杭州市人民政府关于修改《杭州市行政机构设置和编制管理办法》部分条款的决定

作者:法律资料网 时间:2024-07-03 03:50:01   浏览:9286   来源:法律资料网
下载地址: 点击此处下载

杭州市人民政府关于修改《杭州市行政机构设置和编制管理办法》部分条款的决定

浙江省杭州市人民政府


市政府关于修改《杭州市行政机构设置和编制管理办法》部分条款的决定

第251号


  《杭州市人民政府关于修改〈杭州市行政机构设置和编制管理办法〉部分条款的决定》已经2009年7月16日市人民政府第44次常务会议审议通过,现予公布,自公布之日起施行。


市 长

二○○九年八月六日


杭州市人民政府
关于修改《杭州市行政机构设置
和编制管理办法》部分条款的决定

  经市人民政府第44次常务会议审议,决定对《杭州市行政机构设置和编制管理办法》部分条款作如下修改:
  一、第一条修改为:“为规范行政机构设置和编制的管理,根据《中华人民共和国地方各级人民代表大会和地方各级人民政府组织法》、《地方各级人民政府机构设置和编制管理条例》等有关法律、法规的规定,结合本市实际,制定本办法。”
  二、第七条第一款修改为:“市人民政府行政机构根据职能分为工作部门、派出机构和工作部门管理的行政机构。”
  第二款修改为:“区、县(市)人民政府行政机构根据职能分为工作部门和派出机构。”
  三、增加一条,作为第八条:“市、区、县(市)人民政府行政机构职责相同或者相近的,原则上由一个行政机构承担。
  行政机构对职责划分有异议的,应当主动协商解决。协商一致的,共同报本级机构编制管理机关备案;协商不一致的,有异议的行政机构应当提请本级机构编制管理机关提出协调意见,由机构编制管理机关报本级人民政府决定。”
  四、原第八条改为第九条,并修改为:“市、区、县(市)人民政府在一定时期内的特定工作应当交由现有行政机构承担,不另行设立议事协调机构。现有行政机构不能承担该职能的,可以设立议事协调机构,但应当明确其撤销的条件和期限。
  议事协调机构不单独设立办事机构,具体工作由有关的行政机构承担。”
  五、原第十条改为第十一条,并删除第二款中的“市人民政府议事协调机构的常设办事机构称办公室”的规定。
  六、原第十八条改为第十九条,并修改为:“市、区、县(市)人民政府议事协调机构及其办事机构不单独确定编制,所需工作人员由承担具体工作的行政机构内部调剂解决。”
  七、原第十九条改为第二十条,并修改为:“下列事项由市机构编制管理机关提出方案,经市人民政府审议通过后,由市人民政府报省人民政府批准:
  (一)市人民政府行政机构的设置和调整总体方案;
  (二)市人民政府行政机构的设置和调整总体方案批准后,工作部门、工作部门管理的行政机构的设立、撤销或者合并;
  (三)市人民政府行政机构的设置和调整总体方案批准后,工作部门、工作部门管理的行政机构变更规格或者名称。
前款第(一)、(二)项规定的事项,市人民政府同时报市人民代表大会常务委员会备案。”
  八、原第二十条改为第二十一条,并将第(二)项修改为:“市人民政府工作部门、工作部门管理的行政机构增加机构名称(包括撤消增加的机构名称,下同)。”
  九、原第二十一条改为第二十二条,并修改为:“下列事项由市机构编制管理机关审核后,报市人民政府批准:
  (一)市人民政府各行政机构的职能配置、内设机构和人员编制方案;
  (二)区、县(市)人民政府行政机构的设置和调整总体方案;
  (三)区、县(市)人民政府行政机构的设置和调整总体方案批准后,工作部门的设立、撤销或者合并;
  (四)区、县(市)人民政府行政机构的设置和调整总体方案批准后,工作部门变更规格或者名称;
  (五)市人民政府行政机构与区人民政府行政机构管理权限的划分和管理体制的调整。
前款第(二)、(三)项规定的事项,区、县(市)人民政府同时报同级人民代表大会常务委员会备案。”
  十、原第二十二条改为第二十三条,并将第(四)项修改为:“区、县(市)人民政府工作部门增加机构名称。”
  十一、原第二十七条改为第二十八条,并将其中的“议事协调机构及其非常设办事机构”修改为“议事协调机构及其办事机构”。
  十二、原第三十一条改为第三十二条,并修改为:“行政机构违反本办法规定,有下列行为之一的,由机构编制管理机关责令其限期改正;逾期不改正的,由机构编制管理机关建议任免机关或者监察机关对负有直接责任的主管人员和其他直接责任人员依法给予行政处分;
  (一)超越管理权限设置或者调整行政机构的;
  (二)擅自设置或者调整内设机构、派出机构或者直属机构及其级别的;
  (三)擅自改变行政机构职能的;
  (四)擅自超过核定的编制使用工作人员或者超职数配备领导人员的;
  (五)对擅自超编使用的人员拨付行政经费、办理人员调配、社会保障等手续的;
  (六)违反规定干预下级人民政府行政机构的设置和编制管理工作的;
  (七)其他违反行政机构设置和编制管理规定的行为。”
  十三、原第三十三条改为第三十四条,并修改为:“参照公务员制度管理的机构,其机构设置和编制的管理参照本办法执行。”
  本决定自公布之日起施行。
  《杭州市行政机构设置和编制管理办法》根据本决定作相应修正,重新公布。


