SEC Proposed Rule on Business Continuity for Advisors: What you need to know now

On June 28, 2016, the Securities and Exchange Commission (SEC) proposed a new rule and rule amendments under the Investment Advisers Act of 1940 (“Advisers Act”). The proposed new rule, Rule 206(4)-4, would require SEC-registered investment advisers to adopt and implement written business continuity and transition plans. The focus of the SEC is to ensure that investment advisors could continue operations and address the risks related to a significant business or operational disruption. The SEC staff also issued related guidance on business continuity planning (BCP) for registered investment companies addressed in a separate alert.

Although some pre-existing regulations touch on BCP [Rule 206(4)-7], the SEC has indicated that further guidance is necessary for investment advisors. The SEC has found that many investment advisors’ existing BCP plans do not adequately address the resumption of critical business operations, or have not effectively addressed the key operational risks that relate to significant business disruptions.

Bottom line: Be proactive, prepared, and aware

While the new rule has only been introduced at this point, it highlights the importance of management, board members, and the audit committee to evaluate existing business continuity processes and procedures. Many organizations may not have an adequate BCP plan, or don’t actively update, test, and maintain the business continuity plan.

Whatever the outcome of the proposed rule, management should review and understand the company’s business continuity management program. In addition, management and boards should consider having the business continuity plan refreshed, tested, and/or audited to ensure adequacy of the plan.

What to do now

Business Continuity Management Overview

• Evaluate whether your organization has a business continuity plan. Start with identifying if you have a formal, written business continuity plan and disaster recovery. 
• Determine when the last time a BCP risk assessment and business impact analysis (BIA) was completed and/or updated. Organizations should be evaluating and updating these plans at least annually.
• Audit and/or test the business continuity plan periodically to ensure the plan can be properly executed and that key organizational stakeholders are aware of the plan.
• Closely monitor developments related to proposed business continuity rule and updates from the SEC

Contact a Baker Tilly business continuity management specialist.