Business Continuity Plan

Beyond writing a business continuity plan, what does FINRA's continuity rule require a member firm to do with it?

1. A.File it with FINRA for approval before it takes effect, and refile it after any amendment.Wrong. FINRA does not approve continuity plans; the accountability the rule creates is internal to the firm.
2. B.Have it approved by a member of senior management and review and update it upon any material change to the firm.Correct. Senior approval commits the resources the plan assumes, and the review trigger keeps it describing the actual firm.
3. C.Test it under live conditions each quarter with all customer-facing systems disconnected.Wrong. No live quarterly disruption test is prescribed, and shutting down customer access to prove a point would be perverse.
4. D.Have it certified annually by an independent public accountant engaged for that purpose.Wrong. Independent certification belongs to financial reporting, not to the maintenance of a continuity plan.

Why: The plan must be approved by a member of senior management, and it must be reviewed and updated in the event of any material change to the firm's operations, structure, business, or location. Both requirements exist because a continuity plan is worthless if it describes a firm that no longer exists, and because the resources needed to execute it can only be committed by someone with authority over them. Senior approval also fixes accountability, so the plan is not simply a document the compliance department maintains alone. A firm that drafts an excellent plan and then relocates its operations without revisiting it has failed the rule as surely as one that never wrote a plan.

Groveport Securities' business continuity plan was created five years ago and has never been reviewed since, though the firm's business has not materially changed. The firm considers this acceptable because nothing has triggered an update. Does this satisfy Rule 4370?

1. A.Yes, because nothing material has changed in the firm's business since the plan was created.Wrong. Rule 4370 requires an affirmative periodic review at least annually regardless of whether anything has changed.
2. B.No, but only because the firm must review the plan every time it opens a new branch office.Wrong. This substitutes a narrower, invented trigger for the actual requirement, which is a standing annual review obligation.
3. C.Yes, provided the firm can show the original plan remains technically accurate today.Wrong. Current accuracy does not substitute for having actually performed the required periodic review process.
4. D.No, because Rule 4370 requires the plan to be reviewed at least annually regardless of whether a material change occurred.Correct. The review obligation is periodic, not merely event-triggered, and five years without review does not satisfy it.

Why: Rule 4370 requires a member to review its BCP at least annually, in addition to updating it after any material change. The review obligation is periodic and applies whether or not anything has changed. Groveport has treated the absence of a material change as an excuse to skip five years of required annual reviews, which does not satisfy an obligation framed as a standing, recurring duty rather than one triggered only by events.

What must a firm's Business Continuity Plan address, at minimum, regarding a significant business disruption?

1. A.How the firm will continue critical business functions and communicate with customers, employees, and regulators during a disruptionCorrect. Continuity of critical functions and communication with customers, staff, and regulators are core required elements of a BCP.
2. B.Only the firm's internal chain of command during an emergencyWrong. Chain of command is relevant, but it does not encompass the full communication and business-continuity scope the BCP must address.
3. C.Only the physical relocation plan for the firm's headquartersWrong. Physical relocation is only one possible element; the BCP's required scope is broader, including customer and regulator communication.
4. D.Only how the firm will back up and restore its electronic dataWrong. Data backup is one element, but the BCP must also address communication continuity, among other elements.

Why: A BCP must address how the firm will continue to conduct critical business functions and how it will communicate with customers, employees, and regulators during a significant business disruption, among other required elements.

Beyond the plan's content itself, what must a firm keep current with FINRA regarding its Business Continuity Plan?

1. A.A copy of the full Business Continuity Plan document itself must be filed with FINRA annually for review and approval.Wrong. There is no requirement that the BCP itself be filed with FINRA for approval; the ongoing obligation concerns emergency contact information.
2. B.The identity and contact information of at least two associated persons whom FINRA can reach in an emergency, updated whenever the designated contacts change.Correct. Firms must keep designated emergency contact persons current with FINRA so the firm itself can be reached during a disruption.
3. C.The names of all customers who received the Business Continuity Plan summary disclosure, so FINRA can verify distribution.Wrong. FINRA does not require a customer-by-customer log of BCP summary distribution.
4. D.A signed attestation from the firm's CEO that the plan has been tested within the past year.Wrong. This borrows the concept of a CEO certification from a different supervisory-controls requirement and misapplies it to the BCP emergency-contact obligation.

Why: The identity and contact information of at least two associated persons whom FINRA can reach in an emergency, updated whenever the designated contacts change.