Title VI – business continuity management

Investment firms should establish a sound business continuity management and recovery plan to ensure their ability to operate on an ongoing basis and to limit losses in the event of severe business disruption.

Investment firms may establish a specific independent business continuity function.

An investment firm ’s business relies on several critical resources (e.g. IT systems , including cloud services, communication systems, core staff and buildings). The purpose of business continuity management is to reduce the operational, financial, legal, reputational and other material consequences arising from a disaster or extended interruption to these resources and consequent disruption to the investment firm ’s ordinary business proced ures. Other risk management measures might be intended to reduce the probability of such incidents or to transfer their financial impact to third parties (e.g. through insurance).

In order to establish a sound business continuity management plan, an investment firm should carefully analyse risk factors for, and its exposure to, severe business disruptions and assess (quantitatively and qualitatively) their potential impact, using internal and/or external data and scenario analysis. This analysis should cover all business lines and internal units, including the RMF or risk management procedures, and should take into account their interdependency. The results of the analysis should contribute to defining the investment firm ’s recovery priorities and objectives.

On the basis of the abovementioned analysis, an investment firm should put in place:

• a. contingency and business continuity plans to ensure that the investment firm reacts appropriately to emergencies and is able to maintain its most important business activities if there is disruption to its ordinary business procedures; and
• b. recovery plans for critical resources to enable the investment firm to return to ordinary business procedures in an appropriate timeframe. Any residual risk from potential business disruptions should be consistent with the investment firm ’s risk appetite.

Contingency, business continuity and recovery plans should be documented and carefully implemented. The documentation should be available within the business lines, internal units and RMF for staff in charge of risk management procedures, and should be stored on systems that are physically separated and readily accessible in case of contingency. Appropriate training should be provided. Plans should be regularly tested and updated. Any challenges or failures occurring in the tests should be documented and analysed, with the plans reviewed accordingly.