Three Cost-Effective Ways to Improve Your Business Continuity Planning and Protect Your Firm

Transcription

1 Three Cost-Effective Ways to Improve Your Business Continuity Planning and Protect Your Firm In the past few years, business disruptions have brought the financial industry under greater scrutiny. Superstorm Sandy exposed Business Continuity Plan (BCP) problems, just as recent NASDAQ and Knight Capital software glitches exposed technology management issues, and the Madoff and MF Global incidents exposed shortcomings in operational controls. As a result, financial firms are under the microscope. Investors and regulators are drilling deeper into operational practices, and Business Continuity Planning is no exception. Now is the time to review and revise your plan to improve your response to the next audit, the next Due Diligence Questionnaire, and the next natural disaster.

2 The Ignored Lesson from Superstorm Sandy Many heard the forecast for Superstorm Sandy and never thought that things could actually get as bad as predicted, much less get worse as the storm approached. What were the odds that the New York City subway system would flood and workers would be unable to get to their jobs? Who could predict that Wall Street area businesses and residents would be without power for a week, or in some cases, months? In light of the press s focus on the once-in ahundred year convergence of weather, power, and transportation issues, many decided that only large capital investments could have prevented the issues they experienced and have opted to leave their BCP unchanged. However, the status quo approach is a mistake. The real lessons from Sandy are practical ones. Many BCP problems were not due to the failure of redundant technology; they were due to ignoring basic core BCP principles. It is critical to fix these oversights in order to be prepared for the next incident. The thoughtful, well-planned approach to BCP will have the additional benefits of demonstrating to Investors that you are protecting their assets effectively, and satisfy Auditors that you are prepared. A few basic changes to your BCP can make a major difference in your ability to recover from an event. Three Core BCP Components The following three core BCP components are frequently overlooked, but make a significant difference: Testing and Training Communication Know Your Service Providers Without these three elements in place, your recovery plan is in jeopardy, and not even a fully redundant infrastructure can protect you. 2

3 Testing and Training If you don t test your plan, the first time you will learn if it works is during an actual disaster. It is common wisdom that testing a business-critical system before using it in production is best practice, yet frequently firms ignore this principle in their BCP. When was the last time you tested with the full team s participation? Whenever you can: test your plan, train your staff, communicate with others, and minimize service provider risk. How often do critical employees work from home? Can they fully function from a remote location? Verify regularly that they have access to the necessary data and applications, and that all software licenses are up to date. Is your staff cross-trained sufficiently so that they can fill in for one another in an event? Testing your BCP program with the alternative recovery team members will reveal if they are prepared to provide backup. Is every business-critical system incorporated into the backup environment and tested before production rollout? A good BCP program recognizes that a firm s technology changes over time and ensures that all new systems and applications are included in the next comprehensive test. The easiest way to improve your staff s ability to perform critical business functions is to ensure that they are trained properly and that they participate in periodic test scenarios. Regular checks on their BCP proficiency will reveal any gaps and identify areas for improvements. Employees well-versed in the firm s BCP will be able to make a successful transition in a disruption. 3

4 Communication Precious time will be wasted when responding to a disruption if you have not previously assigned a BCP Leader to oversee the response and recovery, or your communication plan is outdated or missing information. Does your call list include phone numbers for home and personal cell phones as well as personal addresses? If you obtain contact information prior to an event for family members of both employees and investors, you will expand your network and increase your ability to get in touch with everyone quickly. How does your staff obtain firm news? If your system is down, is your staff aware of alternative means of communicating with each other? Have you set up a social networking site they can use to post status and retrieve information? This is the time to ensure that everyone has access to text messages, and to assign a buddy who lives nearby to enable employees to support each other and share resources. Good communication is a critical component of a successful Business Continuity Plan. Without it, your recovery time and associated costs are certain to increase. Responsibility for overseeing your recovery efforts belongs with senior management. If they do not have access to current information, it will be difficult to act and your firm will experience unnecessary delays. Correct contact data directly affects your ability to collect information, assign tasks to employees, and update your key investors. 4

5 Know Your Service Providers Every business-critical relationship has inherent risks. Even if you have a defined service level agreement (SLA) with an external service provider, it is unlikely that the SLA terms will compensate for the full cost of the business disruption. With municipal authorities and public utilities, you may have minimal control over the services they provide. As additional functions are outsourced, your BCP will be increasingly dependent on external service providers. Do you know how your counterparties and custodians BCP will affect you? Their disaster readiness directly affects your ability to settle trades and move cash, and they should participate in your regular testing. In the event of a service provider outage, are the services prioritized so that you know where to focus your immediate efforts? Knowing the recovery time objective for each critical business function allows your team to execute your plan efficiently and put alternatives in place quickly. What if roads, bridges and tunnels to the office are not passable or mass transit is unavailable? If you need a backup office and a fully redundant site is not economically feasible, one option is a reciprocal agreement with a client or a service provider to share space in case either office is inaccessible. What if your office is unusable and your staff loses power at home? If you have a backup site with a generator, how many days of fuel should you stockpile? Portable wireless devices and sufficient fuel for a long-term outage increases your ability to respond effectively. One of the most important aspects of a comprehensive business continuity program is the level of involvement of external parties: local officials, counterparties, brokers, regulatory bodies, and service providers. The greater their familiarity with your BCP and the more you know about their plans, the more effective your event response and recovery will be. 5

6 Summary With the hindsight afforded by recent outages and some additional due diligence, your plan will be more responsive to your employees and clients needs not to mention your business s viability. And, you may find that your ability to recover has become the market differentiator you ve been looking for. Next Steps Using Sindex s proprietary BCP Scorecard methodology, we can quickly assess your plan versus regulatory and Disaster Recovery Institute standards. For smaller firms we can frequently provide this service at a fixed cost. This comprehensive tool will evaluate the details of your plan in fifteen categories, including data backup and recovery, mission-critical systems, financial and operational assessments, and the impact on critical business relationships. The service grades adherence to financial industry best practices, and provides a clear picture of what issues require attention and remediation. Contact Us For inquiries on our BCP Advisory Service: Joan Ross jross@sindexsystems.com Office: For general inquiries: Mike Berger mberger@sindexsystems.com Office: Our office address: Sindex Financial Systems 158 West 23 rd Street Second Floor New York, NY On the web: Three cost-effective ways to improve your business continuity planning and protect your firm are: Test your BCP, and give your staff the training needed to execute the plan. Make sure you have a solid communication plan that enables your staff to keep critical business functions up and running while coordinating the return to business as usual. Include external service providers as integral partners in your Business Continuity Plan Sindex Systems, Inc. 6