杭州市行政机构设置和编制管理办法


  (2004年11月11日杭州市人民政府令第213号发布,根据2009年8月6日《杭州市人民政府关于修改〈杭州市行政机构设置和编制管理办法〉部分条款的决定》修订)
  第一章 总 则
  第一条 为规范行政机构设置和编制的管理,根据《中华人民共和国地方各级人民代表大会和地方各级人民政府组织法》、《地方各级人民政府机构设置和编制管理条例》等有关法律、法规的规定,结合本市实际,制定本办法。
  第二条 本市各级人民政府行政机构设置和编制的管理适用本办法。
  第三条 行政机构设置和编制的管理实行统一领导,分级管理。
  行政机构设置和编制的管理应当适应政治、经济和社会发展的需要,遵循精简、统一、高效的原则。
  第四条 行政机构设置和编制的确定,应当依照规定的管理权限和程序审批。
  第五条 市、区、县(市)机构编制管理机关按照规定权限负责本辖区内行政机构设置和编制的管理工作。
  第二章 行政机构设置管理
  第六条 行政机构的设置应当以科学的职能配置为基础,做到职能明确、分工合理、精简规范,有利于提高行政效率,并且不得超过上级机关规定的限额。
  第七条 市人民政府行政机构根据职能分为工作部门、派出机构和工作部门管理的行政机构。
  区、县(市)人民政府行政机构根据职能分为工作部门和派出机构。
  乡(镇)人民政府不设立独立的行政机构,只设立内设的综合办事机构。
  第八条 市、区、县(市)人民政府行政机构职责相同或者相近的,原则上由一个行政机构承担。
  行政机构对职责划分有异议的,应当主动协商解决。协商一致的,共同报本级机构编制管理机关备案;协商不一致的,有异议的行政机构应当提请本级机构编制管理机关提出协调意见,由机构编制管理机关报本级人民政府决定。
  第九条 市、区、县(市)人民政府在一定时期内的特定工作应当交由现有行政机构承担,不另行设立议事协调机构。现有行政机构不能承担该职能的,可以设立议事协调机构,但应当明确其撤销的条件和期限。
  议事协调机构不单独设立办事机构,具体工作由有关的行政机构承担。
  第十条 市、区、县(市)人民政府行政机构在职能分解的基础上设立内设机构。
  市、区、县(市)人民政府工作部门根据工作需要,可以设立派出机构或者直属机构。
  市人民政府工作部门管理的行政机构根据工作需要,可以设立派出机构。
  第十一条 市、区、县(市)人民政府行政机构及其内设机构、派出机构和直属机构的名称应当规范,并与该机构的类型和职能相称。
  市人民政府的工作部门称委员会、办公厅(室)、局;市人民政府工作部门管理的行政机构称局;市人民政府行政机构的内设机构称处、室,市人民政府工作部门的派出机构或者直属机构和工作部门管理的行政机构的派出机构称分局、所。
  区、县(市)人民政府的工作部门称办公室、局,其内设机构称科、室;区、县(市)人民政府工作部门的派出机构或者直属机构称所、队。
  确因工作需要,设定与本条规定不一致的机构名称的,由该机构的批准机关决定。
  第十二条 市、区、县(市)人民政府行政机构的最高级别分别为副厅级、正处级、正科级;市人民政府行政机构的内设机构的最高级别为正处级,区人民政府行政机构的内设机构的最高级别为正科级。
  第十三条 市人民政府行政机构的内设机构不设下属机构。因工作需要确需设立的,按照本办法规定的管理权限和程序审批。
  区、县(市)人民政府行政机构的内设机构不设下属机构。
  第三章 编制管理
  第十四条 行政机构的编制在上级机关核定的总额内,依据职能配置确定。
  行政机构的编制是指人员定额和领导职数。编制总额分为市,区、县(市),乡(镇)三级,不得相互挤占。
  第十五条 行政机构的编制是各机构人员调配、职务任免和财政经费拨付的依据。
  行政机构不得超编使用工作人员,其领导人员应当在确定的职数限额内调配。
  第十六条 行政机构的编制在行政机构设立时确定。行政机构的编制方案应当包括下列事项:
  (一)行政机构的人员定额;
  (二)行政机构的领导职数和内设机构的领导职数。
  第十七条 市、区、县(市)人民政府行政机构编制的调整,由本级机构编制管理机关按照本办法规定的管理权限和程序审批或者审核报批;乡(镇)编制的调整,由上级机构编制管理机关按照本办法规定的管理权限和程序审批或者审核报批。
  第十八条 上级机构编制管理机关下达的公安、司法行政等专项编制的分配,由市、区、县(市)机构编制管理机关分配下达或者会同同级人民政府有关部门分配下达。
  第十九条 市、区、县(市)人民政府议事协调机构及其办事机构不单独确定编制,所需工作人员由承担具体工作的行政机构内部调剂解决。
  第四章 管理权限和程序
  第二十条 下列事项由市机构编制管理机关提出方案,经市人民政府审议通过后,由市人民政府报省人民政府批准:
  (一)市人民政府行政机构的设置和调整总体方案;
  (二)市人民政府行政机构的设置和调整总体方案批准后,工作部门、工作部门管理的行政机构的设立、撤销或者合并;
  (三)市人民政府行政机构的设置和调整总体方案批准后,工作部门、工作部门管理的行政机构变更规格或者名称。
  前款第(一)、(二)项规定的事项,市人民政府同时报市人民代表大会常务委员会备案。
  第二十一条 下列事项由市机构编制管理机关提出方案,报省机构编制管理机关批准:
