Business Continuity Checklist

The CCO confirms the plan addresses each disruption category SEC and FINRA examiners look for: data loss, loss of office, loss of key personnel, custodian outage, and pandemic / regional event. Cross-reference Advisers Act Rule 206(4)-7 and FINRA Rule 4370 elements.

Score each critical function on RTO (recovery time objective) and RPO (recovery point objective). Trading and custodian connectivity typically need same-day recovery; performance reporting can tolerate 48-72 hours. Document the rationale per function.

Map each critical function — trading, custodian liaison, billing, AML / OFAC, supervisory review, IT — to a primary owner. The CCO, CIO, and operations manager are typically essential; client service associates often are too because they execute trades and process distributions.

Single points of failure are the most common BCP exam finding for small RIAs. Every essential function needs a named backup with current system credentials and training. Document any role where no backup exists today as an open finding.

For each role without a backup, name an owner, a target hire-or-cross-train date, and an interim mitigation (vendor support, peer firm MOU, contracted CCO). Findings without owners and dates do not count as remediated at next exam.

List each system the firm cannot operate without: custodian portal (Schwab Advisor Center, Fidelity Wealthscape, Altruist), portfolio management (Black Diamond, Orion, Tamarac, Addepar), CRM (Wealthbox, Redtail, Salesforce FSC), planning (eMoney, MoneyGuide, RightCapital), and archiving (Smarsh, Global Relay). Note vendor SLA and support number for each.

Confirm IT can re-image a lost laptop within 24 hours and that MFA recovery codes for custodian and email tenants are stored in the password vault with break-glass access for the CCO. Lost YubiKey with no backup is a same-day operational failure.

Identify where each required record class lives: client agreements, trade blotter, advertising and social media, email and text archive, complaint log, gift and entertainment log, code of ethics personal trading. Each class needs a primary system and a recovery path.

Pull a sample restore from Smarsh, Global Relay, or Microsoft Purview covering both email and any compliant texting platform (MyRepChat, Hearsay Relate). Off-channel comms enforcement actions in 2022-2024 made archive completeness an exam priority — verify capture is current.

Triggered when the archive restore fails. Open a ticket with the archiving vendor, notify the CCO, and document interim retention controls until capture is verified. Books-and-records gaps must be cured before the next state or SEC sweep.

Pre-draft the email and voicemail script the firm will use during a disruption: how clients reach an advisor, how to contact the custodian directly for transactions, expected restoration window. Required disclosure under FINRA Rule 4370 for BD-affiliated firms.

Confirm the named relationship manager, after-hours line, and escalation path for each custodian (Schwab, Fidelity, Altruist, Pershing) and each critical vendor (PMS, CRM, archiving, planning, MFA). Generic 800 numbers are not enough during an incident.

Walk the team through a realistic scenario: ransomware on the primary file share at 8am Monday with quarterly billing due Friday. Capture every gap surfaced — credential access, custodian fallback, client communication timing — as findings.

Each finding gets a named owner, a target close date, and a verification step. Repeat findings cycle-after-cycle is the most common pattern that turns a routine exam into a deficiency letter.