Business Continuity and COVID-19

COVID-19, the coronavirus strain outbreak, has been detected in every territory that JP Reis works in. Its destabilizing effects on financial institutions have seen executives trying to act decisively without having been through a pandemic before. All of this brings business continuity and disaster recovery policies into the spotlight.

The outbreak is affecting trading organizations in more ways than one. Uncertainty about the disease, and restrictions that will be imposed, as well as the disruptions to supply chains through reductions in production, are causing the biggest falls in market values since 2008. The Dow Jones industrial index fell so quickly at Monday’s opening that trading was automatically suspended. Many directly and indirectly impacted industries are facing big write downs. Milan’s Borsa exchange is one of the worst affected. The Italian economy was fragile anyway and so far, Italy has been Europe’s worst affected country. Today, March 10th, saw Prime Minister Conte announce a national lockdown.

Disaster Recovery

This national decision brings us to enterprise level business continuity, and more specifically disaster recovery. Business continuity planning [BCP] is an on-going, everyday discipline of back-ups, failovers and contingency planning. As part of that, disaster recovery [DR] is like an insurance policy that you hope you never need. Unfortunately, in keeping with insurance policies, when you do need it, you may find that you are not as covered as you thought. When traders are seen jumping from taxis outside the DR site clutching essential desktop equipment under their arms, one senses this might be the case. The biggest challenge when invoking a DR plan is that not all incidents have the same impact and so mitigating them does not mean taking the same steps in reaction to each event.

Working with Banks, Professional Services and Technology companies, JP Reis has often had to persuade clients to consider geographic separation between main offices and disaster recovery facilities. One $1B company was planning to put a secondary facility on the other side of the street from their primary location; in terms of recovery time for denial of access or loss of power to the primary facility this was excellent, in terms of the threat level to losing both facilities it was a very high risk. Disease outbreaks are included on our list of accidental, deliberate and natural threats but this is not a “told you so” story. Geographic separation is clearly an important factor but if you are not permitted to travel, let alone cross a border, the location may not be an effective part of the BCP. If your DR facility is too far away, it could be impractical for your staff to get there anyway thus falling outside of recovery time objectives. Working from home is clearly an effective solution for an incident such as a pandemic and should definitely be part of any BCP.

The Trading floor, however, is one of the work environments where physical proximity to other traders is a business and regulatory necessity, so the use of a DR facility is generally a requirement. Most trading institutions have a group of “Power Traders” who make good use of their trading turrets and the features including multiple private wires, speed dials, open channels, speakers and microphones. Disaster recovery policies often run on the basis that 30-40% of important users can run the business in an emergency and for the power traders, that means having turrets. Is 30-40% really enough though? The answer to that question is complex but one of the factors that needs to be considered is the length of time that the incident is being mitigated. Recovery point and recovery time objectives for a scaled down operation are generally well understood but the length of time that the business needs to operate under DR conditions is often not properly factored.

Soft Solutions

Soft turrets and soft clients are often proposed as disaster recovery solutions. In principle this makes sense although some banks are probably finding out right now that this is not something that can be rolled out reactively for a large trading cohort. 2,000 soft clients require 2,000 suitable pieces of hardware, equipped with the appropriate operating system, potentially supplemented with peripherals. For banks staying with their existing vendor, licenses need to be in place and network capacity testing performed – there is considerable processing power on a turret. Those considering alternative solutions need to consider how to administer system configuration and how they will connect effectively with existing circuits. The conclusion will probably be that this is something to have in place for next time. It is likely that Trader Voice will be a software industry by then.

Work with What You Have

For now, the trading turret’s lifecycle continues and for most power players dealing with complex asset classes they remain essential kit. Attempts to retrofit a continuity plan based on soft clients should only be made based on a clear understanding of the limitations. Realistically, banks need to find ways to work with what they have, preferably facilitate business in a scaled down fashion and seek solutions for full operations within an acceptable timeframe should the incident become protracted. Assuming the current DR facilities are effective in sustaining business at current levels, investigation must be started to establish how to boost capacity and potentially look for alternative locations. A method for mitigating infections is split floor trading: put distance between desks of traders working in the same group. If you enforce hygiene measures and self-isolation between the two operations, business can continue even if one floor is compromised.

In our experience, banks find a way because they can’t afford not to, especially when volatility is such a source of income. Back in 2001, we worked with a large number of traders who’d relocated their operation to a nearby hotel. People said back then that they would plan for the next one, and they did, but time moves on, budgets are squeezed, risks seem more remote and “something has to go.” The next one will come sooner or later in some shape or form. Think about how your organization will prepare. Get it right and the return on investment will be good in the long-term.

Leave a Reply

Your email address will not be published. Required fields are marked *