BCP Survey Yields first look at Wall Street's Post Sept. 11 Preparedness

At its first Business-Continuity Planning Conference and Expo this week, the Securities Industry Association released the results from an in-depth survey on member firm's business continuity plan. The results reinforced the fact that vision and involvement for BCP is reaching the highest levels of financial-services organizations and should be treated as an ongoing program, rather than a project with a start and end date.

The results were gathered from 62 SIA member-firm responses covering brokerages, investment banking, mutual fund and commercial banking participants. Overall, 89 percent of firms reported their current level of recovery as either excellent or very good.

To accomplish this, financial-services firms now have dedicated BCP teams and increasing budgets. According to the survey, a majority of BCP teams report directly to upper management, either the Board of Directors or the CEO, said Blaise D'Ambrosio, who presented the survey results during the conference as a representative of the SIA BCP Committee.

In general these BCP teams are made up of three people or less, but almost 30 percent of respondents reported their teams were made up of between 4 and 8 people. BCP funding is also reaching higher levels, with 75 percent of respondents reporting annual budgets for BCP initiatives.

While BCP programs focus on similar components, the execution and priorities of those programs differ from firm to firm. These strategy differences are mainly due to firm culture, available skill sets and individual circumstances, reported D'Ambrosio.

When it comes to technology behind business-continuity planning and execution, the survey found that 48 percent of firms use a combination of internal and vendor supplied solutions to recover in the event of a disruption. For recovery times, 90 percent of mainframe users reported being able to recover within 24 hours.

The survey also found that smaller firms were more likely to stay closer to home when selecting alternate-data center facilities for recovery. More specifically, 76 percent of firms with more than 5,000 employees had sites beyond 30 miles while only 22 percent of smaller firms with less than 5,000 employees had sites beyond the 30-mile radius.

In terms of maintaining contact information for recovery, the survey found that about 70 percent of respondents still relied on manual maintenance of the information, rather than automated systems. Most respondents reported that contact information was updated regularly- either quarterly or semi-annually.

The survey also found a few weak links for firms looking back and evaluating their BCP plans and strategies. Awareness was found to be the weakest link for firms rating the success of BCP components. And while most firms reported having formal or informal awareness programs in place, 16 percent had no program at all and less than 30 percent actually had in-house training programs for BCP.

One of the main post-Sept. 11 "lessons learned" for firms was that recovery strategies are now focusing on multiple building outages as opposed to single building outages, which was previously the planning standard. While most firms initially talked about the importance of splitting up businesses and management as well as senior executives across locations, very little has actually happened. The results were presented by members of the SIA's BCP Committee and will be made available on the SIA's website at www.sia.com.