The coronavirus (COVID-19) outbreak has been dominating the headlines as it continues to spread across the globe and the United States (as of March 6, 20 states have reported cases). The virus has broken supply chains, disrupted manufacturing and caused extreme movement and volatility in the markets. Recently, large corporations, such as Amazon and Facebook, have told their employees to work from home and avoid coming into the office in order to mitigate the potential for an outbreak that could cripple their business.
The SEC, NFA and other regulatory bodies are also taking note of the effects of the coronavirus. The SEC released an order providing conditional regulatory relief for filings and in-person board meetings for public issuers and registered investments companies impacted by the coronavirus. Also this week, the NFA sent out a notice encouraging all members to review their business continuity plans (BCPs) to ensure they are up to date and include appropriate measures to address the coronavirus outbreak.
Similar to Superstorm Sandy in 2012, we believe the SEC will use the coronavirus outbreak as an opportunity to test and scrutinize advisers’ BCPs. We expect that the SEC will ask about BCP testing and implementation during regular examinations and will even conduct a sweep examination focused on BCPs.
We encourage everyone to take measures to review and test BCPs to ensure, amongst other items, that the plan is up to date and effective, specifically that:
- There is a current listing of all employees and their respective phone numbers and personal email addresses.
- There is a current listing of critical service providers and their respective contact information.
- Designated backup locations (if applicable) are ready to receive employees.
Further, we highly suggest conducting a BCP test in the coming days. You can do this by instructing employees not to come to the office and having them continue their jobs while at home. You should ensure, amongst other things, that:
- Employees are able to access all programs and necessary files.
- Employees have the necessary Wi-Fi bandwidth at home to work in the event their entire household is home.
- Employees have the needed equipment to perform their everyday duties.
While conducting these tests, it is important to document the process, and where necessary, make updates to your firm’s BCP to ensure you are able to smoothly continue operations. Having adequate documentation evidencing testing and implementation of the BCP will be crucial to prove to the SEC that this was actually done.
In times like this, it is important to remind all employees about the process for this type of scenario. Most employees only hear about the BCP during their annual training, so a refresher email should be sent. Every employee should also leave the office prepared to work remotely the next day. Although many believe a BCP is primarily for a natural disaster or act of terror, it is becoming more and more evident that the coronavirus will require many organizations to implement their BCP.
Greyline encourages any firm to reach out to us to discuss their BCP, as well as any concerns.