  (一)全市行政机构编制总额和市(含区)、县(市)、乡(镇)编制总额的调整;
  (二)市人民政府工作部门、工作部门管理的行政机构增加机构名称(包括撤销增加的机构名称,下同)。
  第二十二条 下列事项由市机构编制管理机关审核后,报市人民政府批准:
  (一)市人民政府各行政机构的职能配置、内设机构和人员编制方案;
  (二)区、县(市)人民政府行政机构的设置和调整总体方案;
  (三)区、县(市)人民政府行政机构的设置和调整总体方案批准后,工作部门的设立、撤销或者合并;
  (四)区、县(市)人民政府行政机构的设置和调整总体方案批准后,工作部门变更规格或者名称;
  (五)市人民政府行政机构与区人民政府行政机构管理权限的划分和管理体制的调整。
  前款第(二)、(三)项规定的事项,区、县(市)人民政府同时报同级人民代表大会常务委员会备案。
  第二十三条 下列事项由市机构编制管理机关决定或者批准:
  (一)市、区、县(市)、乡(镇)编制总额的分配;
  (二)市人民政府行政机构职能、编制的调整及其内设机构和派出机构或者直属机构的增设、撤销或者变更;
  (三)市人民政府行政机构的内设机构、派出机构和直属机构设立下属机构的,下属机构的级别及其领导职数的确定;
  (四)区、县(市)人民政府工作部门增加机构名称。
  第二十四条 下列事项由区、县(市)机构编制管理机关审核后,报本级人民政府批准:
  (一)区、县(市)人民政府行政机构的职能配置、内设机构和人员编制方案;
  (二)乡(镇)人民政府综合办事机构的设置和调整总体方案。
  第二十五条 下列事项由区、县(市)机构编制管理机关决定或者批准:
  (一)区、县(市)、乡(镇)编制的具体分配;
  (二)区、县(市)人民政府行政机构职能、编制的调整及其内设机构、派出机构或者直属机构的增设、撤销或者变更;
  (三)乡(镇)人民政府综合办事机构的设置和调整总体方案批准后,综合办事机构的设立、撤销、变更或者职能调整;
  (四)乡(镇)编制的调整。
  第二十六条 设立行政机构的方案,应当包括下列事项:
  (一)设立的必要性和可行性;
  (二)行政机构的类型、名称、级别、职能和隶属关系;
  (三)内设机构的名称、级别和职能划分;
  (四)与其他机构的职能划分;
  (五)所需编制。
  撤销或者变更行政机构的方案,应当包括下列事项:
  (一)撤销或者变更行政机构的理由;
  (二)撤销或者变更行政机构后,其职能的消失、转移情况;
  (三)撤销或者变更行政机构后,其编制的调整和人员的分流情况。
  第二十七条 市、区、县(市)人民政府行政机构增设内设机构、派出机构和直属机构的方案,应当包括下列事项:
  (一)增设的必要性;
  (二)增设机构的名称、性质、级别和职能;
  (三)与其他机构职能的划分;
  (四)所需编制。
  撤销或者变更行政机构的内设机构、派出机构和直属机构的方案,应当包括下列事项:
  (一)撤销或者变更机构的理由;
  (二)撤销或者变更机构后,其职能的消失、转移或者调整情况;
  (三)撤销或者变更机构后,其编制的调整情况。
  第二十八条 市、区、县(市)人民政府因工作需要,确需设立议事协调机构及其办事机构的,由市、区、县(市)人民政府办公厅(室)提出方案或者会同同级机构编制管理机关提出方案,报本级人民政府批准。
  第五章 监督检查
  第二十九条 各级机构编制管理机关对本级和下级人民政府行政机构的设置和编制执行情况进行监督检查。
  行政机构应当每年向同级机构编制管理机关提供行政机构编制执行情况的报告,并在各自职责范围内,配合机构编制管理机关做好行政机构设置和编制的管理工作。
  第三十条 上级人民政府行政机构不得干预下级人民政府行政机构设置和编制的管理工作,不得要求下级人民政府设立与其业务对口的行政机构。
  第三十一条 行政机构擅自超编使用人员的,财政部门不得拨付行政经费;人事、劳动保障等行政主管部门不得办理人员调配、社会保障等手续。
  第六章 法律责任
  第三十二条 行政机构违反本办法规定,有下列行为之一的,由机构编制管理机关责令其限期改正;逾期不改正的,由机构编制管理机关建议任免机关或者监察机关对负有直接责任的主管人员和其他直接责任人员依法给予行政处分;
  (一)超越管理权限设置或者调整行政机构的;
  (二)擅自设置或者调整内设机构、派出机构或者直属机构及其级别的;
  (三)擅自改变行政机构职能的;
  (四)擅自超过核定的编制使用工作人员或者超职数配备领导人员的;
  (五)对擅自超编使用的人员拨付行政经费、办理人员调配、社会保障等手续的;
  (六)违反规定干预下级人民政府行政机构的设置和编制管理工作的;
  (七)其他违反行政机构设置和编制管理规定的行为。
  第三十三条 机构编制管理机关工作人员在行政机构设置和编制管理工作中有违法、失职等行为的,依照有关法律、法规规定处理。
  第七章 附则
  第三十四条 参照公务员制度管理的机构,其机构设置和编制的管理参照本办法执行。
  第三十五条 市、区、县(市)机构编制管理机关可以根据本办法的规定,制定行政机构设置和编制管理的具体工作规则。
  第三十六条 本办法自2005年1月1日起施行。



