As if absorbing the realities of mortgage regulation weren’t tough enough, brokers are now facing an altogether entirely different threat to their businesses; the unexpected – like bird flu, terrorism and major environmental events like the Buncefield oil depot explosion.
All these so-called calamitous circumstances have the potential to disrupt business on an unprecedented scale and, in its relatively newly regulated state, the mortgage industry is required by the Financial Services Authority (FSA) to have a formal disaster recovery plan, known as a business continuity plan, in place.
If realised, a bird flu pandemic would – according to the latest virologists’ prediction – result in at least 25 per cent of the population becoming infected; incidents such as the Buncefield oil refinery disaster in December 2005 made local homes and places of work uninhabitable for several months.
Plan to cope
But it’s not just grand-scale events that need to be planned for. Vanessa Moore, policy adviser at the Association of Mortgage Intermediaries (AMI), says: “Regulation has made it necessary for advisers, both small and large, to look at how they would cope if say, there was a fire, or theft that meant they could not work as usual.”
The terrorist attacks of 7 July 2005, which brought London to a standstill, if only for a few hours, focused UK business and government on the necessity of being prepared for operational disruption.
In its 2006/07 business plan, which covers the financial year 1 April 2006 to 31 March 2007, the FSA explained its involvement in the Resilience Benchmarking project, an exercise aimed at testing the resilience of UK business to calamities.
More than 60 of the UK’s most significant firms and financial infrastructure providers took part in the project last November. The findings of the exercise were published in December, and although most companies were viewed as having resilient IT systems, it was agreed more co-operation between companies was needed.
In the FSA business plan, John Tiner, FSA chief executive, said it would continue to pursue discussions with larger and more complex firms to ‘improve their stress-testing and scenario analysis’.
He said the FSA would work closely with the private sector and other parts of government, to ensure both that individual firms have plans in place to maintain or restore operations in the event of disruption and that the financial sector as a whole is able to respond effectively.
“For our part, we will liaise with insurance firms to ensure that they have a good understanding of their own exposures to market shocks, including terrorism, natural disaster, flu pandemics or pricing,” he added.
New threats are being taken seriously among larger brokers. Even those who already had disaster recovery plans in place because of their life and pensions regulation status are beginning to update their business continuity plans.
Bird flu threat
Ray Boulger, senior technical director at John Charcol, says the brokerage is now building in the potential threat of bird flu into its emergency plans.
He says: “For a company our size there’s a limited amount we can do, there’s no doubt that some circumstances are difficult to deal with. Issues such as a bird flu pandemic would come within our normal disaster recovery plan procedure.”
“However these are regularly under review. The bird flu issue is a health risk, and unlike one-off events such as a fire, it could prove to be a major strategic issue over a long period of time,” he added.
Part of John Charcol’s current review is an issue of whether to initiate a VOIP, or voice over internet policy, should a disaster like bird flu occur. “VOIP would allow most of our staff to work from home,” says Boulger. “Technology has made it possible for regular clients to be serviced as normal. All our staff have broadband and laptops.
“It does still require a few people to come into the office. What they do is start to re-direct calls via internet telephony, using voice-over internet technology. Clients could be put through to their adviser without them needing to know that adviser is working from home.”
Flexible working conditions, which enable staff to work from home, have enabled the use of such technology. Boulger says: “We make sure all our advisers have the tools to work remotely, its part of company policy. There are occasions when advisers do have to work from home.”
But Boulger acknowledges that there would be challenges with new business should the main office building be closed. He says: “We do see most of our clients face-to-face but if there is a relationship it is easier to do business over the phone. It’s not likely that new clients would be near an adviser. So we would have a challenge with that side of things.”
John Charcol’s internet arm would remain unaffected. Boulger says: “We have back-up of back-up systems, so all client details are protected. We haven’t made a final decision on the VOIP yet. But we do have the technology in place. We don’t regard bird flu as a major threat.” But with an office based in central London, the impact of terrorist activity has to be considered. “We do have a plan for bird flu, although it’s sod’s law – you do not plan and then something like this happens.”
Nick Gardner, director at Chase De Vere Mortgage Management, said the bird flu threat was being taken seriously. He says: “It’s an issue, definitely. Brokers have to have a disaster recovery/business continuity plan in place, and ours has taken a lot of work. It was a requirement of FSA authorisation that a basic plan was in place, but we have done a lot more work on ours to ensure that if there is a disaster, things still run as smoothly as possible.”
