Frequently Asked Questions

WISE2019

Frequently Asked Questions:

About the 2019 Whole Industry Simulation Exercises

1) What is a Whole Industry Simulation Exercise?
2) Does WISE test the technical aspects of our business continuity plan?
3) Is this a test? What happens if we don't perform well?

4) Will the results be publicised?
5) Who in my organisation should participate? 
6) Where will it take place?
7) How many participants took part in WISE2017?

CMT

8) What is a CMT and which level of CMT should participate?

9) Can you share the scenario so we know who to invite to our CMT?

10) Can we decide how many CMT members participate in the exercise or is this something the exercise defines?

11) How will the participating institutions be able to communicate with other parties and each other during the exercise?

Exercise

12) Why is there a participation fee?

13) If we register for WISE2019, do we need to commit to attending the full exercise or can we opt to join part of it?

14) Who should we appoint as exercise facilitator? What will the facilitator need to do?

15) Can you provide any more information regarding the exercise (scope, specification..)?

16) How long will the exercise take?

17) What will be the format of the simulation (i.e. in forms of e-mail communications, telephone call, video conference)?

18) What's the difference between WISE2017 and WISE2019?

Logistics

19) You have limited capacity. Will registration be on first come first serve basis?

20) How much preparation work is envisaged for participants?

21) What happens if a typhoon or other incident occurs on the day of the exercise?

Regulators

22) Is this a regulatory mandated exercise (HKMA, SFC)?

23) Will the exercise involve communicating with the regulators?

Post Exercise Reporting

24) Will there be any “success” or “failure” of each participating bank and, if so, on what basis will each status be judged. Will the simulation results be disclosed to regulator and public?

25) To what extent will participating Bank’s internal information be disclosed / required (e.g. Bank’s internal BCP plan) during the simulation?

26) Will the simulation results be disclosed to the participating companies, regulators and public?

1) What is a Whole Industry Simulation Exercise?

Each participating organisation (45 for WISE 2017) responds, from its own offices, to an unfolding systemic crisis supplied from a central command centre. Information is supplied through a web portal simulating social media, market data and news media, email and phone calls. Crisis management teams in each organisation coordinate their response, feeding back decisions to the central command centre.

2) Does WISE test the technical aspects of our business continuity plan?

WISE is not a technical exercise. The purpose is to assess senior management readiness in responding to major incidents; decision making and managing a coordinated response with key stakeholders, such as customers, regulators, staff and the market at large.

3) Is this a test? What happens if we don't perform well?

No, this is not a test but a scenario-based simulation exercise. There is no pass/fail. The objective of WISE is to improve and strengthen your own readiness to respond to a crisis, as well as support the industry as a whole.

4) Will the results be publicised? 

An anonomised report of achievements and learning opportunities will be made available to the public post exercise.
Each participating organisation will also receive a confidential and individualised report.

5) Who in my organisation should participate? 

The designated crisis management team within your organisation. This typically comprises senior decision makers,
including the CEO, COO, heads of businesses and functions (corporate communications, information security, technology, compliance, legal, operations, finance and facility management).

6) Where will it take place?

Each participating crisis management team will convene in their own office location and be connected to a central command centre through a web portal, email and dedicated phone line.

7) How many participants took part in WISE2017?

45 organisations took part in WISE2017. This was an increase from 24 participants in WISE2015.

8) What is a Crisis Management Team (CMT) and which level of CMT should participate?

A Crisis Management Team (CMT) is the strategic response team that coordinates the organisations' resources to manage an incident impacting customers, reputation, operations, commercial interests and other stakeholders. We expect the firm’s Hong Kong Crisis Management team to participate in WISE. This will typically consist of the most senior heads of the corporate functions as well as the heads of the business divisions, and is normally chaired by the COO or the CEO.

9) Can you share the scenario so we know who to invite to our CMT?

The scenario will not be disclosed before the exercise, but it will be diverse, challenging and complex, ensuring both business and corporate support functions will be needed and engaged to respond to the simulated events.

