Originally posted at the hedge fund operational due diligence blog www.Corgentum.com/blog an introduction to operational due diligence on business continuity and disaster recover planning

1. Is Your Hedge Fund Prepared for the Storm? –
Operational Due Diligence on Business Continuity and
Disaster Recovery Planning
With the recent continuing spate of snow storms and extreme weather throughout the United States
the subjects of business continuity planning (“BCP”) and disaster recovery (“DR”) have come back
into the spotlight.
Even minor disaster type events can cause major disruptions to a hedge fund’s operations. From
heavy snow which may prevent employees from accessing the firm’s offices to small scale power
outages and routine internet access outages, occurrences which present the potential for data loss
and business disturbances often occur more frequently than many investors would think.
Often during the course of an operational due diligence review, investors run the risk of being lulled
into complacency when it comes to evaluating a hedge fund’s ability to both continue operations
when a disaster event occurs (i.e. – business continuity) and to restore from a disaster things such
as potential data loss (i.e. – disaster recovery).
Considering Hedge Fund Strategy Appropriateness:
As is the case with the vast majority of issues which should be covered during the operational due
diligence process, certain strategy specific considerations should be taken into account when
evaluating the appropriateness and robustness of a hedge fund’s business continuity and disaster
recovery planning.
For example, a hedge fund which engages in a high-frequency trading strategy should be more
sensitive to risks due to down time from a power outage, loss of internet connectivity or loss of
telephones which would influence the fund’s ability to trade, as compared to a fund which executes
only a handful of trades a week. Similarly, investors performing due diligence on these funds should
take measures to understand the appropriateness of different levels of preparedness for each of
these funds. This is not to suggest that a fund which executes a small number of trades every month
should settle for a mediocre BCP/DR plan for trade connectivity in the event of a disaster event.
However, in reaching an conclusion in relation to the amount of operational risk present at a
particular hedge fund, the nature and weight of the risks relevant to that particular hedge fund
should be considered.
Protecting Critical Data:
Critically important to the successful operations of any hedge fund, is the management and
maintenance of data. Data can include all types of items ranging from daily trade activity files and
security master files to routine employee emails. When a disaster event occurs a hedge fund must
be able to access and restore this data in a timely manner. If not, they could face disruptions which
cause a number of problems including deprive them of market opportunities and delaying production
of investor capital statements

2. Some key questions investors should consider in evaluating the robustness and appropriateness of
a hedge fund’s data backup and recovery systems include:
• How is data backed up? (i.e. – via tapes, external hard drives, online backups etc.)
• Are different types of data backed up more/less frequently? (i.e. – for mission critical
systems versus lower priority systems)
• How long would it take to restore data?
• Are test data restores performed? If yes, how frequently and by whom?
Understanding BCP/DR testing:
Regardless of the business continuity and disaster recovery policies and procedures in place, such
plans are virtually useless unless they are frequently tested. Testing should not only be performed
from a technological standpoint (i.e. – if the primary internet connection goes down does the backup
internet pipe automatically kick-in) but also from a personnel perspective as well. Some key
questions to investors may want to ask in this regard include:
• Have employees performed any simulated testing or restores of systems according to the
firm’s BCP/DR plans?
• Is contact information for service providers (i.e. – administrator, legal counsel, auditor etc.)
up to date should employees need to contact them?
• Who is responsible for activating the firm’s business continuity and disaster recovery plans?
• Are employees provided with each other’s contact information in the event of a disaster?
Who makes sure this information is up to date?
• Should the hedge fund’s office become inaccessible, can employees access their desktops
remotely? If yes, has this been tested by employees?
• Does the firm maintain a disruption gathering location should the hedge fund’s offices
become inaccessible?
Business continuity and disaster recovery planning is a complex area of a hedge fund’s operations.
BCP/DR planning touches a number of different operational functions throughout a firm including
the areas of compliance, business planning and information technology. Investors taking care to
thoroughly vet this area of a hedge fund’s operations may find that they sleep better at night when a
disaster event strikes.
Originally posted on the Corgentum Consulting blog at www.Corgentum.com/blog
For More Corgentum.com
Information info@corgentum.com
Tel. 201-360-2430
© 2011 Corgentum Consulting, LLC