Attacks Severely Affected Financial Markets but Heroic Efforts Were Made to Restore Operations

Although the facilities of the stock and options exchanges and clearing  organizations in lower Manhattan were largely undamaged by the attacks,  many market participants were affected by the loss of telecommunications  and lack of access to lower Manhattan. In addition, connectivity between market participants and exchanges had  not been tested. Disruptions in Government Securities and Money Markets Severely Affected Clearance and Settlement, Liquidity, and Trade Volumes

The attacks also severely disrupted the markets for government securities  and money market instruments primarily because of the impact on the  broker-dealers that trade in the market and on one of the key banks that  perform clearing functions for these products. For example, some firms had difficulties in locating  key staff in the confusion after the attacks. Financial Market Participants Have Taken Actions to Reduce Risks of Disruption, but Some Limitations Remain

Since the attacks, exchanges, clearing organizations, ECNs, and payment  system processors implemented various physical and information security  measures and business continuity capabilities to reduce the risk that their  operations would be disrupted by attacks, but some organizations  continued to have limitations in their preparedness that increases their risk  of disruption. However, at the time we  conducted our review, 9 of the 15 organizations, including 2 we considered  critical to the functioning of the financial markets, had not taken steps to  ensure that they would have the staff necessary to conduct their critical  operations if the staff at their primary site were incapacitated—including 8  organizations that also had physical vulnerabilities at their primary sites. If a wide- scale disaster caused damage or made a region greater than these distances  inaccessible, these 4 organizations would be at greater risk for not being  able to resume operations promptly. The remaining 6  organizations faced increased risk of being disrupted by a wide-scale  disaster because 4 lacked backup facilities, while 2 organizations had  backup facilities that were located 4 to 10 miles from their primary  operations facilities. 3 of this report). SEC and SROs Generally Did Not Review Physical and Information System Security and Business Continuity at Broker- Dealers

SEC and the securities market SROs generally have not examined broker- dealers’ physical and information system security and business continuity  efforts, but planned to increase their focus on these issues in the future. However, the bank regulators’ guidance did  not specifically address measures to protect facilities from terrorist or  other physical attacks. Conclusions

Financial market regulators have begun to develop goals and a strategy for  resuming operations along with sound business continuity practices for a  limited number of organizations that conduct clearing functions. Given the increased threats demonstrated by the September 11 attacks and  the need to ensure that key financial market organizations are following  sound practices, securities and banking regulators’ oversight programs are  important mechanisms for ensuring that U.S financial markets are resilient.
Why GAO Did This Study

September 11 exposed the vulnerability of U.S. financial markets to wide-scale disasters. Because the markets are vital to the nation's economy, GAO assessed (1) the effects of the attacks on market participants' facilities and telecommunications and how prepared participants were for attacks at that time, (2) physical and information security and business continuity plans market participants had in place after the attacks, and (3) regulatory efforts to improve preparedness and oversight of market participants' risk reduction efforts.

What GAO Found

The September 11 attacks severely disrupted U.S. financial markets, resulting in the longest closure of the stock markets since the 1930s and severe settlement difficulties in the government securities market. While exchange and clearing organization facilities were largely undamaged, critical broker-dealers and bank participants had facilities and telecommunications connections damaged or destroyed. These firms and infrastructure providers made heroic and sometimes ad hoc and innovative efforts to restore operations. However, the attacks revealed that many of these organizations' business continuity plans (BCP) had not been designed to address wide-scale events. GAO reviewed 15 organizations that perform trading or clearing and found that since the attacks, these organizations had improved their physical and information security measures and BCPs to reduce the risk of disruption from future attacks. However, many of the organizations still had limitations in their preparedness that increased their risk of being disrupted. For example, 9 organizations had not developed BCP procedures to ensure that staff capable of conducting their critical operations would be available if an attack incapacitated personnel at their primary sites. Ten were also at greater risk for being disrupted by wide-scale events because 4 organizations had no backup facilities and 6 had facilities located between 2 to 10 miles from their primary sites. The financial regulators have begun to jointly develop recovery goals and business continuity practices for organizations important for clearing; however, regulators have not developed strategies and practices for exchanges, key broker-dealers, and banks to ensure that trading can resume promptly in future disasters. Individually, SEC has reviewed exchange and clearing organization risk reduction efforts, but had not generally reviewed broker-dealers' efforts. The bank regulators that oversee the major banks had guidance on information security and business continuity and reported examining banks' risk reduction measures annually.