Risk Insights
Practical perspectives on risk management, insurance, and recovery readiness for small and medium-sized businesses.
14 articles
FINRA Rule 4370: What Small Financial Firms Must Do by Year-End
FINRA's 2026 examination priorities make cybersecurity and business continuity testing non-negotiable. Firms without documented, tested BCPs face citations and fines—here's what small broker-dealers and introducing firms need to know.
The Cost of Not Having a Plan: Fines and Enforcement Actions Law Firms Now Face
Beyond bar discipline, a missing contingency or incident response plan now carries a direct, documented price tag — and regulators have started naming names.
5 Gaps That Undermine a Law Firm's Continuity Plan
Most law firms that have a continuity plan still wouldn't survive a bar complaint, a malpractice claim, or an actual emergency intact. Here's where the gaps usually are.
The New Mandatory Rules: Succession Planning Obligations Every Law Firm Should Know
The legal profession has no single regulator issuing continuity mandates. What it has instead is a web of ethics rules that, together, leave very little room for a firm to go without a written plan.
Hurricane Readiness: Protecting People, Cash Flow, and Customers
Hurricanes are sustained operational events, not single-day property events. Here's a practical framework for getting your organization — and its insurance, continuity, and crisis plans — ready before the season tests them.
The SEC's New BCP Expectations: What Every RIA Must Know in 2026
Examiners are no longer satisfied with static documents. Here's what a compliant, living business continuity plan looks like — and how to build one before your next examination.
The 5 BCP Mistakes That Trigger SEC Deficiency Letters
Most RIA deficiency findings are preventable. Here's what examiners find — and exactly how to fix it before they show up.
How AI is Transforming Business Continuity for Small RIAs
Smaller advisory firms face the same regulatory expectations as large institutions, with a fraction of the compliance staff. Here's how AI-powered planning tools are changing what's realistic for a small firm to maintain.
Why Smaller Utilities Are the Next Ransomware Target — and How to Prepare
Threat actors have discovered that municipal utilities, electric co-ops, and smaller IOUs offer high-impact targets with low defensive capability. Here's the threat landscape — and the BCP framework that can protect your operations.
Business continuity basics
Foundational answers about BCPs, ISO 22301, testing cadence, and how small businesses can start building a plan.
What is a business continuity plan?
A business continuity plan (BCP) is a documented set of procedures showing how an organization will keep critical operations running, or resume them quickly, during and after a disruption such as a natural disaster, cyberattack, or supply chain failure. It typically covers people, processes, technology, and communication.
What does ISO 22301 require?
ISO 22301 is the international standard for business continuity management systems. It requires organizations to identify critical activities through a business impact analysis, assess risks, document recovery strategies, test and exercise the plan regularly, and continually review and improve the program.
How often should a business continuity plan be tested?
Most organizations should test their business continuity plan at least once a year, with additional tabletop exercises after major changes to staff, vendors, technology, or facilities. Untested plans often fail during a real disruption because roles, contacts, or procedures have quietly gone out of date.
What should a small business include in its continuity plan?
A small business continuity plan should include a list of critical business functions, key contacts and backup staff, data backup and recovery steps, alternate work locations or remote-work procedures, and a clear communication plan for employees and customers during a disruption.
Why would a small or medium sized business need a business continuity plan?
SMBs are often less able to absorb an extended outage than large enterprises, and many now lose customers, contracts, or insurance coverage without a documented plan in place. A business continuity plan helps a smaller company recover faster and meet requirements increasingly set by lenders, insurers, and larger clients.
How do I write a business continuity plan step by step?
Start by identifying your critical business functions, then complete a business impact analysis to see how quickly each one needs to be restored. Document recovery strategies and responsible owners, build a communication plan, and finish by testing the plan and scheduling regular reviews to keep it current.