SFC Publishes Assessment Questions for Effective Business Continuity Plans
Introduction
The Licensing Department of the Securities and Futures Commission (the SFC) has issued a circular (see archive) to licensed corporations containing a non-exhaustive list of self-assessment questions to which reference can be made during the review of business continuity plans.
According to the circular, in the event of operational disruptions1, appropriate internal controls and risk management measures are vital in protecting key business functions and recovering them promptly. Therefore, an effective business continuity plan is important to the operations of all licensed corporations.
Assessment of business continuity plans
Below is a non-exhaustive list of possible assessment questions for reviewing existing business continuity arrangements:
Checklist
Completed
Have you assigned at least one senior staff member to:
Identify critical systems and functions (including outsourced functions);
Activate the business continuity plan at the appropriate time;
Oversee the business recovery process;
Communicate with other staff members about the process;
Coordinate with relevant external parties (including major service providers) to resume your business operations; and
Test the business continuity plan and evaluate its effectiveness on a regular basis and update it as necessary?
Do you have other business location(s) which may serve as your back up site from where you can maintain critical operations and services if your staff is unable to access your major office(s)?
How can you serve your clients if access to your office is restricted?
Will certain functions or services to clients need to be suspended if your back up site can only operate on a limited capacity?
Do you have an emergency communication plan to inform your clients and counterparties of your business continuity arrangements?
Do you have an emergency contact arrangement for all your key staff members and are the contact details up-to-date?
Have you regularly backed up and stored your critical business and transaction data, and are those backed-up data available for use in your back-up computer system within a reasonable timeframe?
If you are an Exchange Participant, do you have any alternative trading arrangement to effect clients’ trade orders, such as trading via another Exchange Participant on your behalf or using back-up terminals provided by the Exchanges?
Have you assessed the quantum of potential claims from clients in the event you cannot provide the usual level of services to them?
Have you assessed the adequacy of your existing insurance coverage?
Whilst it is important to assess business continuity plans, licensed corporations are also reminded to update their information, particularly emergency contacts, with the SFC without delay.
Please refer to paragraph 36 in the Appendix to the Management, Supervision and Internal Control Guidelines for Persons Licensed by or Registered with the Securities and Futures Commission (April 2003).↩
Hong Kong licensed corporations
Business continuity in Hong Kong
SFC assessment questions
Operations of Hong Kong licensed corporations
self assessment questions for Hong Kong companies
Review of business continuity plans
SFC Business continuity plan checklist
Sample assessment questions for reviewing existing business continuity arrangements
