processes, and completion of the IRR.
- Resourcing issues have been partly resolved, but stronger prioritization is needed to deliver critical elements.

### IV. Other Observations — A. Implementation of the Three Lines Model of Risk Management
- Governance alignment
  - CBSI’s governance framework is aligned with the Three Lines Model (TLM) of risk management.
  - TLM’s main strength: clarity of governance with well-defined roles and responsibilities that reduce duplication, confusion, and accountability gaps.
  - To realize benefits, each line must take full ownership and actively carry out responsibilities.

- Enhancing BARC’s risk oversight role
  - BARC agenda should deliver consistent and proportionate oversight of risk management, with sufficient time dedicated to risk at every meeting.
  - Key priorities: monitoring implementation of outstanding ERM recommendations; providing informed challenge on risk issues; proactively engaging with staff to assure Board and BARC that priority risks are being identified, assessed, and effectively managed.
  - Information should flow bidirectionally via departmental submissions and constructive challenge from the RMU, with oversight by the RMC and BARC guiding the IRR’s structure and content.

- BARC membership considerations
  - BARC’s effectiveness depends on independence of its members from day-to-day management.
  - International best practice (Basel Core Principles and OECD guidelines): many central banks exclude executives from audit committee membership; executives may attend specific sessions without voting rights.
  - Deputy Governor’s operational and strategic responsibilities could create a perceived or actual conflict of interest if a BARC member.

- Keeping the RMC strategic and disciplined
  - RMC must prioritize work to avoid becoming overly administrative.
  - Near-term priorities: oversee setting of risk tolerances within the RAS, identify the Bank’s priority risks, advance development of the IRR, and strengthen first-line accountability by inviting departments to present risk profiles.
  - Discussions should shift from operational detail to strategic risk insights.

- Clarifying the Chief Risk Officer role
  - CBSI should clarify who performs the CRO function to ensure the TLM operates as an integrated, strategic system.
  - Option: Deputy Governor could assume CRO responsibilities given role as RMC chair and ability to mobilize resources.

- Strengthening second–third line communication
  - Better communication between the RMU (second line) and Internal Audit (third line) is critical to avoid duplication and ensure coordinated oversight.
  - Timely information-sharing enables second line to provide insights on emerging risks and third line to refine audit priorities.
  - Second line: design and operation of the framework; Third line: independent assurance that ERM operates effectively.

### IV. Other Observations — B. Risk Appetite
- Role of risk appetite
  - Risk appetite and risk tolerances are fundamental to ERM, defining risk types and levels acceptable in pursuit of objectives.

- Current ERMP coverage
  - Current ERMP provides only limited coverage of risk appetite.
  - Latest draft introduces a RAS that addresses 23 risk categories; for each category the draft: describes the risk, nominates a risk appetite, identifies a risk owner, and assigns responsibility for certain risks to specific Bank committees (e.g., Monetary Policy Committee, Financial Stability Committee).

- Developing risk tolerances
  - Risk tolerances translate risk appetite into practical thresholds guiding operations.
  - Current draft includes tolerances for selected key risk indicators across a subset of categories, but these require further development.
  - Effective tolerances should be quantifiable, objective, forward-looking, integrated into regular reporting, and periodically reviewed.

- Potential metrics for risk tolerances (identified in discussions)
  - Data from the vulnerability assessment performed by CyberCX following the ransomware attack in 2024;
  - Staff participation in cyber awareness training;
  - A business continuity recovery time objective specifying how quickly CBSI can transition from primary to backup servers, validated through scheduled tests (e.g., every six months);
  - Import coverage in months for foreign exchange reserves.

- Embedding tolerances
  - Discussions should begin with departmental management before organization-wide review.
  - RMC support required for departmental engagement.
  - Annual review of appropriateness should be built into governance timetables.

### IV. Other Observations — C. Risk Identification
- Need for combined approach
  - CBSI has been slow to define its risk profile and align stakeholders on priority risks; only a few departments compile risk registers and there is no structured top-down process for strategic risks.
  - Recommendation: institute a top-down approach led by senior executives combined with bottom-up processes to capture operational risks and surface blind spots.

