Practice question, Business continuity
Show your business continuity and succession plan, when it was last tested, and what would happen to client service if a key person were unavailable for a month.
Taft practice question: not an official regulator question. SEC Division of Examinations, United States (federal). For SEC-registered investment advisers. Evidence category: Policies and procedures.
Not legal advice. A practice prompt for rehearsing how your team explains its controls and evidence. No scoring, no model answer, no implication that a regulator will ask these words.
Authored by Taft. Last checked 2026-11-09. All questions.
Why it is relevant
Staff observed newly registered advisers that did not have adequate business continuity plans, including succession plans, and the business continuity plan is on the typical initial request list.
Sources: [1] Staff Observations, Compliance Policies and Procedures, [2] Attachment, Information Processing, Reporting, and Protection
Evidence to locate
Suggested, not mandatory. A regulator's actual request list governs.
No evidence cues listed.
Follow-up prompts
Who else can execute trades and move client money, and how is that access controlled?
Applicability
- Applies to
- Advisers registered or required to be registered with the SEC.
- Does not apply to
- Not stated.
Cite
Cite the official source first. Then: Taft Compliance Group, Exam-prep toolkit (draft), question q-business-continuity, https://taftcompliance.com/resources/exam-prep-toolkit/questions/q-business-continuity, last checked 2026-11-09.
Sources
U.S. Securities and Exchange Commission, Division of Examinations, Risk Alert: Observations from Examinations of Newly-Registered Advisers (staff statement). regulator guidance. Staff Observations, Compliance Policies and Procedures, pages 3 to 4.
https://www.sec.gov/files/risk-alert-newly-registered-ias-032723.pdf
Checked 2026-11-09; published 2023-03-27.
Supporting passage
The staff observed compliance policies and procedures that: (1) did not adequately address certain risk areas applicable to the firm, such as portfolio management and fee billing; (2) omitted procedures to enforce stated policies, [...] and/or (3) were not followed by advisory personnel, typically because the personnel were not aware of the policies or procedures or the policies or procedures were not consistent with their businesses or operations. [...] Used off-the-shelf compliance manuals that were not tailored for consistency with the advisers' operations and business lines. May not have devoted sufficient resources to comply with regulatory requirements and their own policies and procedures (e.g., advisers may have assigned additional and unrelated responsibilities to the chief compliance officer ("CCO"), resulting in limited time for the CCO to dedicate to compliance), or to ensure compliance personnel understood actual business practices. Did not have adequate business continuity plans, including succession plans.
U.S. Securities and Exchange Commission, Division of Examinations, Risk Alert: Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (staff statement). regulator guidance. Attachment, Typical Initial Information Examiners Request of Investment Advisers: Compliance Program and Oversight Process; Valuation; Information Processing, Reporting, and Protection.
https://www.sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf
Checked 2026-11-09; published 2023-09-06.
Supporting passage
Compliance policies and procedures in effect during the examination period. Tests performed (i.e., compliance reviews, quality control analyses, surveillance, and/or forensic or transactional tests performed by the firm). Annual and/or interim reviews of policies and procedures, including any reports prepared. Record of compliance exceptions. Inventory of compliance risks and conflicts of interest that forms the basis for policies and procedures and notations regarding changes made to the inventory. Valuation process. Fair-valued and illiquid securities held by clients. Advisory fee calculations. Pricing overrides. Safeguards for the protection of customer records and information. Business continuity plan. Cybersecurity incidents or breaches (e.g., incident description, impact, and remediation).
Changes to this question
No released changes.