Going the distance. Business continuity planning in corporate treasury

Transcription

1 Going the distance Business continuity planning in corporate treasury

2 Business continuity planning in corporate treasury Corporate treasury is at the heart of a company s financials and even a hiccup in operations has the potential to create headline risk if, for example, dividend payments or payroll are not posted on time. Planning and preparation are key to sustaining core flows during an outage. Integrated approaches that creatively engage staff are another important first line of defence. Business continuity planning (BCP) represents a broad strategy of prevention and recovery to deal with potential threats to a company. Disaster recovery is typically a subset of that strategy. Working to address threats Together, they underpin operational risk management to address stress scenarios that range from a service interruption from adverse weather, to a breakdown in the supply chain, to a natural disaster. Increasingly, threats are cyber-related, highlighting the need for a strong partnership with information technology (IT) to test how systems perform under distress. Within corporate treasury, the internationalisation of flows adds complexities and benefits in the BCP process. Having treasury centres in different geographic locations on different power grids provides a hedge to back up servers, cross-train staff and maintain a follow-the-sun support model. Oversight on local governance can be challenging due to differences in time zones, languages and regulations. Service interruptions from adverse weather Business continuity planning helps protect your business from potential threats... Natural disasters Cyberthreats Breakdown in supply chain An innovation-oriented approach brings new ways for corporate treasurers to think about solving these challenges in order to retain functional control to securely monitor accounts, move cash, settle transactions, manage liquidity and mitigate risk. Having treasury centres in different geographic locations on different power grids provides a hedge to back up servers, cross-train staff and maintain a follow-thesun support model. This article provides an introduction to BCP and frames the topic to training for a marathon. It speaks to health checks of core systems before, during and after a misstep for a recovery of vital functions that keep corporate treasury up and running. Prevention is the best medicine and exercising care through a documented business continuity plan that is tested frequently is crucial for a resilient banking infrastructure when you need to go to Plan B. 2 of 6

3 Charting a course A high-level guide to help you approach business continuity planning and sustain an operational incident in corporate treasury. Due diligence (before) Engage senior leadership for policy and governance of business continuity planning Organise a crisis management team including corporate treasury, IT, operations, audit etc. to develop a strategic BCP framework Document a business continuity plan with back-up procedures Identify critical systems and functions in treasury operations (accounts, payments, reporting, FX, investments, , voic ) Build failover automation to speed execution of the back-up plan and eliminate potential human error Test, test, test perform scheduled and unscheduled tests at primary and back-up sites including all payment channels Perform routine health checks with banks and providers to ensure payment systems are operating on the latest anti-virus software Mandate employee training on back-up procedures. Vigilant employees are a first line of defence to detect weaknesses in controls Document a client communications plan Exchange contact details on back-up personnel with banks, providers and vendors in the supply chain Ensure bank records for all accounts are current as it relates to authorised signers Implement systems to detect cyber intrusions Buy insurance where appropriate. Execution (during) Declare the decision to go into BCP mode Respond and stick to the business continuity plan as much as possible Execute the client communications plan Log issues that need to be resolved when all systems and staff are back online Recover primary systems Validate cash positions. Self-assessment (after) Remediate open issues Identify the cause of the outage and solutions to prevent a recurrence Conduct a post-mortem on the response Assess recovery times against key performance indicators and service level agreements Test, audit and update the business continuity plan, regularly. Project management 3 of 6

4 Client communication during an outage can be a tricky part of the BCP process. Ideally, client data by product subscription is accessible so targeted messages can be sent to impacted users only. Mass updates run reputational risk if all clients are spammed when, for instance, a service interruption affects only a small population of users. Designating staff to post content on social media is another consideration. Millennials will likely gravitate to these sites for updates rather than calling and trying to get through to a help desk. Decision trees One way to think about BCP from a payments perspective is through decision tree analysis and fundamental if/then statements. Examples include: Delivery channel/payment method Type Payment volume supported SWIFT Unattended High Host-to-host Unattended High Service bureau Unattended High Electronic banking Payment file upload Attended Medium Payment templates Attended Medium Bank-specific contingency payment portal Attended Medium Mobile or digital wallet Attended Low Prepaid cards Attended Low Depending on your structure, if you aren t able to connect to your bank via SWIFT, or through a host-to-host connection, or your service bureau, is your electronic banking system configured on a multi-bank basis to support global treasury operations (i.e. as a BCP contingency)? Do the users and system administrators know their passwords and have their login credentials (tokens, certificates etc.)? Has the payment file upload tool been tested to ensure the file formats are supported? If the payment file upload tool isn t available, are online payment templates set up with current delivery instructions? Are authorisation limits sufficient for back-up staff? Has the system been set up for multi-bank reporting by MT940 (balance and transaction statement) for all accounts globally? Have you asked your bank to set up your accounts for MT101 (request for transfer) through bilateral agreements with your other banks where possible? If your electronic banking system isn t available, then does your bank offer an online emergency payment portal with secure remote access? If so, have you explored it? If online channels aren t available then do you have a mobile or digital wallet pre-loaded with current telephone numbers for your beneficiaries? Are staff equipped with the device? Are pre-paid cards a viable option? How might this differ by country and by currency? As a last resort, how quickly are you able to obtain cash in local or foreign currency if funding is urgently needed for mission critical payment(s)? How might this differ by country? Barclays offers an emergency online funds transfer system, Barclays Contingency Payment Access, for institutional clients. Developed in partnership with AccessPay, it is a cloud-based tool for initiating urgent/high-value, domestic and cross-border payments in the UK.?! A decision tree 1 A B C 2 Outcome 1 Outcome 2 Outcome 3 Outcome 4 Outcome 5 Outcome 6 Outcome 7 4 of 6

