Business Continuity (BC) is concerned with the governance and implementation of proactive and reactive measures which ensure that enterprise and business functions have resilience and recovery capabilities to continue, should a serious event occur. This is done through the (i) integration and alignment with the various risk functions throughout the organization and sector; (ii) development of guidance and standards relating to business continuity, crisis management and location; (iii) monitoring compliance; and (iv) promotion of awareness and education. DTCC’s Global Business Continuity Policy establishes requirements for how DTCC will affect and maintain controls that address defined threats which, if not otherwise implemented, could result in a high level of risk to the continuity of enterprise operations. This policy defines the governance structure, high-level roles and responsibilities and framework for DTCC’s BC process.
Given the nature and breadth of significant business disruptive events, BC aligns its controls to the global, regional, site, service, business and support levels. The business processes have a relative importance based on the service they provide to the financial sector. The ability to deploy sensible and balanced controls, as well as to triage recovery efforts, is based on this relative importance. BC plans enable DTCC to assess the impact of the disruption, organize communication and decision-making, and coordinate the company’s response effort effectively and efficiently.
To ensure the continuity of critical business functions, DTCC’s Business Continuity and Resilience (BCR) department is responsible for working with business areas to identify instances of key person risk, workforce balance risk, and geographic concentration risk. To mitigate these types of risk, BCR utilizes work area recovery strategies that may be employed in the event of a disruption.
- Work area recovery strategies (inclusive of workforce balance, work from anywhere, transference, and on-demand seating) are assigned by BCR to employees as part of the bench strength analysis (BSA).
- The BSA is completed semiannually in tandem with business line and support unit resilience plan reviews to identify gaps with respect to key person risk, geographic concentration risk, and workforce balance risk.
- To address gaps that have been identified, short-term or long-term remediation strategies are put into place (including, but not limited to, hiring personnel and cross-training existing personnel).
- The BSA is considered best practice in the business continuity space; DTCC’s BCR program built a homegrown tool to complete this BSA, achieving a level of detail that is unique in the industry and informed by a series of inputs.
- DTCC also uses third-party tools to gather employee information and build out resilience plans, inclusive of business area call lists. Individuals in the call list are fed into the BSA tool, along with the region they work in, the facility they are assigned to, the hours they work, and the work area recovery strategy they are capable of. Subject matter experts then assign each individual bench strength capabilities per business function in their area.
Once this data is collected, BCR representatives run an automated analysis to identify instances of key person risk, geographic concentration risk, and workforce balance risk, as defined per DTCC’s Global BCR Policy.
- Key person risk occurs when only one individual in a given business area is identified with a bench strength of “same day.”
- Geographic concentration risk occurs for critical business functions when more than 60% of staff are located in one region.
- Workforce balance risk occurs when more than 60% of staff with “same day” capabilities for a given business function are concentrated in a single facility and work the same shift.