Business Continuity and Disaster Recovery

Continuity is a client-service obligation in practice

An advisory business can be interrupted by a hurricane, wildfire, flood, power loss, ransomware attack, telecommunications failure, illness, building closure, vendor outage, or sudden loss of a key employee. A business continuity plan (BCP) decides how the firm will protect clients and operate through the interruption. Disaster recovery is the related work of restoring technology, data, facilities, and normal operations. The terms overlap, but a plan should cover people and client decisions as well as machines.

For clients, continuity means more than keeping an office open. They may need a time-sensitive distribution, trade instruction, tax document, or answer about a portfolio during the disruption. The adviser may need access to current records, a secure way to communicate, and authority to make decisions consistent with the client agreement. If a firm has backups but cannot reach clients or identify who may approve a transaction, the technical recovery is incomplete.

Advisers should prepare for interruptions, maintain adequate records and safeguards, and protect client interests. The 2015 NASAA Model Rule on Business Continuity and Succession Planning gives a practical framework, but it is not automatically binding in every state. Check local law and the adviser’s registration status.

Start by deciding what must continue

A useful plan begins with an impact analysis. List the services clients rely on and the systems, people, offices, records, and vendors needed to provide them. Rank functions by urgency. For example, protecting a client from a fraudulent transfer or answering a margin call may be more time-sensitive than preparing a routine quarterly presentation. A ranking should reflect client harm, legal deadlines, contractual commitments, and the consequences of delay.

For each critical function, define a recovery-time objective: how long the firm can tolerate the service being unavailable. Define a recovery-point objective: how much data loss, measured in time, the firm can tolerate. These are planning measures, not universal regulatory numbers. A small firm might decide that client contact records must be restored within a day and that transaction records cannot be lost beyond the last completed backup. Those targets should be realistic, tested, and matched to the systems that support the service.

Consider a firm with 400 households and an online portfolio system. A vendor outage could prevent staff from seeing current holdings, while email and telephone remain available. The plan might allow staff to handle general status questions, pause discretionary trading that depends on stale data, and use a secure offline client list for urgent calls. It should identify who verifies the vendor’s recovery status and who decides when normal trading resumes. The plan should not encourage employees to guess at holdings or send sensitive files through personal email.

Prioritization also exposes dependencies. A portfolio system may rely on a cloud identity provider, which in turn depends on an employee’s phone for multifactor authentication. A backup may be stored in the same account that a ransomware attacker can access. An alternate office may depend on the same utility or network as the primary location. Map these dependencies before selecting a recovery strategy. A second copy is not resilient if the same failure can disable both copies.

Protect books, records, and the ability to retrieve them

Advisers need records to understand the relationship, supervise activity, respond to clients, and meet applicable retention rules. A continuity plan should identify the records needed during an emergency: advisory agreements, client instructions, contact details, account authorizations, portfolio data, transaction history, billing information, compliance calendars, vendor contacts, insurance documents, and regulator contacts. Different records have different urgency and confidentiality, so access should be controlled rather than placing every file in one unrestricted folder.

Backups should be frequent enough for the business need, protected from unauthorized alteration, and stored so the same event cannot destroy the original and backup together. Encryption, separate credentials, restricted write access, and an offline or otherwise isolated copy can reduce ransomware exposure. The firm should know which systems are included, how long backups are kept, who can restore them, and how integrity is checked. A backup job that reports success without a recovery test is not proof that the firm can resume work.

A recovery test should restore a selected set of files or a system to a clean environment, verify that the records are readable and complete, and confirm that authorized staff can reach them. A firm can test one high-priority service at a time. Record what was tested, the result, the time required, the errors found, and the corrective owner. If restoration takes two days when the objective was four hours, revise the technology, the target, or both. Do not hide the gap by changing a spreadsheet without changing the response capability.

Records can be technically present yet operationally unusable. A password list may be encrypted but the decryption key is stored on the unavailable office computer. A database backup may not include the application needed to read it. Client files may be in a vendor’s proprietary format with no export. Include credentials, software licenses, vendor support contacts, and instructions in a controlled recovery package. Use a secure method so that the package itself does not become an easy target.

Plan communications and alternate work

A plan should specify how the firm will communicate with clients, employees, vendors, regulators, and emergency services if its usual email, phone, or office is unavailable. List backup channels and maintain current contact information in a secure location accessible to authorized decision-makers. Tell clients how they can verify that an urgent message is genuine. During a disruption, criminals may imitate the adviser or exploit confusion to request a wire or password reset.

The message should be factual, brief, and useful. State which services are affected, what clients can still do, how to contact the firm, and when the next update is expected. Do not promise a restoration time that the firm cannot support. If a cyber incident may involve customer information, the privacy incident-response process and applicable notice laws must also be considered. A general outage notice is not automatically a required breach notice, and a breach notice should not be delayed behind routine business updates.

Alternate work arrangements need practical details. Employees should know where they can work, which devices they may use, how to connect securely, and how to handle confidential paper. A second office is useful only if it has power, network access, equipment, and enough space for essential staff. Remote work can help after a building closure, but personal devices and unapproved applications may create security and recordkeeping problems. Test the arrangement with the people expected to use it.

Suppose a flood closes the adviser’s office on a Monday morning. The plan directs staff to a remote location, sends clients a verified status message, and routes incoming calls to a backup number. The compliance officer retrieves the current client contact list and open-issue log from a separate secure system. A designated portfolio manager evaluates which discretionary activities can safely continue using verified data. A staff member tracks requests and promised callbacks. The sequence is concrete because each person and tool has been identified before the flood.