The best plan of action?
In case of fire, terrorist activity or natural disaster, Chase de Vere has in place a hierarchy of emergency staff.
Gardner explains: “We have designated members of staff and management who are responsible for different aspects of the plan, and a number of deputies to take their place in case the first member of staff cannot perform their duties.”
“Say, if the office burned down, we would need to implement our IT back-up, which may involve our head of IT or his deputy. All members of staff need to be told what has happened, and invoke our alternative working plans which involve working from different locations both in and out of London, depending on the scale of the disaster,” he explains.
Moving to an out of town office was the most obvious part of Chase de Vere’s plan, should business be affected, but it would depend on what the disruptive event was.
“We could work with a core team in London and with brokers and administrators working from various home-offices if there was a fire. But if there was a massive bomb attack, which effectively shut down London’s transport links, then clearly we would have to immediately head to an out of London location,” Gardner says.
Client data would be protected by IT systems, communication and data-back being the priorities. Gardner says: “We obviously have IT back-up systems in place to protect our data and would enable us to be up and trading again within 48 hours or so at worst. Another important thing is communication, for the detail of the plan to be communicated to all staff now, so in the event of a disaster, everything should run as smoothly as possible. People should know what to do if there was a disaster – and have an established chain of communication to disseminate information at the time.”
The buddy system
Gardner anticipates that smaller firms, with fewer resources at their disposal, would be looking to hook up with other businesses in buddy-type arrangement. He says: “Most should have negotiated alternative office space or arranged a deal with a friendly firm or business partner to use each other’s offices in the event of a disaster.”
But Gardner believes that mortgage networks will have the best disaster recovery plans in place. He says: “They are better protected in a sense because people work in different locations.”
Tenet, which now has 5,500 plus advisers following its take-over of Berkeley Independent Advisers, has two recovery centres near its headquarters in Leeds.
Emma Bull, marketing manager of Tenet, admits admin staff can be moved to one of the two sites should the worst happen. She says: “The most likely scenario is a fire although we are prepared for terrorism.”
Tenet also has a risk management steering group which meets frequently to assess potential threats. “It’s an on-going arrangement,” says Bull. In terms of information, Tenet makes sure all advisers back-up client information on a daily basis. This is held centrally, and in turn is also backed-up. Bull says: “Most of our advisers are based at home, so they have the facilities to work remotely.”
Smaller brokers, such as the medium-sized Flexible Mortgage.com in Edenbridge, Kent rely on their network for disaster recovery facilities. David Clare, director of Flexible Mortgage.com, says: “We’re part of Personal Touch network. They provide us with a back-up software system called Toolbox. This web-based database means if someone is away, we have the client’s details to hand.”
The Toolbox database contains everything Flexible Mortgage’s team of 25 advisers need to know should one of their colleagues be indisposed. Clare says: “If our advisers have to work from home, then they have all the back-up they need. Toolbox can be accessed remotely and safely via a password system.”
Keeping business going
Keeping business going is essential for Clare. “It’s not just a regulation thing, we want to keep our customers happy. Mortgage is a ‘now’ business. You can lose a good rate.”
Clare does fear for smaller advisers, who he feels are still largely unprepared for all eventualities. He says: “Mortgage advice used to be a cottage industry but regulation has meant that is now impossible. Five years ago, we decided growth was our only option and since ‘Mortgage-Day’ that has proved to be the right choice. It enables us to function on all levels. We have the facilities to maintain clients and fulfill all our obligations. A smaller adviser that is unable to operate often doesn’t have the back-up systems that even a medium-sized firm would.”
AMI’s Moore says even smaller advisers would still be expected to have what the FSA regards as systems control requirements in place.
She says: “During an FSA visit there would have to be some evidence of a continuity of business plan. It is part of regulation because it means clients are being looked after. It is better to have some sort of system than nothing.”
Jeff Knight, director of marketing at GMAC-RFC, says providers themselves can offer back up to brokers. He says “All our IT systems back-up client details. But it is still the responsibility of the mortgage intermediary to be prepared for the worst.”
Samantha Downes is a freelance journalist
