Banco Nossa Caixa, Brazil

Background

On February 18, 2008, Nossa Caixa in São Paulo, Brazil, became the first financial institution in the world to earn certification to the Business Continuity Management System (BCMS) standard BS 25999. This global leadership is characteristic of the 90-year-old bank, which is among the eleven largest financial institutions in the country.

Originally named Caixa Econômica de São Paulo, the bank first opened its doors on March 22, 1917, in the São Paulo city, and its objective was to help people save money. Today, Nossa Caixa is the seventh largest bank in terms of savings deposits, ninth in total deposits, and eleventh in total assets, with a presence in all 645 municipalities of São Paulo. In many cases, the history of Nossa Caixa is closely linked to events in the country, bank representatives said.

In 2005, the bank became a company of open capital – an historic achievement for the State of São Paulo and Banco Nossa Caixa. Maintaining its pioneer spirit, Nossa Caixa became the first financial institution in the country to join the New Market of the Bovespa. Companies with shares listed in this segment voluntarily adopt the highest standards of corporate governance and modern practices of transparency, and equal treatment among shareholders.

To consolidate its position in the marketplace, the bank plans to continue:

• Expanding its commercial portfolio
• Launching new products
• Investing in infrastructure, technology, and personnel
• Modernizing and reforming self-service
• Developing strategic partnerships to explore new business.

Customer Needs

The bank’s certification covers the business unit of the Brazilian Payment System (SPB) - the motivation for seeking certification was that the process could provide information for the SPB and promote continuous improvement in the business continuity processes, as well as opening new business opportunities.

Business continuity means more than just having backup copies of information systems and equipment for various contingencies; it is much more complex than that, bank officials said. Business continuity is not momentary anymore, but part of the management of business, meaning that it must be integrated through all functions of the business and the issue is a corporate one, they added.

The System

With the BS25999 certification, the bank was able to integrate smoothly the work of all the employees, ranging from business and administrative to information technology. Everyone understands and continues to work in order to maintain the process of BCMS within the specifications of the standard, bank representatives said. The work continues with the same dedication and understanding, and it is slowly impacting other business areas. The dedication of the bank’s employees – business managers, auditors, experts in Information Technology – was fundamental to success, helping the company to exceed its target and lead the world in this new area of certification.

Benefits

Bank officials said the financial institution is reaping at least three benefits from certification to BS25999.

First, the achievement is helping Banco Nossa Caixa receive positive recognition from the banking community as the first financial institution in the world to earn this distinction.

Second, implementation of a BCMS provided the process to enable the bank to reorganize its structure, bringing value to the institution by strengthening its ability to meet its responsibilities for information security and business continuity.

Third, the standard proffers the impetus for the bank to improve continually, as the standard requires continual improvement and maintenance audits in order for the institution to maintain its certification.

BSI’s Role

In Brazil, BSI has proven to be a leader in the industry and is the only certification body conducting audits for this new standard. Additionally, BSI is accredited by UKAS, indicating that it is a certification body with its own third-party stamp of approval. “BSI auditors have always been reliable and efficient. The certification shows a greater capacity to manage an interruption in business, protecting brand name and reputation,” the bank representatives said.

[Editor’s Note: The comments reflect a collaborative response by Vilmar Knoth, Chief Information Officer of the Bank; Alvaro Leis, Continuity Business Bank Manager; and Jose Waldir, Bank Chief Security Officer.]