Your disaster plan should exceed reg basics

Since 9/11, disaster recovery has taken on new meaning for the financial services industry.

Since 9/11, disaster recovery has taken on new meaning for the financial services industry. Although regulations require federally registered investment advisers to have a disaster recovery plan that is appropriate for their situation, every business should develop a formal written plan that goes beyond regulators’ requirements. It should address alternative space, emergency procedures, employee information and backup equipment and resources, plus communication processes and systems.

It’s relatively easy to find a template for a disaster plan, which you can tailor to something you believe will work for your company. But having a plan and not testing it is a little like keeping old batteries in your smoke alarm. You think it will work, but you don’t really know for sure.

That’s why Richard Prout, president of Wealth Management Group LLC in Danvers, Mass., recently took a day to run a mock disaster drill. The scenario was that all employees came to work one day to find that the office had burned down. No other directions were given.

The backup office was Mr. Prout’s home office. All seven employees arrived in a timely manner, and the necessary technology worked, so operations could begin immediately.

Although the ability to begin operations immediately may define a successful disaster recovery mode, applying the steps of the plan in the mock drill led to insights.

Technology glitches: The office knew that it wasn’t enough merely to have information backed up off-site; so they had an off-site server to which the information could be downloaded. The server, however, needed to be synchronized with the office server.

In addition, several other computer issues were resolved, as Wealth Management arranged to have a computer expert at the disaster recovery meeting. This allowed programming with the home server to be done on the spot, and office efficiency was improved. Now, instead of Mr. Prout’s having to bring his home server to the office once a week to synchronize it with the office server, an automated program performs that function each night.

Changing plans: To alert clients to a disaster, the plan was to e-mail them. However, based on the practice run, the firm decided that every client would be called and informed of the problem.

Also, Mr. Prout’s team decided that on the second day, the office would again call every client to discuss in detail what had occurred and how the firm would move forward.

Remote office: Assuming a three-month delay before moving into new office space, the team identified potential temporary local office-share locations (with contact information) so that an alternative office for client meetings could be set up swiftly.

Enhancing communication: The firm’s website was identified as an easy way to keep Mr. Prout’s computer-savvy clients updated via daily notices. This resource would be communicated to clients during the phone call.

Success was redefined after the drill, and the measurable goal now is that the office will be fully operational and will have made contact with all clients within three hours of a disaster’s onset.

As more advisers conduct a mock drill, one best practice that will likely emerge is “redrilling.” Recurrent drills are important, especially given technology changes that occur in the course of a year. Hardware, software and technology integration that is current today can be pass or even obsolete in a year. Non-technology changes happen as well. For example, an increasing number of employees have access to business technology and work from home. Expect to see the concept of “virtual employees” as a component of disaster recovery plans in the future.

A different approach to testing a disaster recovery plan took place at Relyea Zuckerberg Hanson LLC. The firm is located in a Stamford, Conn., high-rise that was locked down on 9/11; consequently, the staff could not gain access to the office. (It was a challenge to get just one call through tied-up telephone lines.) This experience enhanced the firm’s written plan. Specifically, instead of anticipating what might happen, the team at RZH recalled what did happen. So the plan changed to define alternatives depending on severity of the disaster.

Technology is key. As with Mr. Prout’s office, Relyea Zuckerberg needed to be able to access client information from any of the home offices of the three owners.

Daily scanning of paperwork allows all advisers to have what they need to be operational from any location. Moreover, Dana Hanson, founding member and managing director, emphasizes that the company’s data are protected in several new ways:

Through an on-site parallel server.

Through backup tapes made nightly and stored off-site.

Through a technology service whereby a consultant can retrieve data.

Contacting clients: On a few occasions, the firm has contacted all of its clients by splitting up calls among advisers. All clients are contacted monthly as a normal procedure. But RZH remembers the telephone problems of 9/11 far too well. So, just in case, a bulk e-mail will be sent, reaching around 85% of the firm’s 75 ultrahigh-net-worth clients instantly.

It’s not enough to have a written disaster recovery plan; you must test it to ensure that it really works. Remember to right-size your disaster methodology to fit your clients and the situation. “E-mail or posting notices to the website are great communication tools,” Ms. Hanson said, “but they won’t help if your clients don’t own a computer.”

As time goes on, the percentage of clients who are computer savvy will increase. Because universities have experienced so much violent tragedy in recent years, many campus disaster communication plans include the text messaging of students with directions that can save lives.

While that may seem far off for financial advisers whose clients don’t own a computer, many (if not most) boomers use the Internet, e-mail, cell phones and text messaging, so technology likely will grow as a critical component of disaster recovery.

Whatever your plan, approach and methodology for disaster recovery, conducting a drill is a best practice for enlightened advisers.

As financial advisers become more astute at managing the business, we can expect that they will develop a variety of approaches to different types of disasters. A mouse eating through the wires at work can play havoc with daily operations. But that is a far different disaster than a snowstorm that keeps everyone from getting to the office for a week, a fire that burns your office to the ground or 9/11.

To get started, you may want to take stock of the disasters you and/or your staff have experienced and decipher what has been learned through experiences. List the critical problems the practice would face if it were closed for a week. Then put pen to paper and create a document with this information:

Team member contact information.

A risk assessment.

Risk exposure minimization measures such as having appropriate insurance coverage.

Floor plans and evacuation procedures.

Precautionary technology back-up procedures.

A prioritized to-do list.

Documentation of procedures, and a directory of suppliers and vendors.

Alternative work site and communication approaches.

Location and availability of equipment and resources.

Creating and maintaining a disaster recovery plan makes good business sense. It helps alleviate anxiety by providing a measure of control in circumstances that are largely out of your control. It also makes good financial sense to be prepared.

Given the interruption to business, wasted time and lost opportunities, can you afford not to have a disaster recovery plan?

Joni Youngwirth is vice president of practice management at Commonwealth Financial Network in Wal-tham, Mass. She can be reached at [email protected].