- Standardizing bottom-up processes
  - RMC should ensure all departments complete risk registers using a standard RMU template, reviewed after incidents or at least annually.
  - Template should be streamlined, supported by clear guidance, and focused on priority risks (e.g., departments could be asked to nominate no more than 10).
  - RMU may specify a set of common risks (e.g., fraud) that every department assesses.
  - Guidance on framing risk statements: “an event (), caused by (), with consequences for CBSI ()”.

- Managing increased risk data and tools
  - RMU must manage larger volumes of information using standardized templates (primarily Excel) and data analytics tools.
  - CBSI has started training staff, including RMU, to use Microsoft Power BI for data aggregation and is considering purchase of an off-the-shelf risk management system.
  - TA advice: defer purchase until ERM is more firmly embedded so CBSI can better assess and select the most suitable option.

### IV. Other Observations — D. Incident Reporting
- Current state and issues
  - Incident reporting has raised risk awareness but confusion remains: staff unclear on distinction between risk register and incident register; not all serious events or material near misses are reported; some reports capture business-as-usual issues better suited to facilities or IT help desks.
  - Guidance needed for managing sensitive incidents (e.g., whistleblower hotline); perception exists that RMU plays a policing role.

- Purpose of incident and near-miss reporting
  - Designed as a real-time feedback loop to strengthen risk awareness, resilience, and continuous improvement.
  - Near misses act as early warnings; incidents reveal risks not captured in registers.
  - Analysis of incidents prevents recurrence, reinforces open reporting culture, and highlights systemic weaknesses through data patterns.

- Updating guidance
  - Revised guidance should explain why RMC values incident information, how incident registers connect to risk registers, and importance of capturing unplanned events that result in—or have potential to result in—harm, damage, or loss to CBSI.
  - While excluding minor business-as-usual events is normal, special arrangements may be required for a narrow set of highly sensitive cases.
  - RMC discussion of incidents should focus on broader risk insights beyond case reviews.

### IV. Other Observations — E. Business Continuity
- Renewed focus
  - Greater emphasis on business continuity following the May 2024 ransomware attack.
  - Draft Business Continuity Management Plan (BCMP) prepared and reviewed by the RMC; plan outlines objectives, examples of continuity events, planning framework using business impact assessments, incident response task force, committee roles, and testing/reporting requirements.

- Clarifying governance roles
  - Draft BCMP needs clearer governance articulation: RMC (supported by RMU) provides executive oversight but not direct implementation.
  - RMU could coordinate BCM but additional resources would be needed to avoid undermining second-line responsibilities.
  - Implementation typically assigned to a specific department (often corporate services or IT for IT disaster recovery).

- Structured BC framework (components)
  - (i) Identify critical processes through a Business Impact Analysis (BIA) with a standard RMU template, building on USAID IT modernization work;
  - (ii) Conduct risk assessments to evaluate likelihood and impact of threats;
  - (iii) Develop and document continuity plans informed by BIA and risk assessment and implement mitigation measures;
  - (iv) Conduct training, exercises, and testing;
  - (v) Ensure ongoing monitoring, updating, and reporting.
  - Keep plan simple and flexible.

- Incident Management Team (IMT)
  - IMT should coordinate rapid responses with defined roles, activation criteria, communication channels, and regular drills.
  - Operations should align with IT recovery timelines and resource allocations; led by a senior staff member with authority to mobilize resources.
  - Post-incident reviews to capture lessons learned.

- Testing
  - Testing and learning from internal and external events are essential.
  - Testing must reflect risk environment: natural disasters pose high probability of disruption in Solomon Islands; reputational risks are more acute if disruption is CBSI-sourced.
  - Testing scope and schedule should reflect this distinction to build credibility and resilience.

### V. Next Steps
- Prioritization overview
  - Figure provided in source indicates how tasks might be prioritized over the next year and a half.

- BARC role
  - BARC must dedicate focused time at each meeting to risk discussions, initially on ERM implementation progress, reviewing business continuity arrangements and remedial actions following the May 2024 ransomware attack.
  - BARC should provide robust challenge to material presented and ensure clear accountability for follow-up actions.
  - IMF Working Paper referenced: Risk Management Maturity at Central Banks (WP/19/303).