下载地址: 点击此处下载
半道“宰客”也是抢

[案情]2003年5月28日,在大同矿务局打工的三个河北民工租乘被告人王某和李某的出租车回家乡望都县收割小麦,双方讲好租车费500元,出发时预付100元用来加油。当车驶出大同,进入怀仁县境内时,王、李二人停车加水。王提议“要挣大钱”,“跟他们每人要500元,不给就硬要”,李遂表示同意。当车行至盘山公路上时,坐在后坐的李某开始向三民工索要“油钱”、“车费”,并以“不给钱(车就)不走”相威胁,前边的王某一边驾车一边帮腔,“打呀骂的”,三民工无奈,分别各自掏出一些钱交给被告人李某,共计1500元。李还扬言“一会儿搜身,(从谁身上)搜出(钱),(就将谁)扔沟里去”。车行至邻县白石口检查站时,停车接受检查,三民工不顾二被告人的阻止,强行下车报警,言称被抢,同时夺回了被要走的钱款。王、李二人被交警抓获。
[意见]在本案的处理上,产生三种不同意见。
第一种意见认为应定强迫交易罪。刑法226条规定,以暴力、威胁手段强买强卖商品,强迫他人提供服务或强迫他人接受服务,情节严重的,以强迫交易罪论处。故强迫交易罪是情节犯,而本案二被告人采取语言威胁的手段,迫使三民工接受其客运服务,促使不平等交易目的的实现,以超出原价两倍的价格强迫受害人付款,差额太大,属情节严重情形,二被告人的行为已扰乱了正常的市场交易秩序,侵犯了消费者合法权益,其行为构成强迫交易罪。
第二种意见认为应定敲诈勒索罪。王、李二被告人主观上报着一种要“挣大钱,必须心要恨”的心态,寻找借口,以语言相威胁,给三民工造成心理恐惧,致使其害怕受到其他伤害,在迫不得已的情况下交出原价数倍的“车费”,实质上是敲诈,二被告人的行为侵犯了三民工的财产所有权,构成敲诈勒索罪。
第三种意见认为应定抢劫罪。二被告人有着明确占有他人财物的动机,在此动机下产生抢劫乘客的犯意,并实施了语言威胁的行为,而且利用特定的危险环境,对受害人进行精神强制,迫使其就犯,二被告人的行为构成抢劫罪。
[评析]笔者认为,虽然二被告人的行为似乎构成强迫交易罪和敲诈勒索罪,但仔细分析起来,对该二被告人最终应以抢劫罪论处。理由处下:
(1)、本案二被告人在三民工向其租车时,即已将目的地、价款等谈妥,达成一致意见,双方的客运合同成立并生效。尽管作案时合同已进入履行阶段,与合同的订立一样,同样仍然处在服务交易之中。因此,从二被告犯意的产生到实施威胁行为均在交易中发生,且被告人又从事的是合法的旅客营运业务,专门提供客运服务,并非像那种平常并不经营客运业务而却强迫三民工临时有偿搭车的行为一样,故符合强迫交易罪的客观要件。被告人是专营出租车业务的经营者,对市场行情是明知的,对路途远近以及车费计算不会出现重大误解和显失公平,且客观上也不存在市场行情与原定应收车费有差距的情形,故其强行索要巨额车费,符合强迫交易中情节严重的要求。二被告人的行为,严重践踏了平等民事主体之间自愿公平交易的原则,扰乱了市场秩序,同时也侵犯了三民工的财产权利,符合强迫交易罪的犯罪构成。
(2)、但二被告人毫无理由地强行索要几倍于原定价格的“车费”,且密谋策划时,即约定“要挣大钱”、“不给就硬要”,反映了其贪利动机和非法掠夺他人财物的目的,一切借口只不过是占有他人财物的幌子,在自己的合同义务未予全部履行前,便威胁三民工预付巨额“车费”,并且当即支付。这一切发生在合同履行期间,似乎给人一种强迫交易的影响,实际上已超出交易的范畴。本来双方约定到达目的地再给付余款400元,但二被告人为“挣大钱”,在半途中发难,从其选择作案的这一时间段上来分析,显然与到达目的地后再威胁三受害人支付数倍的车费之情形炯然不同。其见财起意,敲诈勒索的特征表现得要更大一些,更明显。而且此时,其目的已不再是促使交易的实观,而是进一步转化成赤裸裸的敲诈。再从其作案的空间上来分析,在野外公路上行驶的汽车内,似乎也跟一般生活观念上的交易市场相距甚远,其正在市场中交易的这一概念已从心理意识层面淡出,因此,被告人此时的心态已不再是对市场交易秩序的藐视和挑战,而是纯粹的借机打劫他人钱财。故其行为所侵犯的客体已不再是正常的市场交易秩序及公私财物,而是纯粹的公民个人财产所有权。另外,二被告人只实施了语言威胁,未对三民工实施暴力侵害,仅有程度较轻的推拉扯拽,三民工的人身权利未受侵犯,从这一点上看,二被告人的行为也符合敲诈勒索罪的特征。
(3)、被告人王某、李某当面威胁三民工,并且扬言当场要实施所要威胁的内容,即“扔到(山沟)里(喂狼)”,三被害人自感无回旋余地,被迫当场交出财物,具备了抢劫的两个“当场”性特征。虽然,二被告人未侵害三民工的人身权利,只进行语言威胁,有意识地施加了精神压力,而威胁不仅仅是抢劫的特征,而且也是敲诈勒索的特征,似乎属敲诈勒索行为,但在行驶中的出租车这一特定的空间内,又是在异乡,人生地不熟,而且行进中的车辆在客观上也变相地限制了乘客一定的人身自由,无法得到外援,几及于“叫天不应,呼地不灵”之境地,尽管二被告人未实施暴力,只进行了语言威胁,夹之以程度很轻的推拉扯拽,但在三民工心理上造成的恐惧感、不安感却由于这一特殊的处境而被成倍地放大,此时的一推一扯尽管并不会造成任何身体上的伤害,甚至连一个钮扣也不会掉落,但却在受害人精神上会造成了巨大的强制效力,其心理感受与在大庭广众之下或在熟悉的开放的环境下相差甚远。从这一点看,虽未使用暴力,但给三民工心理上造成压力之大不亚于对其人身进行直接的暴力伤害,从而直接使之失去反抗能力。山高路险,沟壑纵横,行车当中,如反抗则有可能引发交通事故,跌入万丈深沟;如不反抗则至少人身安全得以保全。事已至此,“身不由己”,屈服其淫威,违心地将血汗钱拱手相让,无疑是唯一的选择。也就是说,这种语言的威胁已足以抑制三受害人的反抗。二被告人的行为所造成的社会危害性已远远超过敲诈勒索行为,已超越了敲诈勒索所能评价的范畴。试想,如不对此类行为进行严惩,谁还敢再乘坐出租车,当大家都对满大街的出租车敬而远之的话,这个行业乃至人们的日常工作和生活将会受到多大的影响,这么大的法益难道不应该受到更加强力的刑法保护吗?
(4)本案二被告人的犯罪行为,既具有强迫交易的特征,同时也具有敲诈勒索罪和抢劫罪的特征,界线并不是很明显,不易区分。对于强迫交易罪和敲诈勒索罪这两个罪名来说,前文已述及,考虑到二被告人选择的作案时间,敲诈勒索罪的特征表现得更明显一点,但根据省高院2002年度刑事工作会议的精神,敲诈勒索罪的数额较大暂定为1500元,而本案二被告人向三民工强行索要了1500元,扣减400元合理的租车费,应以1100元计算犯罪数额,如此,则不构成敲诈勒索罪(当然如情节严重还是可以构成该罪的),故该罪可以排除,不再讨论。至于抢劫罪和敲诈勒索罪二者之间,由于被告人作案时利用了特殊的时空条件,出租车又属于公共交通工具,行进途中作案极有可能造成乘坐者人身、财产损失,甚至造成对过往车辆和路人的损害,危及公共安全,因而其主观恶性较大,社会危害特别严重,应以抢劫论处,才可罚当其罪。这如同携带凶器抢夺一样,虽然是抢夺,但一旦“携带凶器”这一因素介入,性质马上发生变化,即转化为抢劫(刑法267条二款)。最高人民法院[1993]法发28号《关于执行〈中华人民共合国铁路法〉中刑事罚则若干问题的解释》第五条(一)项规定“……凡在列车内,对旅客使用暴力、胁迫手段,如以语言威胁、暴露或者暗示以凶器或者依仗人多势众,对被害人施加精神压力等,强拿旅客财物或以‘借钱借物’为名索取财物的,以及对旅客实行强买强卖,侵犯旅客财产权益的,均应以抢劫论处。”故对本案二被告人以抢劫罪定罪处罚也正体观了这一精神。此外,从想象竞合犯这一角度分析,即使二被告人的行为同时均符合强迫交易罪、敲诈勒索罪和抢劫罪的犯罪构成,但择一重处的结果,仍应以抢劫罪处罚。
(5)也许有人会想,以抢劫论,起刑点就是三年有期徒刑,是否处罚太重?二被告人所抢的钱款数额仅一千余元,又被三民工夺回,未造成财产损失。毕竟被告人也提供了客运服务,实践中此类“宰客”行为又并不鲜见。其实,这恰恰是一种客观归罪的报应主义思维。“宰客”本是民事范畴的概念,是民事行为,“宰客”具有引诱、欺诈的成份,但起码建立在一个自愿交易的基础上,只不过利用了消费者处于一种缺乏经验和专业知识的弱势地位。而本案是犯罪行为,受害人在被告人的威胁下,已丧失了自主意识,双方之间已失去了一种交易的平台和现实基础,二被告人的行为是赤裸裸的强盗行径,且利用了特定的危险环境,性质恶劣,其行为已超越了强迫交易罪甚至敲诈勒索罪所能评价的范围,故以抢劫罪论处是符合刑法的立法精神的。另外,本案的小型出租汽车不属于刑法第263条(二)项的“公共交通工具”,依法只在三年以上十年以下量刑,不会处罚太重。

朔州市中级法院 张向阳



Guidelines on the Risk Management of Commercial Banks’ Information Technology ——附加英文版

China Banking Regulatory Commission


Guidelines on the Risk Management of Commercial Banks’ Information Technology





Chapter I General Provisions

Article 1. Pursuant to the Law of the People’s Republic of China on Banking Regulation and Supervision, the Law of the People's Republic of China on Commercial Banks, the Regulations of the People’s Republic of China on Administration of Foreign-funded Banks, and other applicable laws and regulations, the Guidelines on the Risk Management of Commercial Banks’ Information Technology (hereinafter referred to as the Guidelines) is formulated.

Article 2. The Guidelines apply to all the commercial banks legally incorporated within the territory of the People’s Republic of China.

