	Market Participants and Infrastructure Providers Employed Innovative Solutions to Restore Trading

The September 11, 2001, terrorist attacks had a devastating effect on the  U.S. financial markets with significant loss of life, extensive physical  damage, and considerable disruption to the financial district in New York. Although most stock exchanges and clearing organizations escaped direct  damage, the facilities and personnel of several key broker-dealers and  other market participants were destroyed or displaced. Attacks Revealed Limitations in Market Participants’ Preparedness for Wide-scale Disasters, and Some Limitations Remain

Although financial market participants, regulators, and infrastructure  providers made heroic efforts to restore the functioning of the markets as  quickly as they did, the attacks and our review of 15 key financial market  organizations—including 7 critical ones—revealed that financial market  participants needed to improve their business continuity planning  capabilities and take other actions to better prepare themselves for  potential disasters. The 15 stock exchanges, ECNs, clearing organizations, and payment  systems we reviewed had implemented various physical and information  security measures and business continuity capabilities both before and  since the attacks. Although these organizations have taken steps to reduce the likelihood  that their operations would be disrupted by physical or electronic attacks  and had also developed plans to recover from such events, we found that  some organizations continued to have some limitations that would  increase the risk of their operations being impaired by future disasters. Regulators Have Addressed Operations Risks but Have Not Developed Complete Strategies and Practices to Better Assure Recovery of Trading

Securities and banking regulators have made efforts to examine  operations risk measures in place at the financial market participants they  oversee. Regulators also have begun efforts to improve the resiliency of clearing  and settlement functions for the financial markets. The U.S. economy has demonstrated that it can  withstand short periods during which markets are not trading. SEC’s Automation Review Policy Program Could Be Strengthened

Given the increased threats demonstrated by the September 11 attacks and  the need to assure that key financial market organizations are following  sound practices, securities and banking regulators’ oversight programs are  important mechanisms to assure that U.S. financial markets are resilient. In addition, the intervals between examinations were  sometimes long.
Why GAO Did This Study

The September 11, 2001, terrorist attacks exposed the vulnerability of U.S. financial markets to wide-scale disasters. Because the markets are vital to the nation's economy, GAO's testimony discusses (1) how the financial markets were directly affected by the attacks and how market participants and infrastructure providers worked to restore trading; (2) the steps taken by 15 important financial market organizations to address physical security, electronic security, and business continuity planning since the attacks; and (3) the steps the financial regulators have taken to ensure that the markets are better prepared for future disasters.

What GAO Found

The September 11, 2001, terrorist attacks severely disrupted U.S. financial markets as the result of the loss of life, damage to buildings, loss of telecommunications and power, and restrictions on access to the affected area. However, financial market participants were able to recover relatively quickly from the terrorist attacks because of market participants' and infrastructure providers' heroic efforts and because the securities exchanges and clearing organizations largely escaped direct damage. The attacks revealed limitations in the business continuity capabilities of some key financial market participants that would need to be addressed to improve the ability of U.S. markets to withstand such events in the future. GAO's review of 15 stock exchanges, clearing organizations, electronic communication networks, and payments system providers between February and June 2002 showed that all were taking steps to implement physical and electronic security measures and had developed business continuity plans. However, some organizations still had limitations in one or more of these areas that increased the risk that their operations could be disrupted by future disasters. Although the financial regulators have begun efforts to improve the resiliency of clearance and settlement functions within the financial markets, they have not fully developed goals, strategies, or sound practices to improve the resiliency of trading activities. In addition, the Securities and Exchange Commission's (SEC) technology and operations risk oversight, which is increasingly important, has been hampered by program, staff, and resource issues. GAO's report made recommendations designed to better prepare the markets to deal with future disasters and to enhance SEC's technology and operations risk oversight capabilities.