- RMC priorities
  - Align stakeholders on CBSI’s highest priority risks (supported by departmental risk profile presentations);
  - Approve the RAS and risk tolerances;
  - Elevate meeting discussions from operational detail to strategic insights;
  - Decide how to resource BCM and integrate its governance into RMC remit;
  - Provide greater leadership communication reinforcing that all staff are risk managers;
  - Clarify who is responsible for fulfilling the Chief Risk Officer function.

- RMU priorities
  - Develop risk tolerances for each sub-category in the RAS in consultation with departments, the Board, and the RMC;
  - Provide templates and guidance for departmental risk registers;
  - Generate insights from departmental inputs and communicate these to the RMC, Board, and BARC;
  - Gradually build out the IRR as tasks progress.

- Departmental responsibilities
  - Complete risk registers using RMU’s standard template and review after incidents or at least annually;
  - Ensure all incidents are included in these registers;
  - Identify and map critical business processes to allow BIAs and identify positions and systems most critical to CBSI operations.

*IMF Technical Assistance Report — excerpt*

### 52. Follow-up support and Board engagement: It is recommended that CBSI schedule a short

### 52. Follow-up support and Board engagement: It is recommended that CBSI schedule a short

### Follow-up TA mission and Executive/Board workshop
- Recommendation: CBSI schedule a short follow-up TA mission within 18–24 months.
- Purpose of the follow-up:
  - Culminate in a risk management seminar and workshop for the Executive and Board.
  - Assess progress in embedding the ERM framework.
  - Review lessons learned from incident reporting and business continuity testing.
  - Evaluate the effectiveness of the RAS, risk tolerances, and IRR.
- Suggested workshop content:
  - Case studies from peer central banks.
  - Scenario-based exercises to strengthen strategic risk identification.
  - Dedicated session on the evolving role of the Board in risk oversight.
- Expected benefits:
  - Sustain momentum in ERM implementation.
  - Reinforce accountability.
  - Strengthen CBSI’s overall risk culture.

### Strengthening risk governance and oversight
- Core finding: Robust risk governance is essential for protecting CBSI’s reputation, credibility, and operational independence.
- Framework: The Three Lines Model provides an effective framework by delineating roles and responsibilities to support sound risk management.
- Implementation requirements:
  - Well-defined separation between executive management and Board oversight.
  - Broad institutional understanding and execution of assigned responsibilities.
  - Strong leadership from the RMC and BARC, especially during initial implementation, to build momentum and institutionalize good practice.

### Building a supportive risk culture
- Observations:
  - Encouraging signs: departments showing greater engagement with the framework.
  - Weaknesses identified:
    - Limited review and challenge.
    - Reluctance to report incidents.
    - Siloed first line practices.
    - Lack of strategic appreciation for how ERM strengthens the organization.
- Imperative: Address cultural gaps to embed risk management as a shared responsibility.

### Maintaining momentum at a critical junction
- Context: CBSI is at a pivotal stage with several important initiatives well advanced but not yet approved.
- Initiatives noted:
  - Revised ERMP.
  - Departmental risk register template.
  - Business continuity management policy.
- Requirements to advance initiatives:
  - Clear organizational priorities.
  - Defined accountability.
  - Visible support from senior leadership and the Board.
- Business continuity as a test:
  - Disruptions are inevitable in a complex, digital environment.
  - The Bank’s readiness is measured by its ability to minimize impact on both CBSI and the wider Solomon Islands community.
  - CBSI’s credibility depends on demonstrating learning from past experiences and effective response capability.

### Summary policy recommendations
- Schedule follow-up TA mission within 18–24 months including an Executive and Board workshop.
- Use the workshop to:
  - Assess ERM embedding and incident/business continuity lessons.
  - Review RAS, risk tolerances, and IRR effectiveness.
  - Deliver case studies and scenario-based exercises.
  - Clarify the evolving role of the Board in risk oversight.
- Strengthen governance by:
  - Applying the Three Lines Model with clear separation between management and Board oversight.
  - Ensuring RMC and BARC provide visible, sustained leadership during implementation.
- Strengthen risk culture by addressing identified weaknesses (review/challenge, incident reporting, first-line integration, strategic appreciation).

*IMF Technical Assistance Report*

---


_Source: https://www.imf.org/-/media/files/publications/tar/2026/english/tarea2026021-source-pdf.pdf_