The Guidelines may apply to other banking institutions including policy banks, rural cooperative banks, urban credit cooperatives, rural credit cooperatives, village banks, loan companies, financial asset management companies, trust and investment companies, finance firms, financial leasing companies, automobile financial companies and money brokers.


Article 3. The term “information technology” stated in the Guidelines shall refer to the system built with computer, communication and software technologies, and employed by commercial banks to handle business transactions, operation management, and internal communication, collaborative work and controls. The term also include IT governance, IT organization structure and IT policies and procedures.

Article 4. The risk of information technology refers to the operational risk, legal risk and reputation risk that are caused by natural factor, human factor, technological loopholes or management deficiencies when using information technology.

Article 5. The objective of information system risk management is to establish an effective mechanism that can identify, measure, monitor, and control the risks of commercial banks’ information system, ensure data integrity, availability, confidentiality and consistency, provide the relevant early warning, and thereby enable commercial banks’ business innovations, uplift their capability in utilizing information technology, improve their core competitiveness and capacity for sustainable development.



Chapter II IT governance

Article 6. The legal representative of commercial bank should be responsible to ensure compliance of this guideline.

Article 7. The board of directors of commercial banks should have the following responsibilities with respect to the management of information systems:
(1) Implementing and complying with the national laws, regulations and technical standards pertaining to the management of information systems, as well as the regulatory requirements set by the China Banking Regulatory Commission (hereinafter referred to as the “CBRC”);
(2) Periodically reviewing the alignment of IT strategy with the overall business strategies and significant policies of the bank, assessing the overall effectiveness and efficiency of the IT organization.
(3) Approving IT risk management strategies and policies, understanding the major IT risks involved, setting acceptable levels for these risks, and ensuring the implementation of the measures necessary to identify, measure, monitor and control these risks.
(4) Setting high ethical and integrity standards, and establishing a culture within the bank that emphasizes and demonstrates to all levels of personnel the importance of IT risk management.
(5) Establishing an IT steering committee which consists of representatives from senior management, the IT organization, and major business units, to oversee these responsibilities and report the effectiveness of strategic IT planning, the IT budget and actual expenditure, and the overall IT performance to the board of directors and senior management periodically.
(6) Establishing IT governance structure, proper segregation of duty, clear role and responsibility, maintaining check and balances and clear reporting relationship. Strengthening IT professional staff by developing incentive program.
(7) Ensuring that there is an effective internal audit of the IT risk management carried out by operationally independent, well-trained and qualified staff. The internal audit report should be submitted directly to the IT audit committee;
(8) Submitting an annual report to the CBRC and its local offices on information system risk management that has been reviewed and approved by the board of directors ;
(9) Ensuring the appropriating funding necessary for IT risk management works;
(10) Ensuring that all employees of the bank fully understand and adhere to the IT risk management policies and procedures approved by the board of directors and the senior management, and are provided with pertinent training.
(11) Ensuring customer information, financial information, product information and core banking system of the legal entity are held independently within the territory, and complying with the regulatory on-site examination requirements of CBRC and guarding against cross-border risk.
(12) Reporting in a timely manner to the CBRC and its local offices any serious incident of information systems or unexpected event, and quickly respond to it in accordance with the contingency plan;
(13) Cooperating with the CBRC and its local offices in the supervisory inspection of the risk management of information systems, and ensure that supervisory opinions are followed up; and
(14) Performing other related IT risk management tasks.

Article 8. The head of the IT organization, commonly known as the Chief Information Officer (CIO) should report directly to the president. Roles and responsibilities of the CIO should include the following:
(1) Playing a direct role in key decisions for the business development involving the use of IT in the bank;
(2) The CIO should ensure that information systems meet the needs of the bank, and IT strategies, in particular information system development strategies, comply with the overall business strategies and IT risk management policies of the bank;
(3) The CIO should also be responsible for the establishment of an effective and efficient IT organization to carry out the IT functions of the bank. These include the IT budget and expenditure, IT risk management, IT policies, standards and procedures, IT internal controls, professional development, IT project initiatives, IT project management, information system maintenance and upgrade, IT operations, IT infrastructure, Information security, disaster recovery plan (DRP), IT outsourcing, and information system retirement;
(4) Ensuring the effectiveness of IT risk management throughout the organization including all branches.
(5) Organizing professional trainings to improve technical proficiency of staff.
(6) Performing other related IT risk management tasks.

Article 9. Commercial banks should ensure that a clear definition of the IT organization structure and documentation of all job descriptions of important positions are always in place and updated in a timely manner. Staff in each position should meet relevant requirements on professional skills and knowledge. The following risk mitigation measures should be incorporated in the management program of related staff:
(1) Verification of personal information including confirmation of personal identification issued by government, academic credentials, prior work experience, professional qualifications;
(2) Ensuring that IT staff can meet the required professional ethics by checking character reference;
(3) Signing of agreements with employees about understanding of IT policies and guidelines, non-disclosure of confidential information, authorized use of information systems, and adherence to IT policies and procedures; and
(4) Evaluation of the risk of losing key IT personnel, especially during major IT development stage or in a period of unstable IT operations, and the relevant risk mitigation measures such as staff backup arrangement and staff succession plan.

Article 10. Commercial banks should establish or designate a particular department for IT risk management. It should report directly to the CIO and the Chief Risk Officer (or risk management committee), serve as a member of the IT incident response team, and be responsible for coordinating the establishment of policies regarding IT risk management, especially the areas of information security, BCP, and compliance with the CBRC regulations, advising the business departments and IT department in implementing these policies, providing relevant compliance information, conducting on-going assessment of IT risks, and ensuring the follow-up of remediation advice, monitoring and escalating management of IT threats and non-compliance events.

Article 11. Commercial banks should establish a special IT audit role and responsibility within internal audit function, which should put in place IT audit policies and procedures, develop and execute IT audit plan.

Article 12. Commercial banks should put in place policies and procedures to protect intellectual property rights according to laws regarding intellectual properties, ensure purchase of legitimate software and hardware, prevention of the use of pirated software, and the protection of the proprietary rights of IT products developed by the bank, and ensure that these are fully understood and complied by all employees.

Article 13. Commercial banks should, in accordance with relevant laws and regulations, disclose the risk profile of their IT normatively and timely.


Chapter III IT Risk Management

Article 14. Commercial banks should formulate an IT strategy that aligns with the overall business plan of the bank, IT risk assessment plan and an IT operational plan that can ensure adequate financial resources and human resources to maintain a stable and secure IT environment.

Article 15. Commercial banks should put in place a comprehensive set of IT risk management policies that include the following areas:
(1) Information security classification policy
(2) System development, testing and maintenance policy
(3) IT operation and maintenance policy
(4) Access control policy
(5) Physical security policy
(6) Personnel security policy
(7) Business Continuity Planning and Crisis and Emergency Management procedure

Article 16. Commercial banks should maintain an ongoing risk identification and assessment process that allows the bank to pinpoint the areas of concern in its information systems, assess the potential impact of the risks on its business, rank the risks, and prioritize mitigation actions and the necessary resources (including outsourcing vendors, product vendors and service vendors).

