Business Continuity Plan

Since continuous operation is very important in sustaining a normal financial market, TDCC formulated a Business Continuity Plan (BCP) in September 2005. To ensure continuity in business operation, the Plan specifies the company’s major operation, manpower and resources required by such operation, as well as procedures of precaution, responsive action and recovery from disasters. In the efforts to ensure its capability, TDCC has conducted a company-wide BCP drills, and offsite information system redundancy drills. The operation of BCP is stated as follows:

■ Formulating a BCP

(1) Background

TDCC formulates its BCP in accordance with the procedures governing information security management of the Executive Yuan and its agencies as well as the ISO27001 information security policy.

(2) Purpose

To ensure the recovery of TDCC’s major operations within a given time, the BCP specifies the company’s critical operations, main business, as well as manpower and equipment required. This is to make sure that there are adequate resources for precautious measures and emergency response capacity, and to outline steps of action to be taken for effective recovery work when needed.

(3) Scope and maintenance

The BCP consists of the BCP team’s responsibility, procedures and strategies for disaster response, and the team’s key operations before and during the various stages of disasters. In addition, TDCC will adjust its BCP in light of market changes and current business status. The BCP will also be revised according to the result of each drill so as to accomplish the objectives of continuous operation and normal market function.

■ Setting Up a BCP Team

The commander of the BCP team is TDCC’s Senior Executive Vice President, and the Secretary General serves as its chief executive. The team is divided into seven units, including Planning, Business, Technology, Administrative Support, Security, Medical Aid, and Audit. The BCP team is responsible for ensuring continuity in TDCC’s business operation by handling the BCP plan, emergency response, precaution, response and recovery.

■ BCP Tests and Drills

To put the BCP into practice and improve staff’s ability of risk management and disaster response, TDCC conducts relevant tests and drills twice a year.

(1) Methods of drills

Including deduce drills, reporting drills, evacuation drills and complete drills.

(2) Drill plans and implementation

To achieve desired results, departments in charge of each year’s drills compile a detailed plan, while the BCP units also prepare procedures to be implemented in the drills. In addition, the Audit Unit supervises and checks the implementation of the drill during the process.

(3) Review meeting

A review meeting is held after the drill. At the meeting, the BCP units explain and review the implementation of the drill as well as provide suggestion of improvement as references to the revision of the BCP or the next drill plan.

■ Periodic Inspection of the TDCC’s Disaster Response Capability

The recent intense earthquake and tsunami in Japan and resultant serious damage have prompted the TDCC to further strengthen its ability to respond to major disasters, and to review the completeness of its measures for responding to earthquakes, fires, floods, and other serious disasters. It has formulated the following goals to ensure adequate advance planning of its responses to all kinds of possible scenarios:

Each department must have firm control of its own important operations, and ensure that the operations can be carried out smoothly in the backup facilities. To better support backup facility planning and operation, human resources must be subcategorized into core personnel, rear personnel, and reserve personnel to provide sufficient human resources for each stage. Based on human resources and operational requirements, the locations and routes for escape, assembly, and backup must be rationally planned to ensure that people can rapidly be stationed at designated locations when a disaster occurs. Each department must store its business forms and contact information in electronic or physical form in a way that ensures that business operations can be conducted smoothly when a disaster occurs. Priority will be given to using existing information and communications equipment at the backup facilities, and to installing related systems and software. If those are insufficient, additional purchases will be made, to ensure both that backup operation needs are met and that available resources are fully utilized.

Drill Plan for the TDCC BCP
Time Drill Name Description
22 October 2005 All TDCC employees participated in the following drills: 1) major fire at 2F, North of the Headquarter Building; 2) major fire at 2F, South of the Headquarter Building; 3) major fire in the offices on 3F, 9F, 10F, and 11F; all drill participants proceed successively to the off-site drill location (Nangang) according to the planned procedures. A fire occurs at 2F, North of the Headquarter Building and stops the operations of the Settlement Division, Cashier Division, and Accounting Division under the Operations Department and the Service Division under the Shareholders Affairs Department.

A fire occurs at 2F, South of the Headquarter Building, and stops the operations of the External Affairs Division under the Shareholders Affairs Department and the Data Division and Custody Division under the Depository Department.

A fire occurs in the office areas on 3F, 9F, 10F, and 11F, and stops the operations of the administrative units.

All drill participants proceed successively to the off-site drill location (Nangang) according to the planned procedures 21 May 2006 | Off-site backup for securities depository, inventory control, and separate custody systems. | In this drill, it is hypothesized that the securities depository system malfunctions during service hours, and the related operations are taken over by the backup center.