I am trying to figure out if BCP / DR policy can be approved annually by a "committee of the Board" rather than the full Board of Directors. (We are wanting to use our "Audit and Compliance Committee" of the Board for policy approval.) Some sections of the FFIEC guidelines specifically mention "committee of the board" (like the GLBA section) but others simply state Board of Directors.

Anyone have any insights?

Had a similar issue in past years and this years. I realized as an auditor my boss (the Audit Committee) would be approving a policy I was to audit. Management agreed and moved the policy approval to the BOD.

All policies are required to be approved by the full BOD here.

I am aware of current trends and the ambiguities in regulations; however, any committee that is responsible for oversight of a policy cannot rightly have authority to remove or approve that policy. They receive their oversight authority from the board's endorsement of the policy, not the other way around. The committee's responsibilities and authorities are (or should be) clearly outlined within the policy and only survive withIN that policy. Approval or removal of the policy greater than the policy itself.

Second, the BOD has fiduciary responsibility to uphold the policy and if you approve it via a subcommittee you're usurping them (even if they say they want it that way -wink).

Also,keep in mind that any policy you're attempting to approve through a committee isn't receiving support from the highest level of your institution. Don't dumb down the importance of your policy by vetting it through a committee. Remember - policies develop the culture of the organization and this is the most important job the senior management does!

I realize I am reading into your question a bit so please clarify if need be. Cheers

All policies are not required to be approved by the full board.