|
By Steve Dance, Head of Consulting (South), Glen Abbot.
Business continuity managers in the UK financial services industry could be in for a busy year – in its recently published ‘2007 Financial Risk Outlook’, the FSA highlighted several issues that either directly or indirectly affect the business continuity arrangements of regulated firms.
The significance of this is twofold:
• The Priority Risk Report broadly shapes the agenda of regulatory visits. Your management may be asked some pointed questions about your current state of ‘preparedness and capability’ – so be prepared with up to date information on the current status of your business continuity plan;
• The Priority Risk Report is a good indicator of risk ‘hot-spots’ in the sector, painting a broad consensus of the most significant risks that currently face the sector. Produced in consultation with regulated firms, the Priority Risk Report represents a barometer of the key risk issues from both the regulator and regulated firms.
In general terms the FSA had this to say about the business continuity arrangements of regulated firms:
“Firms should regularly test and review their business-continuity plans to ensure that they have systems and processes in place able to cope with major operational disruptions from high-risk events, such as terrorist attacks, natural disasters and global pandemics. In their planning and testing programmes, firms should pay close attention to external dependencies which might render them vulnerable during a major event. Those dependencies include major financial counterparties, key suppliers of goods and services, and infrastructure providers such as power, water and telecoms. An influenza pandemic would present a particular challenge to business-continuity planning, both because of its extended duration and because it would impact personnel more than physical assets. Our Alternative scenario outlines the
implications for firms, consumers and us from a global influenza pandemic”.
A clear signal, then, that business continuity is firmly on the regulatory agenda. However, in addition to these comments the regulator highlighted several sectoral and cross-sectoral issues related to business continuity:
Cross-sectoral risks
Pandemic ‘flu
For most of us, living in countries that have excellent public health facilities and where the majority of fatal infectious diseases have been eradicated, the concept of a killer pandemic is difficult to grasp. The range of possibilities is huge and the base of experience is low.
There is, however, emerging consensus on best practices for business continuity planning for pandemics: major corporations around the world, many of whom were affected by the SARS virus, have used their experience to draw up mitigation and contingency arrangements in preparation for a pandemic. Business continuity managers need to tap into these sources of information and adapt them for their own firms.
Terrorism
The world’s major financial centres are high-profile targets for terrorist attacks, as we know only too well in London. Clearly, attacks of the type that occurred during July 2005 represent a significant operational risk for both individual firms and the financial markets as a whole. The terrorist incident ‘near miss’ last summer served to emphasise that terrorist attacks are still a real threat.
The terrorist attacks in London demonstrated the risks from terrorist groups and the relatively low costs associated with launching an attack. The City came through these attacks relatively well. Nevertheless, many firms reported that their previous rehearsals, whilst helpful, were not completely indicative of their ability to recover from these type of events. Assumptions that had been made regarding crisis communications proved incorrect and were compounded by the need to deal with traumatised and anxious staff.
Sectoral issues
Retail financial services (banks, building societies & insurance companies)
Outsourcing, particularly offshore outsourcing, is both a growing trend and an emerging risk. In a highly competitive, price sensitive domestic market many financial institutions feel the need to pursue a cost-cutting strategy in the face of pressures on domestic margins. Transferring selected functions to offshore centres offers attractive cost reductions but a number of factors inevitably increase both operational and reputation risks:
• Less-developed national utilities infrastructure in offshore centres often result in lower services availability coupled with protracted restoration times;
• Employment market competition threatens staff continuity
• The increased political risk and social instability;
• Governance issues are challenged by physical distance and time differences;
Readers of our quarterly newsletter, ‘Thin Ice’, will be familiar with some of the issues raised above, in particular the disproportionate occurrences of business disruptions caused by civil disturbances and strikes as well as the extended outages that occur due to public utility failures. Additionally, as firms battle for qualified staff to meet demand for their services, there is an emerging trend of high staff turnover in offshore locations. This is pushing local salaries higher and forcing firms to hire less well qualified candidates. Carefully planned outsourcing (whether on-shore or offshore) can provide valuable and tangible benefits. Nevertheless, any initiative to move business processes offshore should be well thought through with thorough research into the issues of governance frameworks, risk management systems and business continuity. Business continuity managers should ensure that they are aware of and fully involved in any offshore outsourcing initiatives and be in a position to have assured both themselves and their firms that their outsourcing partner has appropriate recovery and operational resilience plans in place.