Article 17. Commercial banks should implement a comprehensive set of risk mitigation measures complying with the IT risk management policies and commensurate with the risk assessment of the bank. These mitigation measures should include:
(1) A set of clearly documented IT risk policies, technical standards, and operational procedures, which should be communicated to the staff frequently and kept up to date in a timely manner;
(2) Areas of potential conflicts of interest should be identified, minimized, and subject to careful, independent monitoring. Also it requires that an appropriate control structure is set up to facilitate checks and balances, with control activities defined at every business level, which should include:
- Top level reviews;
- Controls over physical and logical access to data and system;
- Access granted on “need to know” and “minimum authorization” basis;
- A system of approvals and authorizations; and
- A system of verification and reconciliation.

Article 18. Commercial banks should put in place a set of ongoing risk measurement and monitoring mechanisms, which should include
(1) Pre and post-implementation review of IT projects;
(2) Benchmarks for periodic review of system performance;
(3) Reports of incidents and complaints about IT services;
(4) Reports of internal audit, external audit, and issues identified by CBRC; and
(5) Arrangement with vendors and business units for periodic review of service level agreements (SLAs).
(6) The possible impact of new development of technology and new threats to software deployed.
(7) Timely review of operational risk and management controls in operation area.
(8) Assess the risk profile on IT outsourcing projects periodically.

Article 19. Chinese commercial banks operating offshore and the foreign commercial banks in China should comply with the relevant regulatory requirements on information systems in and outside the People’s Republic of China.


Chapter IV Information Security

Article 20. Information technology department of commercial banks should oversee the establishment of an information classification and protection scheme. All employees of the bank should be made aware of the importance of ensuring information confidentiality and provided with the necessary training to fully understand the information protection procedures within their responsibilities.

Article 21. Commercial banks should put in place an information security management function to develop and maintain an ongoing information security management program, promote information security awareness, advise other IT functions on security issues, serve as the leader of IT incident response team, and report the evaluation of the information security of the bank to the IT steering committee periodically. The Information security management program should include Information security standards, strategy, an implementation plan, and an ongoing maintenance plan.
Information security policy should include the following areas:
(1) IT security policy management
(2) Organization information security
(3) Asset management
(4) Personnel security
(5) Physical and environment security
(6) Communication and operation security
(7) Access control and authentication
(8) Acquirement, development and maintenance of information system
(9) Information security event management
(10) Business continuity management
(11) Compliance

Article 22. Commercial banks should have an effective process to manage user authentication and access control. Access to data and system should be strictly limited to authorized individuals whose identity is clearly established, and their activities in the information systems should be limited to the minimum required for their legitimate business use. Appropriate user authentication mechanism commensurate with the classification of information to be accessed should be selected. Timely review and removal of user identity from the system should be implemented when user transfers to a new job or leave the commercial bank.

Article 23. Commercial banks should ensure all physical security zones, such as computer centers or data centers, network closets, areas containing confidential information or critical IT equipment, and respective accountabilities are clearly defined, and appropriate preventive, detective, and recuperative controls are put in place.

Article 24. Commercial banks should divide their networks into logical security domains (hereinafter referred to as the “domain”) with different levels of security. The following security factors have to be assessed in order to define and implement effective security controls, such as physical or logical segregation of network, network filtering, logical access control, traffic encryption, network monitoring, activity log, etc., for each domain and the whole network.
(1) criticality of the applications and user groups within the domain;
(2) Access points to the domain through various communication channels;
(3) Network protocols and ports used by the applications and network equipment deployed within the domain;
(4) Performance requirement or benchmark;
(5) Nature of the domain, i.e. production or testing, internal or external;
(6) Connectivity between various domains; and
(7) Trustworthiness of the domain.

Article 25. Commercial banks should secure the operating system and system software of all computer systems by
(1) Developing baseline security requirement for each operating system and ensuring all systems meet the baseline security requirement;
(2) Clearly defining a set of access privileges for different groups of users, namely, end-users, system development staff, computer operators, and system administrators and user administrators;
(3) Setting up a system of approval, verification, and monitoring procedures for using the highest privileged system accounts;
(4) Requiring technical staff to review available security patches, and report the patch status periodically; and
(5) Requiring technical staff to include important items such as unsuccessful logins, access to critical system files, changes made to user accounts, etc. in system logs, monitors the systems for any abnormal event manually or automatically, and report the monitoring periodically.

Article 26. Commercial banks should ensure the security of all the application systems by
(1) Clearly defining the roles and responsibilities of end-users and IT staff regarding the application security;
(2) Implementing a robust authentication method commensurate with the criticality and sensibility of the application system;
(3) Enforcing segregation of duties and dual control over critical or sensitive functions;
(4) Requiring verification of input or reconciliation of output at critical junctures;
(5) Requiring the input and output of confidential information are handled in a secure manner to prevent theft, tampering, intentional leakage, or inadvertent leakage;
(6) Ensuring system can handle exceptions in a predefined way and provide meaningful message to users when the system is forced to terminate; and
(7) Maintaining audit trail in either paper or electronic format.
(8) Requiring user administrator to monitor and review unsuccessful logins and changes to users accounts.

Article 27. Commercial banks should have a set of policies and procedures controlling the logging of activities in all production systems to support effective auditing, security forensic analysis, and fraud prevention. Logging can be implemented in different layers of software and on different computer and networking equipment, which falls into two broad categories:
(1) Transaction journals. They are generated by application software and database management system, and contain authentication attempts, modification to data, error messages, etc. Transaction journals should be kept according to the national accounting policy.
(2) System logs. They are generated by operating systems, database management system, firewalls, intrusion detection systems, and routers, etc., and contain authentication attempts, system events, network events, error messages, etc. System logs should be kept for a period scaled to the risk classification, but no less than one year.
Banks should ensure that sufficient items be included in the logs to facilitate effective internal controls, system troubleshooting, and auditing while taking appropriate measures to ensure time synchronization on all logs. Sufficient disk space should be allocated to prevent logs from being overwritten. System logs should be reviewed for any exception. The review frequency and retention period for transaction logs or database logs should be determined jointly by IT organization and pertinent business lines, and approved by the IT steering committee.

Article 28. Commercial banks should have the capacity to employ encryption technologies to mitigate the risk of losing confidential information in the information systems or during its transmission. Appropriate management processes of the encryption facilities should be put in place to ensure that
(1) Encryption facilities in use should meet national security standards or requirements;
(2) Staff in charge of encryption facilities are well trained and screened;
(3) Encryption strength is adequate to protect the confidentiality of the information; and
(4) Effective and efficient key management procedures, especially key lifecycle management and certificate lifecycle management, are in place.

