What should a solo RIA include in a business-continuity handoff?

A solo RIA's business-continuity handoff should explain what happens when the usual person, office or system is unavailable, who is authorized to act, and how clients and other parties will be contacted. Keep the plan usable without relying on the absent person's memory. A password list or an unsigned promise from another adviser is not a complete handoff.

This is an educational framework for US advisers, not a legal conclusion, emergency-response guarantee or substitute for applicable rules. State requirements and the firm's actual business model need qualified review.

Which disruptions should the plan distinguish?

Separate the loss of a person, a location and a system. The same backup may not solve all three.

An office closure may leave staff available but unable to reach normal equipment. A system outage may leave the adviser available but unable to view records. The adviser's incapacity can remove the person who normally decides what happens next. Write a scenario for each rather than using a broad instruction to "work remotely."

A planned retirement or firm sale is not the same as an unexpected interruption. The NASAA business-continuity and succession model rule and guidance discuss continuity and unexpected succession, including a key person's inability to perform functions. Use the relevant qualified review for a planned transaction separately.

A solo firm can begin with a small set of realistic scenarios. The goal is not to predict every disaster. It is to identify decisions that fail when the usual person or path disappears.

Does the NASAA model rule apply automatically to every RIA?

No. A model rule is not proof of the law adopted in the firm's jurisdiction. Check the applicable state and other requirements.

The NASAA document describes a plan based on the adviser's facts and circumstances, including size, services and locations. Its guidance also says state-specific requirements may differ from the model. Do not copy the phrase "every investment adviser shall" from the model and present it as a nationwide adopted requirement.

NASAA's continuity resources provide a starting point for the firm's compliance review. The task is to identify the actual rule, required contents and related obligations for the firm. Keep the source and reviewer in the internal plan.

This article does not provide a state-law matrix or classify the firm's registration status. It proposes a working handoff that can be reconciled with the applicable requirements.

What belongs in the handoff itself?

Record the scenario, first decisions, authorized person, alternate contact path and evidence needed to act. Keep sensitive access material in an appropriate controlled system, not in the public guide.

The map is a proposed organizing artifact, not a required regulatory form. An entry is incomplete if it names a person without establishing what that person can do. Mark that gap before relying on the arrangement.

How do you choose a backup without inventing authority?

Define the job and verify the arrangement before calling someone a backup. Friendship, familiarity or a casual acceptance does not settle access and responsibility.

Ask what the person would actually do: deliver status information, help restore a system, handle a defined administrative task or provide advisory work. Those roles raise different questions. Have qualified reviewers determine the agreements, registration, authorization and client considerations required for the proposed arrangement.

A fictional solo adviser, Avery, asks another professional to be an emergency contact. That person agrees to answer a call. Avery still needs to resolve what information may be shared, what authority the person has and which work cannot proceed. The agreement to answer is not treated as permission to manage accounts.

This invented example is not a recommended legal arrangement. It shows why the handoff should record the scope of help rather than merely list a name.

What should happen to records and access?

Identify the reviewed backup and recovery process, including who can use it and how current the recovered information is. A copied folder does not prove usable continuity.

The NASAA model guidance includes protection, backup and recovery of records and alternate means of communication. The firm's reviewers should reconcile those areas with the actual vendors, systems and policies. Test retrieval of harmless synthetic records rather than assuming a backup worked because a job reported success.

Do not solve continuity by sharing account passwords in an ordinary document or handing an unreviewed person an owner's credentials. Arrange access through approved mechanisms and the appropriate vendor or account processes. The plan should describe where authorized people find the instructions, not expose secrets to everyone who reads it.

Keep the status of the data visible. A restored record from before a disruption may miss later changes. Decide how the firm detects that gap and which decisions must wait for reconciliation.

What do clients need to hear during a disruption?

They need an accurate contact route and a clear explanation of what is known, what remains unavailable and how updates will be provided. Do not promise a recovery time without a grounded basis.

Prepare a message template that can be adapted to the actual event. It should not announce that assets are safe, access is restored or advisory work continues unless those statements have been verified. A template is preparation, not evidence of the event.

Decide who can update the website, phone message or other designated channel and how that authority is used if the adviser is unavailable. An alternate email address is not useful if nobody knows who checks it.

The SEC's 2013 risk alert following weather-related disruptions discusses staff observations about adviser continuity planning, including communication and operational issues. It is historical examination evidence, not a current incident report or a new rule. Use it to generate test questions rather than claim that every firm has the same defect.

How should vendors be included?

Record the vendor escalation path and the firm's own responsibilities. A vendor's recovery plan does not automatically cover the whole advisory business.

Identify what the vendor provides, which work depends on it and what information the firm needs if it stops. Check current contact details and the actual contract or support process. Keep a distinction between a vendor estimate and a commitment the firm can responsibly communicate.

Test dependencies that cross systems. A working telephone may not help if the contact list is only in an unavailable platform. A backup record may not be usable if the authorized person's access depends on the same failed device. The scenario test should follow the real path.

How can the handoff be tested safely?

Run a tabletop exercise with fictional facts and no real client instructions. Ask the designated people to find the plan and explain their next steps.

Use scenarios such as an unavailable office, a lost device or an unreachable adviser. Check whether the plan gives a usable alternate route and whether the role understands its limits. Do not make a real trade or disclose a client file simply to demonstrate that a handoff works.

The NASAA guidance suggests exercises and review when material facts change. Have the firm determine any required cadence under applicable rules; this article does not prescribe a universal annual-only schedule. Record the test date, observed gaps and changes that were actually retested.

Review again after changes to personnel, locations, systems, vendors or service scope. A plan can become stale while its file name still says final.

How does this fit ordinary operating work?

Continuity depends on a defined service process, but it is not simply another reminder automation. It asks who can continue the work when the ordinary path is gone.

The solo-RIA automation guide helps identify ordinary workflow ownership. The staged prospect-information guide addresses handling paths for collected information. The continuity map tests how those paths behave under disruption without assuming the same person remains available.

What does a completed handoff not prove?

It does not prove compliance, guarantee uninterrupted service or settle a succession arrangement. It makes the proposed response and unresolved permissions visible.

Keep legal, regulatory, access and client-communication gaps open until the appropriate reviewers resolve them. If the plan relies on one unavailable person's memory, the handoff is still incomplete even if every worksheet box contains text.

The bottom line

Prepare the action path before the disruption. Name the authorized person, alternate channel and records required, then test the handoff without using real client instructions. A backup is useful only when the people, permissions and process fit together.