Summary
This is GAO's third report since the September 11 terrorist attacks that assesses progress that market participants and regulators have made to ensure the security and resiliency of our securities markets. This report examined (1) actions taken to improve the markets' capabilities to prevent and recover from attacks; (2) actions taken to improve disaster response and increase telecommunications resiliency; and (3) financial regulators' efforts to ensure market resiliency. GAO inspected physical and electronic security measures and business continuity capabilities using regulatory, government, and industry-established criteria and discussed improvement efforts with broker dealers, banks, regulators, telecommunications carriers, and trade associations.
The critical securities markets organizations GAO reviewed have acted to significantly reduce the likelihood of physical disasters disrupting the functioning of U.S. securities markets. As of January 2007, the seven critical exchanges, markets, clearing organizations, and payment processors GAO reviewed have the capability of performing their critical functions at sites that are geographically dispersed from their primary sites. These organizations were also preparing plans to reduce the likelihood that a disease pandemic will disrupt their critical operations, although not all had fully completed such efforts. They also improved their physical and information security measures, including by taking actions that GAO identified during this review. Although key securities trading staff remain concentrated in single locations, the broker-dealers and clearing services banks that account for significant trading volumes and that GAO reviewed have increased the distances between their sites for primary and backup operations for clearance and settlement activities and established dispersed backup trading locations. Various private and public sector groups continued to enhance the preparedness of the financial sector, although resolving vulnerabilities in the telecommunications infrastructure remains a challenge. Securities industry organizations have continued to conduct annual industrywide tests of financial market participants' backup site operating capabilities, and key trading and clearing organizations are increasingly using communications networks that are less vulnerable to disruption to transmit information. After attempts to assist individual financial market participants to determine whether their own telecommunications lines were routed through single paths or switches proved difficult, regulators are assisting efforts to develop automated systems for identifying circuit paths. In response to concerns over whether the telecommunications infrastructure can absorb the increased demand likely to result from large numbers of organizations and individuals seeking to telecommute during a pandemic, financial regulators and market participants are assisting government efforts to model such events and develop potential solutions. To improve market resiliency, financial regulators established goals for prompt recovery of critical clearing activities after disasters and have been conducting examinations to ensure market participants' compliance. Securities regulators also set goals and are examining securities markets' readiness to resume trading and plan to do more focused reviews of individual broker-dealer capabilities. The Securities and Exchange Commission (SEC) also has improved its program for overseeing operations issues at market and clearing organizations, including increasing its staffing levels and expertise. Securities and banking regulators have been actively addressing pandemic issues, but could better ensure that market participants prepare complete plans and have sufficient time to train employees and test these plans, by providing formal expectations that plans address even severe outbreaks and set dates for completing such plans.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director:
Team:
Phone:
No director on record
No team on record
No phone on record
Recommendations for Executive Action
Recommendation: To increase the likelihood that the securities markets will be able to function during a pandemic, the Chairman, Federal Reserve, the Comptroller of the Currency, and the Chairman, SEC, should consider taking additional actions to ensure that market participants adequately prepare for an outbreak, including issuing formal expectations that business continuity plans for a pandemic should include measures likely to be effective even during severe outbreaks, and setting a date by which market participants should have such plans.
Agency Affected: Department of the Treasury: Office of the Comptroller of the Currency
Status: Closed - implemented
Comments: In December 2007, OCC, in conjunction with the Federal Financial Institutions Examination Council, issued an Interagency Statement on Pandemic Planning to the national banks. The statement directed those banks to ensure the pandemic plans they have in place are adequate to maintain critical operations during a severe outbreak. Specifically, the institution's business continuity plan (BCP) address pandemics and provide for a preventive program, a documented strategy scaled to the stages of a pandemic outbreak, a comprehensive framework to ensure the continuance of critical operations, a testing program and an oversight program to ensure that the plan is reviewed and updated. According to the OCC liaison, these plans were to be in place by the end of 2007, and in late 2007 OCC staff had begun reviewing banks compliance with this compliance. By December 31, 2007, their staff had reviewed the plans of the key banks that participant in the securities markets and confirmed that these organizations' plans addressed the items required by the guidance.
Agency Affected: Federal Reserve System
Status: Closed - implemented
Comments: In December 2007, the Federal Reserve, in conjunction with the Federal Financial Institutions Examination Council, issued an Interagency Statement on Pandemic Planning to each Federal Reserve Bank and to all banking organizations supervised by the Federal Reserve. These plans were to be in place by the end of 2007. The statement directed those banks to ensure the pandemic plans they have in place are adequate to maintain critical operations during a severe outbreak. Specifically, the institution's business continuity plan (BCP) address pandemics and provide for a preventive program, a documented strategy scaled to the stages of a pandemic outbreak, a comprehensive framework to ensure the continuance of critical operations, a testing program and an oversight program to ensure that the plan is reviewed and updated. According to Federal Reserve officials, examiners began incorporating the new guidance, including the expectation that plans be in place, into exams occuring after December 2007.
Agency Affected: Securities and Exchange Commission
Status: Closed - implemented
Comments: In July and August of 2007, SEC's Market Regulation Division issued letters to the major clearing organizations and exchanges-those covered by the Commission's 2003 Policy Statement on Business Continuity Planning for Trading Markets-that directed these organizations to confirm by year-end 2007 that their pandemic plans are adequate to maintain critical operations during a severe outbreak. Specifically, the institution's business continuity plan (BCP) address pandemics and provide for a preventive program, a documented strategy scaled to the stages of a pandemic outbreak, a comprehensive framework to ensure the continuance of critical operations, a testing program and an oversight program to ensure that the plan is reviewed and updated.