10) Can we decide how many CMT members participate in the exercise or is this something the exercise defines?

It is recommended that your entire Hong Kong Crisis Management Team participates. In most organizations the CMT is composed of the most senior heads of both the corporate functions, as well as the business divisions, and chaired by the COO or CEO. The scenario will be sufficiently challenging and complex to engage every CMT member.

11) How will the participating institutions be able to communicate with other parties and each other during the exercise?

During the exercise, the CMTs will be able to communicate with other parties through a dedicated list of telephone numbers and email addresses. Amongst the (simulated) parties that can be called are the authorities, the press, market data providers, the exchanges, the clearing houses, IT companies, public utilities, Police and other first responders, etc. The CMTs can also communicate with each other in the exercise.

12) Why is there a participation fee?

Our project has no profit objective, our books will be transparent and any material surplus will be reimbursed to the participants.

The amount is based on a cost estimate in line with industry practice in other countries with similar exercises such as Singapore, UK and US. The expenses relate mainly to our organising partners staff costs, the preparation of simulated news reports (‘life’ video reports etc.) and the technical infrastructure (web portal) to distribute these situation updates simultaneous to all participants.

13) If we register for WISE2017, do we need to commit to attending the full exercise or can we opt to join part of it?

The exercise format will be designed to meet the exercise objectives, designed by the participants of WISE. The exercise builds over time, and if sections of the exercise are missed, the CMT will not experience the full potential of the exercise. The objectives may not be achieved and your investment will not be fully realised.

14) Who should we appoint as exercise facilitator?

Each organisation will be asked to identify a Facilitator who will be the primary point of contact during simulation on the day of the exercise. You can also assign a backup facilitator or contact in case the main facilitator is unable to commit to all briefing sessions. After registration you will be asked to provide the name, job title, email and contact telephone number of the facilitator.

The facilitator:

a) Should not participate as member of the Crisis Management Team, but only be facilitator

b) Should ideally be someone from your organisation’s risk, resilience, business continuity or crisis management functions with understanding of the requirements of designing and delivering a simulation exercise;
c) Should also have the authority and experience to focus internal resources on required activities and should be able to make decisions about your organisation’s involvement;
d) Will be responsible for your organisation’s logistics and infrastructure arrangements prior to and during the exercise as advised by WISE organisers.
e) For this exercise, the facilitator does not decide the crisis response for own company but facilitate the crisis management team to respond to the simulated crisis.
f) Must commit to attend Facilitator Briefing sessions including a follow up session after the WISE exercise.

15) Can you provide any more information regarding the exercise (scope, specification..)?

Please refer to our website www.hkfsbcm.org for the basic information on the WISE exercises.

16) How long will the exercise take?

WISE2019 format is still to be agreed, however, it is likely to includes a prebriefing to the CMT to ensure they understand the objectives, rules and format, the exercise and a debrief. It is important to ensure all participants stay for the debrief; this is where the lessons and improvements are recorded.

17) What will be the format of the simulation (i.e. in forms of e-mail communications, telephone call, video conference)?

In previous WISE exercises, each participating company is logged in to a web portal which provided newsfeeds and videos of the events unfolding during the crisis scenario. In addition, the events were also delivered to the participants through telephone calls, short message texts (SMS) and emails.

During the exercise, the CMTs were able to communicate with other parties through a dedicated list of telephone numbers and email addresses. Amongst the (simulated) parties that could be called were the authorities, the press, market data providers, the exchanges, the clearing houses, IT companies, public utilities, Police and other first responders, etc. The CMTs could also communicate with each other in the exercise.

18) What's the difference between WISE2017 and WISE2019?

