Business Continuity Planning
Updates are ready for review; srvo approval is still pending. Log the approval in the compliance log before treating this section as authoritative.
1 Business Continuity Planning
Significant business disruptions may result from large-scale events that the firm must be prepared to address. A Business Continuity Plan (BCP) has been developed to help minimize impact from these disruptions. The CCO is responsible for the maintenance of the BCP.
1.1 Plan Components
The BCP is designed to address important areas of the firm’s operational activities, to include:
Data back-up and recovery (hard copy and/or electronic).
Key Systems List.
Key Contact List.
Firm Location.
Alternate communication channels.
Regulatory reporting.
Periodic review and testing.
Current review and approval of the BCP.
Training and notification of APs.
The BCP will be made available to all APs so they are familiar with procedures in the unlikely event of a significant business disruption. The CCO will ensure APs are informed upon hiring and annually thereafter through training review. Material changes to the BCP will require more frequent distribution and review.
1.2 Key Systems
All key systems will be included on a list identifying them as a key system. The CCO will maintain a current “Key Systems List” as part of the BCP. The firm utilizes certain critical information systems and hardware that the CCO has identified and include:
Internal databases containing client records.
Internal databases housing firm records.
Firm programs and software.
From the Key Systems List, the firm has developed a process to ensure that in the event of a disaster it will be able to transition to necessary backup systems as others are rendered non-functional. The CCO will ensure that the list includes:
System or area name.
Description of the system/area.
Name of person(s) or entity responsible supporting the system, including alternates.
Back up location (address, phone numbers, directions, etc.) where key systems may be established or duplicated.
1.3 Key Contacts
Key employees will be provided access to the BCP and will be informed as the plan changes. The individuals identified on the “Key Contacts List” will maintain copies of the BCP in locations outside the firm’s main office location. The CCO will be responsible for the maintenance of the “Key Contacts List,” on a regular basis and may include:
Key internal personnel.
Key external service provider contacts.
Key regulatory contacts.
Information to be collected for the key contacts (and alternates) should include:
Full name.
Primary and alternate address.
Primary and alternate phone and fax number(s).
Email addresses.
For each internal key contact, the CCO may denote descriptions of the job functions each person. The firm may designate alternate individuals to fulfill these roles in the event of unavailability of internal key contacts. All individuals should be educated as to roles and may be asked to rehearse as part of the firm’s efforts to train and educate its personnel on the proper BCP procedures.
1.4 Data Back Up/Recovery and Off-Site Storage Facility
The CCO may identify locations geographically separated from the main office as a back-up site. The location should be a reasonable distance away to utilize a completely separate power and telephone grid. This site may be utilized to establish remote operations for key systems that have been identified as mission critical.
The site should be designed with the necessary computer and communication systems to enable the firm to operate and support basic needs of its clients. Any backup facility utilized for the purposes of the firm’s BCP should be accessible only to key employees and secured when unattended.
Under the CCO’s approval, the firm may allow staff to operate from their homes or other designated locations should a catastrophic event occur. The CCO will ensure that contingency locations are designated and recorded as part of the BCP.
The firm will periodically back up critical firm data in accordance with the applicable regulatory requirements regarding electronic storage and record retention. In the event of a communications or operations failure, the firm will implement some or all of its BCP recovery measures. The implementation of disaster recovery measures will largely depend on the extent of the communications or operations failure.
1.5 Client Notification
The firm will inform clients at the beginning of the relationship via Part 2A of Form ADV of its BCP policy and contact information. A separate form letter describing our BCP is available to clients upon request.
### Firm Assessments
Financial and Operational Assessments - The firm will identify changes in its operational and financial risk exposures as necessary. Financial Risk relates to the ability to continue to produce revenue. As part of the firm’s assessment of potential financial risks it may face due to a catastrophic event or other significant disruption to its operations, it will also need to take into consideration costs establishing backup facilities, expenses implementing the BCP, availability of funding in the event of BCP implementation, outstanding debt as a result of lost revenues, other expenses arising out of the occurrence of a significant disruption to its operations and loss of revenues, etc.
Operational Risk focuses on the firm’s ability to maintain communications with clients and to retrieve key activity records through its key systems. As part of the firm’s assessment of potential operational risks it may face due to significant disruption to its operations, it should consider:
Time delays due to accessing and start-up of backup systems.
Capabilities of alternate communication systems.
Communication with staff and service providers.
Personnel availability.
Key Business Relationships - An assessment of its BCP relative to key service providers whose operations are critical to firm support may include:
Custodial or clearing firms.
Financial institutions the firm holds accounts.
Providers of critical systems (ie., networks, etc.).
- Other service providers deemed critical to the firm.
1.6 Contingency Succession Planning
Should there become a situation where the CCO is deceased or becomes incapacitated and can no longer supervise the firm, the firm will initiate its contingency succession plan. Any replacement CCO must be qualified per current jurisdictional guidance.
Staff/APs – Associates must be promptly notified via firm communications systems that an interim/new CCO has been assigned, as well as how requests and documents will be processed.
Custodian(s) – Custodians who maintain written agreements with the firm in support of its investment advisory activities must be contacted to ensure the custodian is aware of the change of supervision and oversight authority.
Client(s) – Clients will be made aware of the matter via Form ADV Part 2A or material change page.
Regulatory Body(ies) – Each regulatory authority having oversight of the firm will be promptly notified as noted in the firm’s list of contacts.
1.7 BCP Training and Education
The CCO will ensure BCP familiarity and training of APs where applicable. Each internal key contact, descriptions of job functions for each key person should be noted in the event of a catastrophe. The firm’s BCP should be made available to staff to ensure all are familiar with the procedures in the event of a significant business disruption.
1.8 Periodic Review
No less than annually the CCO will review the BCP, which will address the adequacy of the BCP, areas that require improvement, and sufficient training of staff. Results will be documented by the CCO, and a record retained per current recordkeeping requirements.