5 Volume driven considerations In the absence of being able to initiate a high volume of payments through primary corporate-to-bank connectivity, a back-up might be to prioritise the urgent payments that need to be disbursed through an attended channel. The number of employees who are available and entitled to process payments is a factor that will determine the ability to mitigate compensation loss for payments that cannot be made with good value. The resiliency of enterprise resource planning and treasury workstations is a factor that will determine the ability to reconcile and apply cash in a timely fashion. Restoration and recovery of flows is essential for the aggregation of Big Data for predictive cashflow forecasting. Open innovation While the responsibility often falls under the remit of IT, it is important for leadership in corporate treasury to challenge teams across the organisation to think progressively about protecting data streams and, increasingly, digital assets. Creative ways to engage a wide spectrum of employees and encourage a sound risk culture include: Internal hackathons intensive events that bring designated tech specialists together to identify and resolve potential cyberthreats, computer viruses and vulnerabilities in data security. Outcomes include best practices to pre-empt cybercrime through internal controls and external collaboration with like-minded organisations in the industry. Innovation challenges competitions for crowd sourcing of ideas, solutions and development of prototype apps on specific topics. In support of BCP, a potential challenge might be how to communicate with employees and clients if a firm s mobile networks, intranet and internet are down. Prizes are awarded to teams with winning deliverables. Simulation training the quality of employee training is often the difference between thriving or surviving during an outage. Scheduled and particularly unscheduled tests should include back-up staff, as in a real disaster, primary staff may be unavailable. It is imperative that all personnel understand their roles and responsibilities, including staff at regional treasury centres, payment factories and field offices. Innovation champions as technology connectors the BCP team can bring perspectives on innovation, new disruptive technologies and FinTech to their colleagues across the wider team. The threats of tomorrow require a deep understanding of emerging trends that traditional risk mitigation teams may not have. It is up to today s treasury professionals to prioritise BCP and proactively engage stakeholders on a strategy that is effectively communicated yet safeguarded. You can t sprint a marathon but with extensive preparation, it is possible to build a resilient infrastructure to keep corporate treasury operations up and running even in the most challenging of headwinds. In the end, BCP is a team sport it will be the people, systems and processes that help a firm go the distance when it s being stretched. For additional information about Barclays Contingency Payment Access, please contact your Barclays representative. 5 of 6

6 Biography Helene Rosenberg Global Transaction Banking Barclays US In her role within Global Transaction Banking, Helene works with corporations, NGOs and non-bank financial institutions on structuring global cash management solutions in Europe and Africa. Her emphasis is on innovation in payments, the digital client experience and developing go to market strategies with clients who are entering new markets. Prior to joining Barclays, Helene worked at SWIFT where she held roles in Global and Key Account Management as well as Consulting Services, where she launched a niche line of advisory services that included best practices when integrating TMS and ERP platforms. Helene has been published in the London Journal of Corporate Treasury Management. barclays.com/corporatebanking Disclaimer: this article is intended as a high-level introduction, only, to business continuity planning. Please consult with specialists within your organisation on guidance for your firm. Every attempt has been made to ensure that the information provided is accurate. However, neither Barclays Bank PLC ( Barclays ) nor any of its employees makes any representation or warranty (express or implied) in relation to the accuracy, reliability or completeness of any information or assumptions on which this document may be based and cannot be held responsible for any errors. No liability is accepted by Barclays (or any of its affiliates) for any loss (whether direct or indirect) arising from the use of the information provided. Barclays is a trading name of Barclays Bank PLC and its subsidiaries. Barclays Bank PLC is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register No ). Registered in England. Registered number is with registered office at 1 Churchill Place, London E14 5HP. February BD of 6