It's Not A Matter Of If It's A Matter Of When Business Continuity Plans - Are You Prepared? by Warren Forest
In light of the recent events concerning the Corona virus, that have affected all of us, it is very important that Broker/Dealers ("B/D"), and Registered Investment Advisers ("RIA") look at their systems and procedures regarding Significant Business Disruptions ("SBD"). Is your business prepared to handle a disruption? Do you have a written plan in place? Has your plan been tested? These questions, and others need to be addressed now, to insure that your operations can continue during times of duress.
For many years now, regulators, including the Securities and Exchange Commission ("SEC"), FINRA and State Securities Commissioners, have required both B/D's and RIA's, to have Business Continuity Plans ("BCP") in place. Along with a formal BCP, B/D's and RIA's must also give a disclosure statement to their customers, informing them of the fact that a written plan exists, that the customer can get a copy of the written BCP, and most importantly, that there are alternate ways to get in touch with the B/D, or RIA in the event that an actual business disruption occurs.
Of course, no one can predict the exact nature of a calamitous event. But there are basically two major types of SBD's, internal and external. Internal disruptions affect a firm’s ability to communicate and do business. A good example of an internal disruption is a fire in your building. An external business disruption prevents the operation of the securities markets or a number of firms, such as a terrorist attack, a city flood, or a wide-scale, regional/national disruption, such as a pandemic. While an internal SBD does not have the widespread effect that an external SBD has, both situations need to be addressed.
When addressing both internal and external SBD's, several important areas should be recognized. First, is your company's data. Is it saved and protected? Can you access data in the event you are displaced from your normal business environment? Customer and account information is the lifeblood of a financial institution's business. It is imperative that this data be protected and accessible in the event of an SBD.
Another major area of concern is communication abilities. Can you get in touch with your associates and your customers during a business interruption? More importantly, do your customers and associates know how to get in touch with you if there is a business disruption? Communication is a critical factor in running a successful financial service firm, and it is imperative that B/D's and RIA's have the systems and procedures in place to achieve this.
An effective BCP will address and name particular individuals to contact in the event of an SBD. BCPs should designate at least two emergency contact individuals. Telephone numbers, email addresses and any other means of communication, should be communicated to both firm associates and customers. Often a calling tree will be utilized among firm associates, so that necessary information is communicated down the organizational chain.
Are there procedures and capabilities in place to work remotely? Whether the SBD is internal, or external, accessing the office may not be possible. Staff should be able to work remotely from home, or another off site location.
One of the primary concerns in formulating your BCP, is ensuring that your customers have access to their funds and securities. Therefore, it is essential that a B/D or RIA coordinate their efforts with third party partners, such as Clearing Firms, Investment Companies and Custodial Firms, when developing and implementing a BCP. For the majority of B/D's and RIA's, it is the third party partner that actually holds customer funds and securities. Informing customers that they can access their assets directly if the B/D, or RIA is unable to, is critical to their financial well being.
It is one thing to say you are going to do something, but can you actually do what you say you are going to? In other words, testing your BCP is as important as developing it, if not more so. Once you have identified the essential elements of your plan, do a test run, as if an actual SBD has occurred. Utilize the call chain, try working remotely, back up your data, etc.
In a worst case scenario, do you have the financial resources to weather the disruption and restart your business? Check all insurance coverage to make sure that it is adequate to replace any lost, or damaged assets such as buildings and computers. Try and have at least six months of cash reserves, although a year's worth would be idea, to cover your expenses.
BCP's were never designed to be static documents. That means your BCP should be viewed as a "living" document, and should regularly be reviewed, amended and updated as needed. Formally, the BCP must be reviewed at least annually and the company's CEO, or CCO must sign off on it. In light of the recent events affecting all of us, it would be prudent to amend your BCP to include Pandemic occurrences if you have not already done so.
The time to prepare for a SBD, is well in advance of the disruption happening. If you need assistance with a BCP, or any other compliance related issue, please feel free to contact us at (407) 696-9600, or warren@forestbrokerageadvisers.com. We at Forest Brokerage Advisers, Inc. are here to help you.