One year ago, ‘Superstorm’ Sandy wreaked havoc on Wall Street, flooding subways, streets and buildings and forcing a historic two-day closure of the New York Stock Exchange.
Market participants and market operators can’t prevent the next storm, but they can reassess and bolster their own plans for how to manage through it. One positive externality of Sandy is that it moved the need for a viable business continuity and disaster recovery plan from largely notional to real.
For hedge funds and other investment managers, the biggest adaptation in the past year has been to a holistic rather than piecemeal approach, according to Michael Asher, chief information officer of New York-based Richard Fleischman & Associates, which provides business continuity, disaster recovery and other technology services.
“What they’ve realized is that the process is as important as the technology,” Asher told Markets Media. “It’s not just making a check mark because you have a server somewhere -- you need to have a process and know that it actually works.”
For the buy side, the stakes are high. An ineffective BC/DR plan can result in loss or corruption of electronic records, a lapse in management or oversight of the portfolio, and more broadly, diminished client confidence in the organization.
“Investment managers deal with large amounts of highly sensitive data,” said Robert Crossler, assistant professor of management and information systems at Mississippi State University. “Their success depends on their ability to protect this, and when an incident occurs to get back up and working very quickly.”
Business continuity and disaster recovery isn’t only for East Coast investment managers to deal with hurricanes; managers in the Midwest or on the West Coast can be shut down by a tornado or earthquake just as easily, and a non-natural disaster such as a terrorist attack can happen anywhere. Sandy served to expose the vulnerabilities of an interconnected financial system, and moved forward the evolution of BC/DR from just another item on the compliance checklist to a critical component of an asset manager’s operations and risk infrastructure, as vital as trading, portfolio management and reporting.
Regulatory Guidance
Following Sandy, the Financial Industry Regulatory Authority, the U.S. Securities and Exchange Commission and the Commodity Futures Trading Commission jointly reviewed firms’ business continuity and disaster recovery planning. In August, the regulatory groups issued a Business Continuity Planning advisory to encourage firms to review business continuity plans and to provide best practices to improve responses to, and reduce recovery time after, large-scale events.
In the four-page advisory, market participants were urged to assess their own contingency plans for widespread disruptions, looking specifically at alternative locations, vendor relationships, telecommunications and technology, communication protocols, regulation and compliance, and review and testing.
“Market reliability and resilience are vital to investors and to the fair and efficient operation of capital markets,” Andrew Bowden, director of the SEC’s Office of Compliance Inspections and Examinations, said at the time of the advisory.
Asher of RFA noted asset managers are more rigorous about BC/DR, for example working up seven- to 10-step plans and testing disaster recovery mode for as long as two full days. “Firms are taking this very seriously,” he said. “Attitudes and goals are different. Process is the key factor -- it’s now ‘how can I execute my day-to-day activities?’, where it was ‘I’m going to test this component in isolation’.”
Asset managers are going beyond their own BC/DR plans, to studying the plans of the companies they work with. “Managers are asking not just us as administrators, but also other service providers, for their BCP and DR plans, and more importantly, how often they are tested,” said Scott Price, regional director and head of sales at Chicago-based Custom House Fund Services, which provides administration services to hedge funds. “We’ve got documents and processes in place, but our clients are wishing to see the results as soon as they get tested.”
“BCP takes into consideration not just infrastructure, it also documents client deliverables as well as workflows,” Price continued. “We have to document twice a year any changes to the operational procedure, and forward that to our central IT function, which simulates it across our group.”
As Sandy recedes further into the rear-view mirror, market observers say the risk is that investment managers’ drive for stronger business continuity and disaster recovery plans will inevitably lose steam, at least until the next man-made or natural disaster.
“One of the issues with BC/DR is that it is difficult to calculate a return on investment,” Crossler said. “It is an activity that when life is good, is easy to put off and not worry about.”