The U.S. Securities and Exchange Commission (SEC) issued a risk alert, which calls on investment firms to review their disaster planning.
The SEC’s Office of Compliance Inspections and Examinations (OCIE) Wednesday issued an alert on business continuity and disaster recovery planning for investment advisors. The alert follows a review of firms’ responses to Hurricane Sandy last October, which caused widespread damage in the Northeastern U.S. and equity and options markets to stay closed for two days.
Earlier this month, regulators issued a joint advisory on similar issues, which covered a broad array of firms, whereas this new alert focuses solely on investment advisors. Both notices call on firms to review their business continuity plans in order to improve their responses to, and reduce recovery time after, this sort of significant disruption.
THE SEC’s review of advisors found that some firms have business continuity plans (BCPs) that did not adequately address and anticipate widespread events, and that these firms “generally experienced more interruptions in their key business operations and inconsistent communications with clients and employees.”
It also suggests that coastal firms consider the need for an inland back-up site, and geographic diversity generally, so that all a firm’s sites are not affected by the same power and utility outages as the main office.
The review also found that some advisors did not evaluate the BCPs of their service providers, and it suggests that they should consider reviewing the IT infrastructure of service providers, and whether it is necessary to have multiple back-up servers.
Additionally, it says that advisors should consider having alternate internet providers, or guaranteed redundancy from their existing providers; and that they should explore whether it makes sense to keep back-up files and systems in their primary office location. “Many advisors stated that they are now exploring the use of cloud computing,” it says.
The report also suggests that advisors should consider contacting clients before a major storm to see if they have any transactions they will need executed if an extended outage occurs. And, it says that advisors should consider testing the operability of all critical systems under the BCP using various scenarios.
“Our staff examined approximately 40 advisors in the aftermath of Hurricane Sandy to assess their preparedness for and reaction to the storm,” said OCIE director, Andrew Bowden. “We hope our observations in this risk alert and those in the earlier joint advisory will help industry participants better prepare for future events that threaten to disrupt market operations.”