Thoughts on Business Continuity Planning
Over the past week, I have attended a couple of interesting panel discussions on the hedge fund industry. At these events, one of the common themes was that the investment management industry is changing and hedge fund management companies need to make sure that operations are tight – this means that a management company should have developed and robust procedures for disasters including, as the article below indicates, pandemics. It is expected that this topic will become even more important if the impact of the H1N1 virus does not abate.
The article below was provided by Lisa Smith of Eze Castle Integration, an IT solutions firm for hedge fund management companies. This article is part of our guide to Hedge Fund Business & Technical Issues.
****
Business Continuity: A Look at Pandemic Response Planning
By: Lisa Smith, Certified Business Continuity Planner, Eze Castle Integration
As the last several months have unfolded, one thing has become clear: the influenza A (H1N1) virus is not going away. After the initial panic subsided, fear and concern seemed to diminish even though the World Health Organization and U.S. Centers for Disease Control insist that the threat is not over. Now, nearly five months since the first case of H1N1 was reported in Mexico, a pandemic has emerged as predicted.
As of November 1, 2009, 199+ countries have reported laboratory confirmed cases of pandemic influenza H1N1 2009, including over 482,000 cases and 6,000 deaths (World Health Organization). U.S. health officials estimate that the virus could directly and indirectly affect up to 40 percent of the nationwide workforce over the next two years (Centers for Disease Control).
What does this mean for hedge funds? It is more important than ever to ensure a firm can and will remain functional if you are affected by a pandemic. Particularly, hedge funds must be mindful of the repercussions of the virus, as a decrease in staff could cause potential downtime.
Below are six essential pandemic response steps that firms need to undertake to ensure their businesses remain at peak performance, even if an outbreak occurs in the office.
Begin response procedures BEFORE a disaster strikes.
Organizational resiliency starts by strengthening your organization during normal business operations prior to a disaster such as a pandemic. It should not take a disaster to compel your firm to evaluate its business continuity and response processes. One should be in place long before disasters strike.
Identify who will serve as crisis leaders and be in charge of handling situational changes that may occur, including communication to other employees about response procedures and alternative site locations. An ideal crisis leader is someone who demonstrates good leadership skills during normal business operations and has experience dealing with crises. Typical crisis leaders are members of the senior management team (i.e. COO, CFO or Portfolio Manager). Firms must also ensure all employees are mentally and physically able to respond to changes, especially if they are telecommuting.
Also, certify that all employees are cross-trained within the organization; if there is a staff shortage as a result of a pandemic, employees will need to fill additional roles and responsibilities. Non-critical employees, including business development, accounting and research analysts, may be able to take larger roles and assist during a pandemic response phase.
Develop disaster / pandemic procedures based on a variety of scenarios.
Be proactive. As part of the planning process, create a list of potential scenarios and define your firm’s response strategies. Impact scenarios should include both potential internal and external occurrences.
For instance, what is your response if access to your office building is restricted due to extensive H1N1 exposure? How will you access your email, market data and portfolio management systems? Where will employees work and how will they communicate with colleagues and counterparties?
Externally, how will you operate if your prime broker or fund administrator contacts are unavailable? Being prepared will ensure your business operations continue seamlessly and without interruption.
Thoroughly review and modify your business’ Employee Assistance Program (EAP).
An EAP provides assistance and access to counseling services for issues in and out of the workplace. In the event of a disaster, employees may wish to speak with a professional counselor to deal with any stress or negative emotions that have resulted from the event. If you cannot provide a physical counseling presence, provide a list of area clinics that offer comparable services. In advance, consider preparing educational materials that inform employees of the various stress indicators and reactions they may experience as a result of a disaster. If employees know that support is available prior to a disaster, it will mitigate panic and stress, and they will be better able to adapt to changes in their environment.
You should also inform employees about current sick leave and family support policies in the event that someone is forced to take an extended leave of absence.
In addition to developing and strengthening your EAP, you might also consider having upper management and emergency response team leaders partake in Critical Incident Stress Management (CISM) training, which will provide advanced preparation for responding to critical situations.
Test alternate site and remote access capabilities.
If a crisis situation is directly affecting your physical workspace or your employees, you must be prepared to provide alternatives. You may choose to move business operations to an alternate site where employees can go without risk. An alternate site would make sense for crisis situations that are confined to specific areas, such as natural disasters, outages or other situations.
In a pandemic situation – particularly if you have had any outbreaks of illness amongst your employees – you may choose to allow employees to work remotely. If this is a viable alternative, ensure ahead of time that you have adequate capacity and infrastructure to support multiple virtual private networks (VPN) and remote access capabilities. Confirm the number of Citrix licenses you have available; if there are not enough to support your complete staff, you may need to consolidate responsibilities.
Review your business response plan and procedures with team members and leaders.
Develop communication notification and escalation procedures for response team leaders and assign internal notification tasks to each leader. Identify if there are external business partners who need to be notified as well (i.e. investors, service providers, etc.). Assign a primary and secondary spokesperson in case the public needs to be notified, and ensure the spokesperson(s) has training and experience dealing with the media. If your spokesperson does not have training, now is the time to arrange for crisis communications training.
Test your pandemic response plan.
It is important to test your company’s response plan with leaders and response team members to ensure there are no glitches or obstacles in the event of a real disaster. Test internal communication strategies – from response team leaders to staff members. This can be done manually or through an automatic notification system. You can also send employees to work at the alternate site or to work remotely to ensure there are no technical issues that can affect productivity. It is imperative that the teams and employees are able to work together and build trusting relationships today. A strong foundation that includes good performance and trusting relationships will enable your business to recover from any kind of crisis.
Business Continuity Professionals say that “planning” helps mitigate panic and downtime. It takes work and resources to develop a resilient organization prior to an interruption or disaster, but it is imperative if businesses want to stay operational. Businesses cannot function without employees that maintain knowledge and expertise to operate the business, and those employees need to know what to do during an interruption or disaster. Without a plan, you will spend the entire time chasing the incident instead of recovering from it.
For more information, please see http://www.eci.com.
****
Other related hedge fund law articles include:
Bart Mallon, Esq. of Cole-Frieman & Mallon LLP runs the Hedge Fund Law Blog and the forex registration website. He can be reached directly at 415-868-5345.