Disaster Recovery Planning After Hurricane Sandy

Hurricane Sandy wreaked incredible havoc on the East Coast of the United States, costing many lives and causing billions of dollars worth of damage. It was truly a tragedy of immense proportions; even as these words are being written, there are citizens who remain without power or life’s basic necessities nearly a month after the storm struck. Such an enormous calamity succinctly illustrates how vulnerable we are to the fury of nature.

As people and communities begin putting the pieces back together, investment managers are evaluating how their businesses fared throughout and following the storm. In many cases, new lessons have been learned over the past few weeks and, by extension, firms are making changes to their business continuity and disaster recovery planning.

First and foremost, a number of investment managers either did not have true disaster recovery plans or the plans were notably insufficient. Given that we are just eleven short years removed from 9/11, it is nearly inexcusable for any business based in New York City to lack a robust business continuity plan, including asset management firms. Investment managers without appropriate plans were left facing some difficult decisions, most of which had to be made with incomplete information without much time for deep consideration; adequate planning should assist with such decision making in the future.

A major area that needs to be revised surrounds the assumptions and logic driving many disaster recovery plans. The majority of such contingency strategies revolve around what happens when a disaster strikes the offices of the investment manager, knocking out power or rendering the site unusable for business operations. In these cases, it is typically assumed that, in our electronically connected world, staff can work from home. For many business continuity plans, this was the extent of the strategy.

However, less thought was given to what happens when the office of the investment manager is relatively untouched but the staff is unable to commute or are without power at their own homes. During Hurricane Sandy, travel was incredibly difficult, especially to and from Manhattan, meaning that employees could not readily access their offices. At the same time, many staff experienced widespread and long-lasting power outages at their residences, making work from home impossible. This left many investment managers short on internal resources with no foreseeable way to bring these employees back online.

Another area that will likely be given additional attention following Hurricane Sandy concerns the extent to which an external service provider assists in the disaster recovery process. Most notably, in the case of fund administrators, a complete set of books and records, including portfolio and investor details, are housed on behalf of the investment manager at a separate location. In addition, reputable fund administrators have their own disaster recovery and business continuity plans which are routinely audited under accreditations such as ISAE 3402.

What this means is that an investment manager who utilizes a highly regarded fund administrator already has some part of their disaster recovery plan in place. That being said, a fund administrator is not solely sufficient, as it does not address the portfolio decision making, internal staffing, or IT infrastructure needs of the investment manager. However, an investment manager using a fund administrator is instantly further ahead than an investment manager who self-administers their funds or utilizes and lower-grade service provider.

[ Technology Fragility Threatens Markets]

As a final note, while this analysis has focused on Hurricane Sandy and its impact on the East Coast, a similar disaster recovery and business continuity planning review should occur for all investment managers, regardless of geography. In this instance, it was a hurricane in the Atlantic that caused the disruptions, but it could easily next time be a West Coast earthquake or a Midwest tornado or flooding in the South.

The point is that each investment manager faces their own business risks (environment being just one) and this terrible experience should be seen as an opportunity for review for all money managers.

Have no illusions, investor due diligence requests for the foreseeable future will be probing the disaster recovery plans of investment managers at length. This alone should be reason enough for investment managers to give further thought and review to their disaster planning strategies. If that isn’t a sufficient motivation, consider this: during Hurricane Sandy, the NYSE and NASDAQ were closed, which meant that no fund could trade equities and hence the playing field was relatively level.

What happens if the next disaster impacts a smaller area and does not interrupt trading otherwise? An impacted investment manager would be put at a substantial disadvantage compared to his or her peers; in an industry renowned for the tiniest of edges being exploited for profit, such an event could mean ruin under the wrong circumstances.