Article 29. Commercial banks should put in place an effective and efficient system of securing all end-user computing equipment which include desktop personal computers (PCs), portable PCs, teller terminals, automatic teller machines (ATMs), passbook printers, debit or credit card readers, point of sale (POS) terminals, personal digital assistant (PDAs), etc and conduct periodic security checks on all equipments.

Article 30. Commercial banks should put in place a set of policies and procedures to govern the collection, processing, storage, transmission, dissemination, and disposal of customer information.

Article 31. All employees, including contract staff, should be provided with the necessary trainings to fully understand these policies procedures and the consequences of their violation. Commercial banks should adopt a zero tolerance policy against security violation.


Chapter V Application System Development, Testing and Maintenance

Article 32. Commercial banks should have the capability to identify, plan, acquire, develop, test, deploy, maintain, upgrade, and retire information systems. Policies and procedures should be in place to govern the initiation, prioritization, approval, and control of IT projects. Progress reports of major IT projects should be submitted to and reviewed by the IT steering committee periodically. Decisions involving significant change of schedule, change of key personnel, change of vendors, and major expenditures should be included in the progress report.

Article 33. Commercial banks should recognize the risks associated with IT projects, which include the possibilities of incurring various kinds of operational risk, financial losses, and opportunity costs stemming from ineffective project planning or inadequate project management controls of the bank. Therefore, appropriate project management methodologies should be adopted and implemented to control the risks associated with IT projects.

Article 34. Commercial banks should adopt and implement a system development methodology to control the life cycle of Information systems. The typical phases of system life cycle include system analysis, design, development or acquisition, testing, trial run, deployment, maintenance, and retirement. The system development methodology to be used should be commensurate with the size, nature, and complexity of the IT project, and, generally speaking, should facilitate the management of the following risks.

Article 35. Commercial banks should ensure system reliability, integrity, and maintainability by controlling system changes with a set of policies and procedures, which should include the following elements.
(1) Ensure that production systems are separated from development or testing systems;
(2) Separating the duties of managing production systems and managing development or testing systems;
(3) Prohibiting application development and maintenance staff from accessing production system under normal circumstances unless management approval is granted to perform emergency repair, and all emergency repair activities should be recorded and reviewed promptly;
(4) Promoting changes of program or system configuration from development and testing systems to production systems should be jointly approved by IT organization and business departments, properly documented, and reviewed periodically.

Article 36. Commercial banks should have in place a set of policies, standards, and procedures to ensure data integrity, confidentiality, and availability. These policies should be in accordance with data integrity amid IT development procedure.

Article 37. Commercial banks should ensure that Information system problems could be tracked, analyzed, and resolved systematically through an effective problem management process. Problems should be documented, categorized, and indexed. Support services or technical assistance from vendors, if necessary, should also be documented. Contacts and relevant contract information should be made readily available to the employees concerned. Accountability and line of command should be delineated clearly and communicated to all employees concerned, which is of utmost importance to performing emergency repair.

Article 38. Commercial banks should have a set of policies and procedures controlling the process of system upgrade. System upgrade is needed when the hardware reaches its lifespan or runs out of capacity, the underpinning software, namely, operating system, database management system, middleware, has to be upgraded, or the application software has to be upgraded. The system upgrade should be treated as a project and managed by all pertinent project management controls including user acceptance testing.


Chapter VI IT Operations

Article 39. Commercial banks should consider fully the environmental threats (e.g. proximity to natural disaster zones, dangerous or hazardous facilities or busy/major roads) when selecting the locations of their data centers. Physical and environmental controls should be implemented to monitor environmental conditions could affect adversely the operation of information processing facilities. Equipment facilities should be protected from power failures and electrical supply interference.

Article 40. In controlling access by third-party personnel (e.g. service providers) to secured areas, proper approval of access should be enforced and their activities should be closely monitored. It is important that proper screening procedures including verification and background checks, especially for sensitive technology-related jobs, are developed for permanent and temporary technical staff and contractors.

Article 41. Commercial banks should separate IT operations or computer center operations from system development and maintenance to ensure segregation of duties within the IT organization. The commercial banks should document the roles and responsibilities of data center functions.

Article 42. Commercial banks are required to retain transactional records in compliance with the national accounting policy. Procedures and technology are needed to be put in place to ensure the integrity, safekeeping and retrieval requirements of the archived data.



Article 43. Commercial banks should detail operational instructions such as computer operator tasks, job scheduling and execution in the IT operations manual. The IT operations manual should also cover the procedures and requirements for on-site and off-site backup of data and software in both the production and development environments (i.e. frequency, scope and retention periods of back-up).

Article 44. Commercial banks should have in place a problem management and processing system to respond promptly to IT operations incidents, to escalate reported incidents to relevant IT management staff and to record, analyze and keep tracks of all these incidents until rectification of the incidents with root cause analysis completed. A helpdesk function should be set up to provide front-line support to users on all technology-related problems and to direct the problems to relevant IT functions for investigation and resolution.

Article 45. Commercial banks should establish service level agreement and assess the IT service level standard attained.

Article 46. Commercial banks should implement a process to ensure that the performance of application systems is continuously monitored and exceptions are reported in a timely and comprehensive manner. The performance monitoring process should include forecasting capability to enable exceptions to be identified and corrected before they affect system performance.

Article 47. Commercial banks should carry out capacity plan to cater for business growth and transaction increases due to changes of economic conditions. Capacity plan should be extended to cover back-up systems and related facilities in addition to the production environment.

Article 48. Commercial banks should ensure the continued availability of technology related services with timely maintenance and appropriate system upgrades. Proper record keeping (including suspected and actual faults and preventive and corrective maintenance records) is necessary for effective facility and equipment maintenance.

Article 49. Commercial banks should have an effective change management process in place to ensure integrity and reliability of the production environment. Commercial banks should develop a formal change management process.


Chapter VII Business Continuity Management

Article 50. Commercial banks should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness.

Article 51. Commercial banks should consider the likelihood and impact of a disruption to the continuity of its operation from unexpected events. This should include assessing the disruptions to which it is particularly susceptible including but not limited to:
(1) Loss of failure of internal and external resources (such as people, systems and other assets);
(2) The loss or corruption of its information; and
(3) External events (such as war, earthquake, typhoon, etc).

Article 52. Commercial bank should act to reduce both the likelihood of disruptions (including system resilience and dual processing); and the impact of disruptions (including by contingency arrangements and insurance).

Article 53. Commercial bank should document its strategy for maintaining continuity of its operations, and its plans for communicating and regularly testing the adequacy and effectiveness of this strategy. Commercial bank should establish:
(1) Formal business continuity plans that outline arrangements to reduce the impact of a short, medium and long-term disruption, including:
a) Resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
b) The recovery priorities for the commercial bank’s operations; and
c) Communication arrangements for internal and external concerned parties (including CBRC, clients and the press);
(2) Escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
(3) Processes to validate the integrity of information affected by the disruption;
(4) Processes to review and update (1) to (3) following changes to the commercial bank’s operations or risk profile.