Assign responsibility before a crisis

Name a plan owner, incident lead, technology contact, client-communications lead, and backup for each role. Identify who may suspend operations, approve emergency expenses, communicate with regulators, and authorize restoration. In a small practice, one person may hold multiple roles, but the plan should identify a substitute if that person is unavailable. An emergency does not create time to discover that only one employee knows the administrator password or the vendor’s escalation number.

The model rule calls for assigning duties to qualified responsible persons. ‘Qualified’ should mean able to perform the assigned task, understand its limits, and obtain needed authority. A receptionist can route calls, but may not be qualified to authorize trading. A technology provider can restore a server, but may not decide whether client services should resume. Write down the division of technical and advisory responsibility.

Include temporary staffing and succession contingencies. If the sole principal becomes incapacitated, the firm needs to know who can contact clients, maintain records, supervise employees, and seek legal advice about registration and ownership changes. A continuity arrangement must fit the firm’s contracts and governing law; a business associate cannot simply assume advisory authority because the principal is unavailable. These questions connect continuity to succession planning, but a short-term outage plan still needs its own operating steps.

Manage vendor and counterparty outages

Critical vendors should be named in the plan, with contact and escalation information available outside the vendor system itself. Ask each vendor about its recovery arrangements, incident notice, data export, backup locations, subcontractors, and service status process. Contracts can require timely cooperation and access to records, but contract language is only one control. A vendor may be unavailable when the firm most needs it, so identify manual or alternate workflows and their limits.

A firm that relies on one portfolio platform should know how long it can operate without current valuations and trade data. It may decide to pause selected activity until it verifies the information through a second source. A firm that uses a single payroll vendor should keep a lawful, secure way to meet payroll if service is interrupted. In each case, identify the decision that triggers a fallback and who may approve it. Do not improvise from stale exports without assessing accuracy and authorization.

Review vendor dependencies after a merger, software migration, or major change in the firm’s services. New tools can introduce new data flows and recovery assumptions. If a vendor’s contract ends, verify that the adviser can retrieve records before access is terminated. If the vendor reports a breach, preserve notices and determine the adviser’s independent duties rather than assuming the provider will contact every affected client.

Test the plan and fix what fails

A plan should be tested on a schedule and after material changes. Tabletop exercises are efficient: tell participants that the office is unavailable, the main cloud account is locked, or the principal cannot be reached, then ask them to work through the decisions. A technical test might restore a backup or route calls to the alternate number. Different tests reveal different problems; a tabletop discussion cannot establish that a backup file can be restored, while a restoration test cannot establish that employees know what clients should be told.

After the exercise, record missed contacts, unclear authority, inaccessible records, unrealistic recovery targets, and communication failures. Assign each corrective action to a person with a due date. Re-test significant fixes. Keep the plan current when personnel, office locations, vendors, systems, client-service priorities, or regulatory status changes. A BCP copied from another adviser may look complete while naming the wrong vendor, assuming the wrong staff capacity, or omitting the firm’s actual most important service.

A useful tabletop scenario: at 8:30 a.m. on a trading day, the primary email service and portfolio platform are unavailable, a vendor reports suspicious logins, and the lead portfolio manager is unreachable. Ask who declares an incident, how staff verify client requests, which records remain available, whether any trading pauses, how urgent clients are contacted, and who decides when systems are safe. The scenario tests the links among business continuity, cybersecurity, supervision, and client protection.

Understand the regulatory boundary

For a specific legal mandate, check whether the adviser’s state adopted the NASAA model and what the enacted text requires. The model’s guidance itself cautions that state rules may differ. SEC-registered advisers also have a federal compliance framework, but Rule 206(4)-7 should not be misstated as prescribing one identical continuity checklist for every firm.

SEC-registered advisers have compliance obligations under the Investment Advisers Act and Rule 206(4)-7 to adopt and implement written policies and procedures reasonably designed to prevent violations, review them at least annually, and designate a chief compliance officer. Those requirements provide a compliance framework, but they should not be misstated as a federal rule prescribing one identical BCP checklist for every adviser. An adviser may also have contract, fiduciary, recordkeeping, privacy, or other obligations that affect how it should prepare.

State-registered advisers should review their state administrator’s rules and instructions, including any adopted NASAA model provisions or similar state-specific language. A multi-state firm must account for the jurisdictions in which it operates. If an exam question gives a particular rule or state, use that controlling text. If it asks for sound planning generally, the model’s listed components are a useful framework, but do not invent a universal statutory deadline or prescribed recovery time.

A practical plan review

A focused review can be conducted in sequence. Confirm the firm’s critical services and client-harm priorities. Identify the systems, records, people, facilities, and vendors that support them. Set recovery targets and prove the backup can meet them. Assign primary and alternate decision-makers. Verify client and regulator communication routes. Define how staff will protect sensitive information during remote work. Finally, run a scenario, record failures, and make corrections.

Keep the plan usable in an emergency. A two-page quick-action guide can list the first call, the incident lead, the alternate system, and the location of detailed instructions. The full plan can contain technical steps and contact lists. Both must be secure, current, and accessible when ordinary systems are down. Give employees only the access they need, and protect sensitive credentials through a separate controlled process.

Continuity planning accepts that disruption will happen and prepares choices in advance. A plan will not prevent every outage, and a backup does not guarantee immediate recovery. Its value is that the adviser can make client-centered decisions under pressure: preserve records, communicate honestly, limit unsafe activity, bring essential services back in a tested order, and learn from the event.