Business Continuity Plan

Transcription

1 Business Continuity Plan Revision as of Continuum Wealth Advisors, LLC 18 Division St.; Suite 207B Saratoga Springs, NY 12866

2 Introduction Recent events have brought the importance of creating and maintaining the business continuity plans to light. In 2001, securities industry regulators surveyed firms in their jurisdictions to evaluate: Existence and/or content of Business Continuity Plans Data back-up procedures Location of books and records Effects of the events of September 11, 2001 on the ability to conduct business From the survey results, they determined that firms in the investment industry required guidance for development of written plans for recovery of their critical systems in the event of an unanticipated interruption in business. To meet regulatory expectations, the firm s BCP must be reasonably designed to ensure that the firm can meet present obligations to customers in an unplanned interruption in business, such as in an emergency. The regulators do not intend for all business continuity plans to be the same. Given the variety found among investment firms as well as the diverse nature of their businesses, firms must design customized plans to meet operational, size and other needs. Regulatory guidance suggests that the plan contain: Operational assessments Provisions for rapid resumption of mission critical systems Back-up arrangements for material relationships with business constituents, banks and appraisals of counter-party impact Back-up system for recovery of data (both hard copy and electronic data) Alternate means for communications for use between employees and the firm, as well as between customers and the firm Instructions for communications with regulators and regulatory reporting requirements in the event of a disaster Description of the alternate physical locations of employees and/or certain departments Assurance for customers prompt access to their funds and securities in the event the firm determines it is unable to continue its business Provisions for updating the plan Provisions for periodic testing of the plan Notification of relevant provisions of the plan to customers of the firm

3 Our plan will address each of the relevant elements above. Internal, Sensitive Company Information The following section of the BCP addresses the firm s mission critical systems, areas of importance to the ongoing operation of the firm. Each section will address a specific type of risk, and will provide information and instructions to managers charged with responsibility for those areas. Operations Contact Information In the event of an unplanned interruption in our business, it will first be important for us to know whom to contact and how. Access to this information at the time of an emergency will facilitate the resumption of the firm s operations. Because our BCP is maintained online, access to this information is available through any web browser. Persons charged with responsibility for data or information in this section will be informed of their log-on information for emergency purposes and are encouraged to also retain a printed copy in a safe location offsite. In the event of an emergency or other interruption in our business, employees have been provided with contact information for all other employees. Both home phone numbers and mobile numbers have been shared. Mission Critical Operations Risk Assessment In order for the firm to resume its operations following an unplanned interruption, it must have an understanding of its mission critical systems and its critical business constituents. The firm is prepared to implement steps to restore relationships, systems and contacts accordingly. Mission critical systems are those which are necessary to maintain the operation of the business, including its infrastructure. Depending upon the firm s business or the nature of the transactions processed, this may consist of anything related to order taking, entry, execution, comparison, allocation and settlement. Since a disaster might affect access to customer accounts, associated persons (including employees, principals, and even clerical staff) must be fully aware of how the plan will be maintained. This would include the systems for: Order taking, order entry Execution, comparison, allocation Clearance and settlement of securities transactions Maintenance of customer accounts, access to customer accounts Delivery of funds and securities

4 The firm does not maintain custody of customers funds or securities, which are maintained at our primary custodian, Charles Schwab & Co., Inc., or directly at a fund/annuity company. In the event of a significant business interruption and if telephone service is available, the firm s registered persons will take customer orders or instructions and contact the clearing firm on the customer s behalf. If internet access is available, customers may access their funds and securities by contacting their custodian directly. The firm will make this information available to customers through its disclosure policy and/or through other means. If the significant business disruption is so severe that it prevents the firm from remaining in business, the firm will assure its customer s prompt access to their funds and securities through contacting their respective custodian. Financial and Credit Risk Essential to our ability to manage risk is an understanding of where we face financial risk, including our ability to fund our operations and maintain adequate financing and sufficient capital. Additionally, we must manage our credit risk. Credit risk might be experienced in the event of an emergency due to the erosion of investments or capital resulting from the lack of liquidity in the broader market. In the event a principal of the firm determines that the firm may be unable to meet its obligations to any party listed above or otherwise to continue to fund its operations, the principal(s) may first seek alternative financing. If the firm s capital obligations cannot be met or remedied, a principal of the firm will file appropriate notices with the regulators. If the firm s capital obligations cannot be met or remedied, the principal will contact FINRA (Financial Industry Regulatory Authority). Back Up Recovery of the firm s data in the event customary systems cannot be accessed is a key component of the plan to resume operations in a timely and efficient manner. To accomplish this, the firm must catalogue the types of data it retains, the manner in which the data is retained (paper or electronic), and the location. Securities firms are subject to regulations that require documents and data to be maintained in certain manner and for certain periods of time. When prioritizing the recovery of data, these securities regulations should also be considered. Document Retention and Back Up The firm maintains all primary hard copy books and records at 3N Document Destruction; 748 Pierce Road; Clifton Park, NY Storage boxes are arranged chronologically. Certain documents and records are submitted to the custodian(s), so alternative access may be available in the event of an emergency. These records include client account forms, trade

5 records, duplicate statements, etc. The custodian(s) has represented to us that these records are retained by them in compliance with prevailing regulations and laws including the SEC, FINRA or state retention requirements, and federal laws, such as those laws protecting the non-public records of individuals. In addition, the firm maintains its back-up documents and records in electronic format using Laserfiche scanning and indexing software. This electronic client filing system is then backed up offsite at least daily by a third-party IT firm, Stored Technology Solutions, Inc.; 5 Sagamore St., Suite A; Glens Falls, NY In the event of an emergency or unplanned interruption that causes the loss of our paper records or which interrupts our access to the records, the physical/electronic recovery plan will be put into place. This will require that we access the copies from the firm s back-up site, noted above. Operations will be conducted from 5 Nostalgia Lane; Ballston Spa, NY until such time as our primary site and records can be accessed and normal operations resume. The firm s contract with its custodian(s) provides that the custodian(s) will maintain a business continuity plan and the capacity to execute that plan. The custodian(s) represents that it will advise a principal of the firm of any material changes to its plan that might affect its ability to maintain our business, and whether or not services to our firm will differ in timeliness or any other manner from other clients of the custodian(s). Network Security Security of the firm s network can be best achieved through well-thought out systems of protection. Although complex procedures may be required in certain instances, often simpler processes are easier to understand, implement and enforce. In determining its own procedures for the security of its network, the firm will consider: Firewalls, including centrally deployed rules and external resources Centrally managed protocol for user ID and Password updates according to scheduled time frames Proactive scanning and network monitoring for suspicious behavior, new hosts, out-ofdate systems. A principal of the firm will implement one or more of the best practices noted above in an ongoing effort to maintain the security of its network. Updates to the Plan

6 The firm will update this plan as necessary based on material changes to its operations, general business, organizational structure or location. Among the types of changes that will be considered to be material are: Change of/addition to approved custodian Reorganization or addition/termination of responsible principals named in this document System enhancements, such as new network server, new back-up or retention software New or additional record-keeping location such as new branch location Any other change that would interfere with the orderly execution of this plan Testing the Plan To best ensure that the plan is adequate to provide means for rapid recovery of its essential systems, the firm will conduct periodic testing that may include: Audit of the back-up data Survey of responsible principals, including a duties assessment Survey of personnel to determine their knowledge of key components of the plan Planned disruption in any critical systems, such as the primary/secondary server or the central phone system