Business Continuity Plan

A Category III AIF leans on technology. It also leans on a small team of people. What happens if either one fails?

The workbook calls this an operational risk: loss from weak systems and controls, human error, or bad management. Its fix is simple to state. A Category III AIF needs adequate business continuity plans and disaster recovery plans for its own work. The fund also relies on third parties, such as sub-advisors or the fund administrator. So those third parties need good plans of their own too.

The workbook does not attach a specific figure, timeline or standard to what makes a Business Continuity Plan "adequate" — it is a qualitative expectation, not a numeric one.

Two separate places in the workbook flag the same idea from different angles:

• Under Operational Risk, the concern is the fund's information systems and facilities, which may be exposed to employee error, malfeasance or security threats — and the fund's reliance on third parties for parts of its operations.
• Under Business Continuity and Disaster Recovery Plans, listed separately as a due-diligence risk factor, the trigger named is a material Key-Person event or a natural disaster. Institutional investors doing due diligence are expected to check that the fund has plans addressing both.

Illustrative figures — the workbook attaches no target recovery time to a Business Continuity Plan. Vindhya Alpha Fund runs its trading desk from a single Mumbai office. Heavy rain floods the building's basement, and the desk loses power and network connectivity at 10:30 AM on a trading day.

Under its Business Continuity Plan, Vindhya fails over its 6-member trading and risk team to a pre-arranged backup site in Navi Mumbai. Trading and position-monitoring resume there by 1:00 PM the same day — a recovery window of 2.5 hours — with no order left unexecuted overnight.

The plan separately names a successor for the fund's sole senior portfolio manager. If that manager becomes unavailable — the workbook's own trigger for a Key-Person event — the successor takes over investment decisions within the same working day. Vindhya's fund administrator, a third party, maintains its own separate business continuity and disaster recovery plans, since Vindhya's own operations depend on that provider staying functional too.

Chapter 7 (Category III AIF Investment Strategies and Due Diligence Process) lists Business Continuity and Disaster Recovery Plans as a due-diligence risk factor, triggered by Key-Person events or natural disasters. Operational Risk, in the Chapter 5 or 6 risk-factors discussion, repeats the requirement for the fund and its key third parties. Expect a question naming the two trigger events — Key-Person events and natural disasters — rather than any numeric standard, since the workbook gives none.

• The workbook gives no specific figure for Business Continuity Plans — no required recovery time, no minimum standard. Do not invent one.
• The requirement extends to key third parties, not just the fund itself — a fund administrator or sub-advisor without its own plan is a gap in the fund's own continuity, not a separate issue.
• Do not confuse Business Continuity Plan with Key-man Insurance — a BCP is an operational and procedural plan; Key-man Insurance is a financial product that compensates the fund for losses from a key person's death or incapacity. A fund can (and the workbook suggests should) have both.