Business continuity has come in to focus with the Covid-19 pandemic. Having a good business continuity plan is a critical item for a firm but doesn’t typically come to light until a triggering event. At my previous firm we had an overnight fire in our building that kept us out of our office for 2 ½ weeks. Having a formal, documented, and tested business continuity plan with solid technology behind it allowed for us to be operating the same morning of the event with limited employee and client impact. This blog post outlines some of the key lessons learned from that experience and key takeaways for firms.
The starting point for a good business continuity effort is having a formal, documented plan. This is a a must for a firm of any size. The business continuity plan is an SEC audit requirement as well as critical to being prepared for a catastrophic event.
In addition to having a formal, documented business continuity plan, it is very important to test the plan on a regular basis. This puts the plan in to action before an event occurs and allows you to iron out any kinks in a non-crisis situation.
Finally, having a technology and operations strategy that supports business continuity efforts is important to being successful. The technology elements of business continuity should be woven in to the core technology strategy, not just considered when a disaster occurs.
Formally documenting all components of your business continuity plan allows you to think through all components of your plan in a calm, thoughtful way. When an event occurs, you want to be able execute the plan and think through the items unique to that event, not the basics of recovery. Your best thinking doesn’t typically occur in the stress of an event triggering business continuity.
Formally documenting the business continuity plan also helps you put all of your contact information in one location. In addition to internal contacts you want to make sure that you include key vendors. Key external contacts typically include your technology managed service provider, other key technology vendors, custodian(s), building manager, and any other key vendor contacts to run your business day to day. All are dependent on key outside vendors to run day-today. Having all of the key vendors with contact information in one place helps cut down on time lost trying to find this information in a business continuity situation. I always carry a hard copy of the business continuity plan along with an employee contact list to make sure to have all important contacts in all circumstances, even if you can’t access any of your systems.
Documenting your business continuity plans helps you think through your critical roles and redundancy for those roles. I recommend documenting all critical tasks to keep the firm running in tiers. Those tasks that need to be recovered immediately, within 1 day, within 1 week, and then longer term. For example, phones and money movement typically needs to be recovered immediately while tasks like billing can be recovered over time. For each of those roles identify who does those tasks day-to-day and how you would do those tasks in a business continuity situation. If you have multiple offices, this is a great opportunity to build operational redundancy for key tasks in multiple locations. If you don’t have multiple offices, you can identify multiple people for a task or vendors as a backup.
The primary reason to test the business continuity plan is to determine areas of the plan that don’t work or components that are missed. No matter how much effort you put in to documenting the plan, actually executing the plan identifies areas that don’t work or were missed. I recommend testing the plan by taking a day and time and actually operate in a business continuity situation. I typically have done this on a Friday afternoon and do it at least once a year.
An additional benefit of testing the business continuity role is to communicate and verify the roles in a business continuity exercise. The business continuity emergency response team as well as the key operational team members understand their roles and tasks, including those that they don’t do on a regular basis by testing on a regular basis. All team members will understand their roles when a business continuity event occurs.
Related to roles, testing a business continuity plan highlights any access that is not in place for team members. For instance, having a team member who is the back-up for doing money movement may not have access to that level of authority in the system but would need it in a business continuity event. Testing the business continuity plan can also identify training opportunities. I have done tests where a person was identified to do trading in the event of the main office not being available, but that person did not know how to do trades.
The most critical component for the technology infrastructure for business continuity is to make sure the technology is available remotely or in other offices. This is documented in a disaster recovery plan, which goes hand-in-hand with your business continuity plan. System redundancy is typically done through cloud computing these days or off-site backups.
In addition to system redundancy, I recommend making sure employees have the tools to work outside the office. As part of a firm strategy of working anywhere, I made sure all employees had laptops. This proved to be a very helpful for productivity when we had the fire in the building and didn’t have to troubleshoot employees computers.
Another important area of business continuity technology is multiple communication channels. During a business continuity event frequent and timely communication is critical to success. I like to have email, instant messaging (e.g. Slack), as well as everyone’s cell phone and a way to communicate via a text messaging app (there are several on the market) to make sure you have backup in case one of your channels fail.
Business Continuity planning is an unsung task that you hopefully will never have to use in real life. If you ever have an incident you will be happy that you have put the time and effort in to make it a success. When we had the fire in the building, the fact that we had spent the time to document and test our plan made the time a success and positively impacted the firms bottom line.
I have a business continuity template to get you started in the process. Please contact me via email (cemert@cjectechpartners.com) and I’ll email the template to help get you started. I’m also available to create and test business continuity plans for your firm as well as advising on how to make sure your business continuity is a success.