Hurricane season is in full swing, and it's a good time for investment advisors to turn their attention to disaster planning. After Hurricane Katrina hit the Gulf Coast in 2005 and other natural disasters continue to strike across the country, securities regulators have focused on whether advisors are prepared for contingencies that may harm clients.
Accordingly, investment advisors should create and test disaster plans. A thorough and comprehensive disaster plan will help advisers resume operations quickly after a catastrophe with little or no inconvenience to clients. An advisor must also review the disaster plans of third-parties with which it has established relationships, such as custodians and broker/dealers.
The plan should address the specific risks that may affect the firm. It should cover the following elements:
- Who may declare an emergency
- Who is responsible for maintaining employee contact information
- Primary and secondary meeting places if the adviser's office is destroyed or rendered unusable
- Reporting the disaster to the authorities and insurance carriers
- Recovery of client information
- Backup communication systems
Fiduciary duty as it relates to disaster planning
Advisors owe a fiduciary duty to their clients to prepare for disasters and other contingencies. Without a disaster plan in place, clients may suffer if a key member of an advisory firm dies, records are destroyed or the business shuts down unexpectedly. Clients' financial well-being may be jeopardized through no fault of their own.
In several deficiency letters, the SEC suggested that advisers have a fiduciary duty to establish a process for responding to emergencies, contingencies and disasters. Failing to implement a disaster plan may be viewed as a breach of fiduciary duty.
In one deficiency letter, the SEC cited an advisor for having a disaster plan that was inadequate in detail and scope. According to the letter, the disaster plan should:
- Designate a specific location for employees to meet and conduct business operations in the event of a building disaster
- Articulate detailed procedures relating to employees, clients, physical facilities, communications, information systems, business operations, regulatory concerns and financial resources
- Address business continuity issues, especially if it's a small shop, such as what happens if the president or key employees are unable to perform their duties
State examiners are likely to have similar expectations.
Policies and procedures relating to disaster plans
Policies and procedures should help to minimize the impact of a disaster on the advisor, its employees, vendors and the advisory firm's clients. The disaster plan can be incorporated by reference in the advisor's policies and procedures.
Although Rule 206(4)-7 under the Investment Advisers Act of 1940 gives advisors flexibility in designing compliance policies and procedures that meet their needs, the SEC recommended that firms address certain areas, including disaster planning.
A good time for federally registered advisors to test their plans is in conjunction with annual audits of their policies and procedures pursuant to Rule 206(4)-7. It is also a good idea for state-registered investment advisors to review their policies and procedures on a regular basis.
Although it's not always possible, the best way to prepare for a disaster is to take steps to avoid it. Advisors should be proactive in identifying potential risks and taking steps to guard against them.