Business Continuity Planning: A Real-World Test

Business Continuity Planning: A Real-World Test

Ever since the SEC and other regulatory bodies (i.e., FINRA) identified the possibility of “significant business disruptions” many years ago and mandated that registrants create, maintain, and test a Business Continuity Plan (“BCP”), these plans have rarely been taken very seriously until they are needed.

A story has circulated over the years that an independent broker-dealer in Garland, Texas named “Bullish Bob Bagley” (you cannot make this up) was audited by FINRA and cited for not having a BCP. Bullish Bob, as the story goes, tried to explain that he was a one-man shop, at the time, and he always showed up for work! This didn’t sit well with FINRA, as you might imagine, and Bullish Bob was forced to create a BCP to be posted on his website. In typical “I’LL SHOW YOU!” fashion, Bob created it going into such detail as “I walk out of my house and turn left. As I approach the first intersection, I look both ways ensuring that there are no oncoming cars before I step into the crosswalk.” Apparently, it satisfied the FINRA examiners and created significant fodder for the compliance conferences; Bullish Bob Bagley remains a hero to the silent masses! For the record, you can view the most recent BCP for Bullish Bob here. Over the years, it has been modified to (barely) meet FINRA requirements, but his humor still comes through, especially towards the end.

Now we can all agree that Bullish Bob certainly doesn’t take the BCP as seriously as some of the larger firms, but on September 11, 2001, those that did not take things seriously were regretting it. We all know the horror that occurred that day and it was no small feat to get disrupted firms back up and running after the attacks. For those that were not as geographically impacted as others, it wasn’t as big a deal but that didn’t mean that smaller firms weren’t assessing the impact that event had on their businesses. Their clearing firms and custodians were likely affected significantly, and, by token, their clients were as well. I remember working for a large Wall Street firm back then and even months after the attacks I would get an email asking us to “re-paper” an account because the last set of paperwork was destroyed (this was long before the days of digital imaging being the norm). Clients always understood and were cooperative, fortunately.

The point we’re trying to make here is that everyone, regardless of the size of your firm, needs to have a plan in place in the event of a significant disruption of your business. One, it is a requirement and two, you’re not caught flat-footed should something happen that requires you to temporarily shutter your existing workspace and relocate it to an alternate location.

What we’re experiencing with COVID-19/Coronavirus right now is hopefully a once-in-a-lifetime event, but firms should be taking this opportunity to implement the BCP as it is written (i.e., this is not a drill or practice run). But it’s not enough to simply implement your plan. Take this opportunity to improve it.

  1. Document the results and feedback that you receive during this disruption.
  2. Identify the areas that you need to update based on this feedback.
  3. Document everything!

If you’ve been testing your BCP on an annual basis as required, there shouldn’t be too many changes to make. If, on the other hand, you’re dusting the plan off and looking at it for the first time in years, you’ve probably got some work to do.

Gone are the days when there needed to be a physical location where all employees would report and phones would be re-routed. This is the 21st century and most employees can work remotely at least on a limited basis, and you don’t have to contact your phone carrier to have all of the phones forwarded to one person’s home phone! I’m willing to bet that if the pages of your current BCP are yellowed and tattered, it probably states that “all employees will gather at the home of and phones will be routed to <insert name/number here>….” But is that REALLY what is happening? Probably not.

Bottom line:

  • Read your current Business Continuity Plan
  • Test it on a no-less-than-annual basis
  • Make revisions where necessary to ensure accuracy
  • Publish, at a minimum, a Business Continuity Plan Statement on your website*

Whether the disruption is on a global scale like the pandemic we’re experiencing right now or you’re just having really bad winter weather conditions where you work and your employees cannot safely get to work, don’t get caught flat-footed and the first thing that comes to mind is, “OH CRAP!” Be ready and have confidence in your Plan. The more confident you appear to your clients, the more at-ease they’ll be when the time comes!

Finally, we understand the rather uncommon challenges faced by many of you at this particular time. We’re here to help, so please get in touch if you want some assistance.

*The BCP Statement is a condensed statement that typically satisfies a regulatory requirement for public disclosure. Essentially it states that the firm has a Plan and is willing to share the full Plan upon request. It also gives phone numbers for the clearing firm(s) or custodian(s) where the clients can access their accounts and assets should they not be able to reach their broker/adviser. Most firms opt for the Statement because the offsite locations are the home addresses of the owners of the company which they’d rather not share in such a public forum.