WISE2015 was designed and delivered by volutneers from the industry. They were supported by a number of partners; PwC, Deloitte, KPMG, EY, Hill & Associates - all who gave their time for free. The show of support was fantastic, but we didn't want to rely upon this support again in 2017. WISE2017 was managed by Control Risks (CR). The participation fee covered the cost of their services, and the techology required to support the exercise. Once again, we are looking to use a vendor to support the delivery of WISE2019.

19) You have limited capacity. Will registration be on first come first serve basis?

Every application is assessed on suitability, and we will contact you should be there be any doubt. The set-up of the WISE exercise is easily scalable, we don't expect to reach limits in number of participants.  For WISE2017 we were able to accept all 45 financial institutions that signed up.

20) How much preparation work is envisaged for participants?

Every participating financial institution should assign a facilitator, who will be primarily responsible for the logistics before and during the exercise. He or she will attend two briefing sessions. As a facilitator he will look after logistics such as ensuring that all CMT members are invited and know what to expect, and that the various modes of communication are functional during the exercise.

21) What happens if a typhoon or other incident occurs on the day of the exercise?

In advance of the exercise, participants are asked to block out 2 separate dates a couple of weeks apart. the primary exercise date and a backup date that can be cancelled if the exercise is completed. As the dates are only 2 weeks apart, we do not expect to have to repeat connectivty tests and rehearsals.

22) Is this a regulatory mandated exercise (HKMA, SFC)?

Although the exercise is an industry driven initiative and is therefore neither a regulatory nor a supervisory activity, it provides your institution with the opportunity to test your business continuity planning, senior management preparedness and crisis management responses within the setting of an industry-wide crisis simulation. It also provides your institution with an opportunity to test the effectiveness of its communication with other institutions, stakeholders and affected parties in case of a crisis.

Should you have any questions regarding the SFC’s or HKMA’s position, please contact SFC and/or HKMA directly via email at riskandstrategy@sfc.hk or bsotr@hkma.iclnet.hk respectively, with provision of your institution's contact information

23) Will the exercise involve communicating with the regulators?

Yes and No... During the simulation, Crisis Management Teams of the participating institutions will be required to communicate with their authorities. These authorities will be simulated by the exercise command centre. .
As part of the exercise, dedicated phone numbers and email addresses will be made available to separate exercise communication from ‘real’ communication.

It must be noted that this exercise is not a ‘test’ with ‘pass or fail’. Individual results will not be shared with the regulator (or anyone else). The objective is to improve the ability of the industry to respond to unexpected crisis situations. We find it essential that all findings will be anonymized so that no individual firm comes out looking badly. We therefore recommend everyone, including firms with less well established Crisis Management Teams, to participate. There will be no repercussions.

24) Will there be any “success” or “failure” of each participating bank and, if so, on what basis will each status be judged. Will the simulation results be disclosed to regulator and public?

No, there will be no ‘pass or fail’ for the CMTs. This event is an exercise, to build experience. It is not a test. The objective is to improve the ability of the industry to respond to unexpected crisis situations.  All results will be disclosed to the participating organization only in full confidence.  Results will not be shared with the regulators or the public. 

25) To what extent will participating Bank’s internal information be disclosed / required (e.g. Bank’s internal BCP plan) during the simulation?

It must be noted that this exercise is not a ‘test’ with ‘pass or fail’. The objective is to improve the ability of the industry to respond to unexpected crisis situations.  Each firm should facilitate and manage their own Crisis Management Team (CMT) discussions and all internal outcome discussions will remain internal.  There is no obligation to share any discussion outcomes or decisions with any of the simulated Trusted Advisors, eg. regulators, law enforcement.  We find it essential that all findings are anonymous; each firm will have a different level of maturity and their own lessons to be learnt. 

​
26) Will the simulation results be disclosed to the participating companies, regulators and public?

The exercise results will be aggregated in a closure report and no participating company will be identified against any specific result. For example, the exercise closure report may state "60% of respondents indicated that they have activated alternative work arrangements when event XXX occurred.

We therefore recommend everyone, including firms with less established Crisis Management Teams, to participate. There will be no repercussions.