Article 54. A final BCP plan and an annual drill result must be signed off by the IT Risk management, or internal auditor and IT Steering Committee.


Chapter VIII Outsourcing

Article 55. Commercial banks cannot contract out its regulatory obligations and should take reasonable care to supervise the discharge of outsourcing functions.

Article 56. Commercial banks should take particular care to manage material outsourcing arrangement (such as outsourcing of data center, IT infrastructure, etc.), and should notify CBRC when it intends to enter into material outsourcing arrangement.

Article 57. Before entering into, or significantly changing, an outsourcing arrangement, the commercial bank should:
(1) Analyze how the arrangement will fit with its organization and reporting structure; business strategy; overall risk profile; and ability to meet its regulatory obligations;
(2) Consider whether the arrangements will allow it to monitor and control its operational risk exposure relating to the outsourcing;
(3) Conduct appropriate due diligence of the service provider’s financial stability, expertise and risk assessment of the service provider, facilities and ability to cover the potential liabilities;
(4) Consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement (including what will happen on the termination of the contract); and
(5) Consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms.

Article 58. In negotiating its contract with a service provider, the commercial bank should have regard to ( but not limited to ):
(1) Reporting and negotiation requirements it may wish to impose on the service provider;
(2) Whether sufficient access will be available to its internal auditors, external auditors and banking regulators;
(3) Information ownership rights, confidentiality agreements and Firewalls to protect client and other information (including arrangements at the termination of contract);
(4) The adequacy of any guarantees and indemnities;
(5) The extent to which the service provider must comply with the commercial bank’s polices and procedures covering IT Risk;
(6) The extent to which the service provider will provide business continuity for outsourced operations, and whether exclusive access to its resources is agreed;
(7) The need for continued availability of software following difficulty at a third party supplier;
(8) The processes for making changes to the outsourcing arrangement and the conditions under which the commercial bank or service provider can choose to change or terminate the outsourcing arrangement, such as where there is:
a) A change of ownership or control of the service provider or commercial bank; or
b) Significant change in the business operations of the service provider or commercial bank; or
c) Inadequate provision of services that may lead to the commercial bank being unable to meet its regulatory obligations.

Article 59. In implementing a relationship management framework, and drafting the service level agreement with the service provider, the commercial bank should have regarded to (but not limited to):
(1) The identification of qualitative and quantitative performance targets to assess the adequacy of service provision, to both the commercial bank and its clients, where appropriate;
(2) The evaluation of performance through service delivery reports and periodic self assessment and independent review by internal or external auditors; and
(3) Remediation action and escalation process for dealing with inadequate performance.

Article 60. The commercial bank should enhance IT related outsourcing management, in place following (not limited to ) measures to ensure data security of sensitive information such as customer information:
(1) Effectively separated from other customer information of the service provider;
(2) The related staff of service provider should be authorized on “need to know” and “minimum authorization” basis;
(3) Ensure service provider guarantee its staff for meeting the confidential requests;
(4) All outsourcing arrangements related to customer information should be identified as material outsourcing arrangements and the customers should be notified;
(5) Strictly monitor re-outsourcing actions of the service provider, and implement adequate control measures to ensure information security of the bank;
(6) Ensure all related sensitive information be refunded or deleted from the service provider’s storage when terminating the outsourcing arrangement.


Article 61. The commercial bank should ensure that it has appropriate contingency in the event of a significant loss of services from the service provider. Particular issues to consider include a significant loss of resources, turnover of key staff, or financial failure of, the service provider, and unexpected termination of the outsourcing agreement.

Article 62. All outsourcing contracts must be reviewed or signed off by IT Risk management, internal IT auditors, legal department and IT Steering Committee. There should be a process to periodically review and refine the service level agreements.


Chapter IX Internal Audit

Article 63. Depending on the nature, scale and complexity of its business, it may be appropriate for the commercial banks to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function. An internal audit function should be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the commercial bank and have appropriate access to the bank’s records.

Article 64. The responsibilities of the internal IT audit function are:
(1) To establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the bank’s systems and internal control mechanisms and arrangements;
(2) To issue recommendations based on the result of work carried out in accordance with 1;
(3) To verify compliance with those recommendations;
(4) To carry out special audit on information technology. The term “special audit” of information technology refers to the investigation, analysis and assessment on the security incidents of the information system, or the audit performed on a special subject based on IT risk assessment result as deemed necessary by the audit department.

Article 65. Based on the nature, scale and complexity of its business, deployment of information technology and IT risk assessment, commercial banks could determine the scope and frequency of IT internal audit. However, a comprehensive IT internal audit shall be performed at a minimum once every 3 years.

Article 66. Commercial banks should engage its internal audit department and IT Risk management department when implementing system development of significant size and scale to ensure it meets the IT Risk standards of the Commercial banks.


Chapter X External Audit

Article 67. The external information technology audit of commercial banks can be carried out by certified service providers in accordance with laws, rules and regulations.

Article 68. The commercial bank should ensure IT audit service provider to review and examine bank’s hardware, software, documentation and data to identify IT risk when they are commissioned to perform the audit. Vital commercial and technical information which is protected by national laws and regulations should not be reviewed.

Article 69. Commercial bank should communicate with the service provider in depth before the audit to determine audit scope, and should not withhold the truth or do not corporate with the service provider intentionally.

Article 70. CBRC and its local offices could designate certified service providers to carry out IT audit or related review on commercial banks when needed. When carrying out audit on commercial banks, as commissioned or authorized by CBRC or its local offices, the service providers shall present the letter of authority, and carry out the audit in accordance to the scope prescribed in the letter of authority.

Article 71. Once the IT audit report produced by the service providers is reviewed and approved by CBRC or its local offices, the report will have the same legal status as if it is produced by the CBRC itself. Commercial banks should come up with a correction action plan prescribed in the report and implement the corrective actions according to the timeframe.

Article 72. Commercial banks should ensure the service providers to strictly comply with laws and regulations to keep confidential and data security of any commercial secrets and private information learnt and IT risk information when conducting the audit. The service provider should not modify copy or take away any documents provided by the commercial banks.


Chapter XI Supplementary Provisions

Article 73. Commercial banks with no board of directors should have their operating decision-making bodies perform the responsibilities of the board with regard to IT risk management specified herein.

Article 74. The China Banking Regulatory Commission supervises and regulates the IT risk management of commercial banks under its authority by law.

Article 75. The power of interpretation and modification of the Guidelines shall rest with the China Banking Regulatory Commission.

Article 76. The Guidelines shall become effective as of the date of its issuance and the former Guidelines on the Risk Management of Banking Institutions’ Information Systems shall be revoked at the same time.