In 2016, the Securities and Exchange Commission proposed a rule that would require investment advisors to put business continuity and transition plans in place. But the rule was never finalized.
So there’s no clear guidance on what a business continuity plan for an investment advisory firm needs to include, or the contingencies it needs to cover, or the level it needs to go to when detailing how the plan is put into motion.
Nonetheless, the vast majority of RIAs do have some kind of plan, even if not comprehensively documented, largely because regulators expect it as a part of the firm’s fiduciary duty, compliance consultants say.
Now that the country is faced with what officials say is a global pandemic, advisors may find an opportunity to stress test those plans and see how they hold up in real-life situations.
Sander Ressler, managing director of Essential Edge Compliance Outsourcing Services, who performs a lot of internal audits for advisory firms, says most business continuity plans are sparsely written, often pulled off the internet and are rarely customized to the specific firm’s needs. Many of them, he says, would not be truly practical in a pandemic.
“I think it has been almost exclusively a perfunctory act to put those plans together without any expectation that there would actually be a need for it,” he said. “The chickens are coming home to roost.”
In fact, the majority of the plans developed in the past 20 years are almost exclusively weather-related, Ressler said.
“I don't think anybody has ever written a plan that is about a medical pandemic, which is a totally different thing,” he said.
Ressler said, if anything, the recent crisis may prompt advisors to see the need to segment continuity plans for different types of catastrophic events.
Karen Barr, president and CEO of the Investment Adviser Association, said advisors in her organization have tested their continuity plans in real time—but not with this particular kind of emergency.
“One of the challenges here is … the lack of clear guidance, and the time horizon is very uncertain,” she said. With a flood, severe storm or hurricane—the typical disruption that governs most continuity plans—there is the event, and then the recovery. “This is an ongoing, evolving situation, which creates more uncertainty than those other kinds of business disruptions.”
GJ King, president of RIA in a Box, a compliance firm, said that coronavirus is causing a convergence of many risks at once, which can be difficult for businesses—particularly RIAs—to withstand.
“You have financial market volatility; you have legitimate safety concerns for employees,” he said. “Third, you have a bunch of change, a bunch of people perhaps working from home for the first time, so you’re very, very vulnerable from a cybersecurity standpoint. It’s kind of the perfect storm for bad things to happen if firms really aren’t prepared and being thoughtful about this.”
What Should Advisors Be Doing?
Right now, King says RIAs should be, as much as possible, imagining the variety of scenarios that could play out in the weeks and months ahead. Most firms have not tested their continuity plans for a multi-month scenario.
The most significant near-term threat for advisors, he says, is a loss of access to physical office facilities, and they should be prepared for their employees to work from home.
“For many RIA firms though, they’re not as used to a work-from-home or remote work situation,” King said.
Many businesses will point to communications tools like video chat or Slack channels as preparation for a work-from-home requirement.
But teleworking for an RIA goes beyond just communications, and needs to include an ability to make transactions, access client accounts, wire funds or even just produce performance reports from a remote location. Even considering how incoming calls can be re-routed to a remote office location needs to be considered.
Fortunately, a lot of the technology that advisors use to conduct their business is increasingly cloud-based, Brian Hamburger, founder and CEO of MarketCounsel said, which should make teleworking easier. But not all advisors have moved their workflows or day-to-day business processes to those platforms, especially larger firms with multiple employee steps in their procedures.
Firms in the Midwest and Northeast are a little better prepared for business continuity issues because they’ve experienced them in bad weather conditions. The most vulnerable firms tend to be in the Southern part of the country, where they’re typically not used to the storms that can shut down travel to the office.
MarketCounsel says RIAs can do a better job training their employees on what to do in case facilities or personnel become unavailable. Employees should know how to access critical systems remotely and how to conduct themselves in a state of emergency. Firms should also review and update their communication plan to address how employees will be notified of events that may prompt continuity procedures and how to keep communication going through the disruption.
Vincent Rossi, president and chief investment officer of Intelligent Capitalworks, an RIA in Scottsdale, Ariz., said he spends a “not insignificant” amount of money to run a fully redundant system, including a second office site. And although the second site may not help with this situation if he and his staff are not able to access it, all of his firm’s telecommunications systems can be accessed from anywhere, and his employees’ laptops are run through properly configured firewalls to make working from home feasible.
“People don’t perhaps realize just how expensive this is and how much work it is; it’s like buying insurance and you keep paying the premiums,” he said. “On the outside chance you need them, you’ll be glad you paid them.”
A Loss of Key Personnel
But RIA in a Box’s King says RIAs should prepare for other scenarios, beyond loss of facilities.
“If people are just working from home, that’s just one challenge,” King said. “If people are working from home but now all of a sudden schools are closed, a good chunk of your workforce is really unable to work because they’re now caring for children. What happens then?”
Firms should also prepare for the potential loss of key personnel in the event that someone in the firm comes down with COVID-19, Hamburger said, or has to care for someone who has, or, at the most extreme case, passes away. The issue with many small- to midsize advisory firms is often an individual’s job duties have grown with the firm, and colleagues don’t always know exactly how each employee gets their individual tasks accomplished.
If only one person knows how to enter payroll, for instance, employees won’t get paid.
“The most critical thing there is ensuring that all of the policies and procedures are documented, so that in the event that there is someone who becomes unavailable, either in the short term or intermediate term or even in the longer term, that their responsibilities can be covered by someone else on the team,” he said.
This is where cross-training on critical functions becomes important, said Conor Anderson, partner and head of advisor services for AdvisorAssist. There are critical functions that an RIA needs to keep up and running, such as client account management, trading and client communication.
“If the firm has a sole person responsible for client engagements and that person is under the weather for a certain period of time, someone else has to step in those shoes, be able to address client asks or needs, and meet with the clients that need it,” Anderson said.
Business continuity plans are also supposed to address succession issues, and most plans that he has seen don’t go into that level of detail, Anderson said. While it may be difficult to think about and an unlikely scenario even as the virus spreads, principals at RIA firms should consider the implications of incapacity or death.
“The one- or two-person firm, if one becomes incapacitated permanently or happens to pass away, what's the succession plan?” Anderson said.
To be sure, that’s an unlikely outcome to the current situation.
But one good thing that could come out of the coronavirus pandemic is that it affords advisors an opportunity to consider as many situations that could possibly befall a firm as possible, including those that, in some form or another, eventually will.