As we are going through these unprecedented times, we feel it is important to not only continue providing perspective on existing and proposed regulations, but to also stay abreast of other regulatory developments, trends and best practices as they are communicated by OCIE and as we see them occur in practice within our client base.
The following request for information was received by two of our clients yesterday who are currently undergoing an SEC examination and was undoubtedly prompted by the impact that COVID-19 has had on day-to-day operations of investment advisers. We have heard that OCIE may also be sending this to advisers who are not currently being examined, likely as part of an information gathering effort.
We felt these questions were important information to share with you, not only if you have recently enacted your firm’s BCP, but also for future reference to help guide the creation, implementation, and/or review and assessment of your firm’s Plan.
Please feel free to reach out with any questions, comments, or concerns, or if you would like to discuss how these additional requests impact your current BCP.
Stay safe and have a nice weekend.
- Does the firm have: (i) a written Business Continuity Plan; (ii) a Pandemic Continuity of Operations Plan; and/or (iii) equivalent informal plans or guidance (collectively, “BCP”)? If so:
- Briefly describe some of the aspects of the BCP that are particularly applicable to maintaining continuity of business operations when dealing with the COVID-19 pandemic (e.g., personnel working remotely).
- Are there any business operations that cannot be performed remotely?
- If the firm has a BCP, has the firm activated/implemented its BCP in response to COVID-19? If so, please describe:
- What aspects of the plan have been implemented?
- Whether the firm has identified any preliminary weaknesses or unforeseen issues since implementing its BCP?
- Whether the firm has encountered, thus far, any limitations in its ability to operate critical systems or conduct critical operations in connection with its personnel working remotely?
- Whether working remotely has affected the firm’s oversight of any of its third-party vendors or service providers?
- Does the firm’s BCP efforts address the resiliency practices of its key third-party vendors, service providers, and business partners (collectively, “vendors”) (i.e., the continuation of the vendors’ business functions affecting the firm’s key operations)? For example, does the firm make sure that vendors address:
- Continuity program activities, such as regularly reviewing and updating their BCP?
- Disaster recovery plans for their systems, such as identifying the locations where data is backed up and recovery time objectives?
- Business continuity procedures, such as comprehensive continuity strategies and procedures with all of their vendors?
- Communication practices, such as internal and external communication plans with their vendors and clients/customers?
- Is the firm prepared to have all of its personnel operate remotely for several weeks (e.g., 3+) or months, if required or appropriate? Are any personnel unable to operate remotely or unable to do so for several weeks or months?
- Does the firm have a contingency plan if its essential personnel are unable to work, or only able to work on a part-time basis, for several weeks or months? For example, personnel may be incapacitated or are only able to work part-time if they are caring for children.
- Has the COVID-19 pandemic created hardships for the firm (e.g., financial, human resources, or otherwise)?
- Has the firm considered assessing the impact of COVID-19 on its business and operations? If so, is it underway, or when does the firm believe it will undergo this assessment?
- What other issues or concerns does the firm want to share with the SEC, including any challenges related to COVID-19 that have impacted other firms?
In partnership with SS&C | Advent, Focus 1 presented it’s “2020 SEC Exam Priorities and Practical Compliance Solutions” webinar last Thursday, March 19th. If you were unable to attend and have not yet registered, please email firstname.lastname@example.org with “Webinar” in the subject line, and as soon as the recording is available this week we will register you and respond with a direct link to the recording and associated compliance resources:
- SEC Exam Survival Guide
- OCIE Exam Priorities (2013 – 2020)
- 37 SEC Exam Tips