Investment banks & securities firms
1) Market in Financial Instruments Directive (MiFID)
The Markets in Financial Instruments Directive will impact nearly all financial institutions and markets to an extent never seen in Europe before. Organisational structure, the order cycle and trading activities will all be affected as firms adapt their business processes to meet the Directive’s requirements and implementation deadline of November 2007. At first sight, a business continuity manager might ask “what has this got to do with me?” The implications of MiFID for business continuity managers although not immediately obvious are nevertheless profound: MiFID is not just an additional piece of regulation - it forms the platform for the EC’s objective of a single European market for securities and investments. In this context it provides opportunities for securities and investment firms to formulate business strategies to capture the opportunities provided by a single market. In formulating these strategies, firms will adapt many of their core business processes related to Client Acquisition, Order Handling, Execution and Post Trade Reporting. Changes to organisational structure to support new business processes will doubtless also occur. Firms who intend to be ‘Systematic Internalisers’ face additional challenges to design IT systems and infrastructures to meet challenging availability and information retention mandates.
The corollary of this, then, is that business continuity plans relating to these processes will require in-depth review and, in all likelihood, a complete re-write. The big challenge is that no one yet knows how these processes will operate, only that existing processes will be radically different. New business continuity plans will need to be defined but will need to be developed in a series of iterations as the new operational processes crystalise.
2) Credit & equity derivatives
The huge growth in the volumes of credit & equity derivatives has created backlogs in outstanding trade confirmations and therefore poses a significant operational risk to the capital markets and the firms who operate within them. These are relatively new product markets and, whilst trading activities may be performed using state of the art technology, many firms have sub-optimal back-office processes to support the business volumes generated by their the front offices. Although the back office backlog for credit derivatives has shown some improvement since last year, the situation with equity derivatives has deteriorated.
A firm with a significant operation relating to either credit or equity derivatives could find itself significantly exposed in a disaster situation – it is difficult enough to plan for and manage the recovery of a mature and optimised business process. A business process that is sub-optimal (particularly where the firm’s position in the market is not completely clear) will be fraught with problems. From a business continuity perspective the credit derivatives operation is a potential ‘hotspot’.
3) Asset management
As mentioned above, MiFID proposes significant changes and Europe-wide standards. Fund managers too will be significantly impacted by the directive which implies changes to client classification, conduct of business, financial product promotions, outsourcing of portfolio management services and best execution. This will have a direct and significant impact on firms’ management of investment processes, execution and reporting of their trading activities. Again, for business continuity managers in these firms the impact will be ensuring a re-write of the affected business processes with the additional challenge that the processes may not be fully defined.
4) Hedge funds
The hedge fund industry has grown rapidly over the past few years. Often staffed with employees who have a trading background, there is mounting concern over the levels of operational risks that may be developing as a result of this rapid growth and the capability of some hedge funds' operations functions to maintain support. We see two factors that will prompt hedge funds to focus on business continuity planning;
• As hedge fund managers and their prime brokers are now regulated by the FSA, given the concerns over operational capabilities, business continuity planning will be an integral part of the regulatory requirements for an operational control framework;
• Institutional investors with large hedge fund exposures may feel the need to gain assurances of the operational resilience of the hedge fund managers. In this context the hedge fund may be at a commercial disadvantage if investors take the view that their assets are not protected in accordance with their expectations.
Conclusion
2007 will be a busy year for business continuity managers in the financial sector. All areas will need to ensure that business continuity plans can stand up to regulatory scrutiny. All firms will need to demonstrate specific progress on issues such as terrorist attacks and pandemic ‘flu. In addition to this there are sector specific hot-spots, such as offshore outsourcing, MiFID and new products/markets that will be overlaid on an already crowded agenda. Now is a good time to consider what initiatives need to be instigated to mitigate these risks and issues.
During March 007 Glen Abbot will be conducting a series of briefings relating to the above issues and their implications for business continuity managers and senior management. To pre-register your interest in attending one of these briefings, please follow the link below and complete the registration form, using the ‘General Enquiry’ option. http://www.glenabbot.co.uk/contact_us.htm
Thin Ice
Thin Ice is Glen Abbot’s e-newsletter. It scans business interruption events around the world and provides statistics of the different types of business interruption and their effects. Thin Ice is a valuable resource for business continuity managers who require statistics relating to business interruptions. To be added to the subscription list for your free copy simply send an email to thinice@glenabbot.co.uk
•Date: 19th Feb 2007• Region: UK •Type: Article •Topic: Financial sector BC
Rate this article or make a comment - click here |
