Registered investment advisors, as well as a fair contingent of state registered investment advisors, are required to prepare and maintain a Business Continuity Plan. Recently, I spoke to my partner and BCP expert, Steve Galletto, regarding this regulatory requirement.
Steve explained that the purpose of the BCP is to help ensure that a firm is prepared to adapt and overcome a significant business disruption that could be caused by, for example, natural disaster, loss of key personnel, or even just a service outage. Firms with an effective plan in place will find themselves in a better position to service clients as they are able to mitigate business disruptions and reduce downtimes. However, for a BCP to be effective it can't just look good on paper.
To strengthen your plan, avoid these pitfalls:
1. Unrealistic expectations. Your plan should be drafted to help your firm adapt and overcome foreseeable business disruptions, not just the most likely disruption events. Many plans assume that certain key/critical services will be available (i.e. power, cell phones, phone lines, Internet, water) and will be fully functional. Plans may also assume that staff will be in a position to show up for work, and won't be otherwise personally effected by the circumstances leading to the business disruption.
But your firm does not operate in a bubble. Your BCP should provide structure for those who are available to assist with resolving the business disruption while also providing the necessary information and resources for those individuals to succeed.
2. Failing to see the big picture. If your plan's only focus is backing up and protecting your firm's books and records, you are missing the big picture. Sure, your BCP must address how the firm will survive a digital record catastrophe, but it also should focus on personnel and facilities. Communication with staff is essential. If you can't communicate with your staff, there is no effective way to execute the plan. Furthermore, all firms rely on essential systems and services to conduct their business. You must identify these systems and services and create a recovery protocol, which will be the roadmap for the resolution of any business disruption.
