Could Your Firm Survive a Bad Week?

Every firm believes it could handle a bad week until it actually has one. A server fails on a Monday morning, a ransomware note appears on a portfolio manager's screen, or a cloud provider has an outage during a live deal. What happens in the next four hours defines the next four months.

For boutique investment firms, wealth managers and advisers, a bad week is not an abstract risk. It is client money, deal timelines and regulatory reporting all sitting on infrastructure that, in many firms, has never been properly stress-tested.

This article relates to the Business Continuity & Disaster Recovery domain of the Technology Resilience Score. It looks at whether your firm could keep operating, and recover cleanly, if something went badly wrong tomorrow.

Why business continuity is different for financial services firms

Most businesses can absorb a day or two of disruption. Financial services firms rarely have that luxury. Trading windows close, valuation deadlines don't move, and clients expect access to their portfolios and their adviser on demand. The cost of downtime is not just lost productivity — it is reputational and, in some cases, regulatory.

• Deal and portfolio data is time-sensitive; a delay can affect pricing, execution or client outcomes
• Clients and investors expect continuous access to reporting and communication, not an apology email
• Many firms operate lean IT teams, so a single point of failure can take down an entire office
• Recovery has to be demonstrable, not assumed — you need evidence a plan works, not a belief that it would

A firm that has never tested its recovery process is making a bet it hasn't priced.

What FCA operational resilience expects of firms like yours

The FCA's operational resilience rules require firms to identify their important business services — the ones that, if disrupted, could cause harm to clients or to markets — and to set impact tolerances for how much disruption they can absorb before that harm becomes unacceptable. For an investment firm, that might mean the ability to place trades, value a portfolio, or give a client access to their funds. Business continuity and disaster recovery planning is the practical mechanism that keeps a firm inside those tolerances.

This isn't a document exercise. It requires actual technical capability: backups that restore cleanly, failover that has been tested, and a recovery time that has been measured rather than estimated. The key question becomes: "If our most important system went down right now, do we know exactly how long it would take to get it back, and has anyone actually tried?"

The problem with an untested recovery plan

Plenty of firms have a backup solution. Far fewer have confidence in it. The gap between having a plan and having a tested plan is where most disasters actually happen.

• Backups exist but have never been restored to confirm they work
• Recovery time objectives are guessed rather than measured against a real test
• The plan lives in one person's head, or in a document nobody has opened in a year
• Cloud and on-premises systems are covered inconsistently, leaving gaps between them

An untested plan is a hope, not a strategy.

What weak business continuity looks like in a financial services firm

These are the warning signs we see most often when we assess firms in this sector.

• No documented list of which systems are truly critical to daily operations
• Backup jobs that run but are never verified or test-restored
• No clear owner for continuity planning inside the firm
• Recovery plans that assume the same person will always be available to execute them
• No defined maximum tolerable downtime for core systems
• Continuity planning that has never been updated since a cloud migration or office move

Any one of these on its own is manageable. Together, they mean a firm is relying on luck rather than design.

What strong looks like

A resilient firm knows exactly which systems and data matter most, has documented and tested recovery procedures for each, and can state with confidence how long recovery would take and how much data could be lost in the worst case. Continuity planning is reviewed on a schedule, not after an incident forces the conversation.

Just as importantly, strong continuity planning is owned. Someone in the firm, supported by their technology partner, is accountable for making sure the plan still matches how the business actually operates today — not how it operated two systems ago.

How this TRS domain helps financial services firms improve

The Business Continuity & Disaster Recovery domain of the Technology Resilience Score gives firms a structured way to assess where they stand, rather than relying on assumption. It looks at planning, testing, documentation and recovery capability together, because a strong score in one area doesn't compensate for a gap in another.

• Establishes which business services and systems are genuinely critical
• Assesses whether backup and recovery has been tested, not just configured
• Reviews whether recovery time and data loss tolerances are documented and realistic
• Identifies single points of failure, technical or human

The result is a score out of 5, giving your firm a clear baseline and a structured improvement path rather than a vague sense that things are probably fine.

Building resilience before you need it

The firms that recover fastest from a bad week are the ones that planned for it when things were calm. Waiting until after an incident to ask whether the backups work is the most expensive way to find out the answer.

The Technology Resilience Score gives ambitious financial services firms a benchmark across 10 domains, including Business Continuity & Disaster Recovery, so continuity planning becomes a measured discipline rather than an assumption.

Related reading

• Would Your Firm Even Know?
• Why Your Firm's Cloud Foundation Matters More Than You Think
• Operational Resilience Is a Technology Strategy Problem

Get your Technology Resilience Score