Contingency Planning

Contingency planning prepares funding, operations, communications, and decision authority for plausible financial or business disruptions.

Contingency planning is the process of preparing specific actions, resources, funding, communications, and decision authority for a plausible disruption before it occurs. A useful plan states what triggers activation, who acts, which obligations receive priority, how operations continue, and how the organization returns to normal.

In finance, contingency planning often addresses cash shortfalls, loss of funding, payment or settlement disruption, counterparty failure, cyber incidents, unavailable staff or systems, and interruption of a critical service provider. It is a preparedness control, not a prediction that the event will occur.

Key Takeaways

  • A contingency plan links a defined disruption to triggers, actions, owners, resources, and recovery targets.
  • A list of risks is not a plan; decision authority and executable steps must be documented.
  • Funding, collateral, customer access, regulatory reporting, and critical counterparties may require separate actions.
  • Plans should be tested and updated when operations, systems, vendors, financing, or legal obligations change.
  • A contingency plan cannot replace adequate liquidity, resilient systems, internal controls, insurance, or capital.
TermMain purposeExample
Contingency planningPrepare actions for a plausible adverse eventAlternative funding and payment procedures
Business continuity planningKeep critical services operating through disruptionShift processing to a recovery site
Disaster recoveryRestore technology and dataRecover systems from backup
Incident responseContain and manage a specific incidentIsolate compromised systems and notify owners
Risk mitigationReduce, transfer, avoid, or retain exposureAdd controls, insurance, collateral, or limits
Risk retentionDeliberately bear a defined loss layerFund a deductible from available cash

These activities overlap, but they are not interchangeable. Restoring a server does not by itself explain how customer payments, collateral calls, payroll, or regulatory reporting will be handled while the server is unavailable.

Core Elements of a Financial Contingency Plan

Scenario and Scope

Describe a disruption that is severe enough to require a different operating mode. The scenario should identify affected legal entities, locations, systems, products, customers, currencies, counterparties, and time horizons.

Activation Triggers

Triggers should be observable. Examples include:

  • available liquidity falling below a stated threshold
  • loss of a critical payment or trading system
  • failure of a bank, clearing member, custodian, or vendor
  • a cyber event affecting customer or transaction records
  • unavailable premises or key staff
  • a downgrade, covenant event, or collateral call

An escalation threshold can be earlier than the formal activation trigger so management has time to respond.

Roles and Authority

The plan should identify an accountable executive, decision team, alternates, contact methods, spending and transaction authority, and the circumstances in which normal approvals can be modified.

Resources and Actions

Actions may include drawing committed facilities, mobilizing collateral, postponing discretionary payments, switching service providers, moving staff, restoring data, communicating with customers, and making required regulatory reports. Each action needs prerequisites and an owner.

Recovery and Exit

Define service priorities, recovery targets, reconciliation steps, backlog handling, and who decides that normal operations can resume. Recovery includes verifying data and transactions, not simply restarting a system.

Worked Example: Funding Disruption

Assume a company normally has:

  • 6 million dollars of available cash
  • a 10 million dollar committed credit facility
  • projected peak 30-day outflows of 12 million dollars
  • a policy trigger when available liquidity falls below 1.25 times projected peak outflows

Current available liquidity is 16 million dollars, and the trigger level is:

1.25 x 12 million = 15 million dollars

The buffer above the trigger is only 1 million dollars. If a delayed customer payment reduces expected cash by 2 million dollars, the plan should activate its escalation stage rather than wait for a missed obligation.

Possible actions include confirming facility availability, prioritizing payments, reviewing collateral needs, contacting the lender, delaying discretionary spending, and updating the cash forecast daily. The company must still consider covenants, draw conditions, bank counterparty risk, and whether multiple customers could delay payment at the same time.

Financial Evidence to Maintain

  • daily or weekly cash-flow forecast
  • bank balances and signatory access
  • committed and uncommitted facility terms
  • debt maturities, covenants, and collateral requirements
  • payment, clearing, custody, and settlement dependencies
  • critical vendor and counterparty contacts
  • customer-funds or asset-access procedures
  • regulatory and contractual notification requirements
  • test results, incidents, lessons learned, and open remediation

The source records should be accessible during the disruption, including when the primary network or premises are unavailable.

Testing the Plan

A tabletop discussion can test decisions and communications. A simulation can test system recovery, remote access, transaction processing, or alternate providers. Testing should produce evidence:

  • which trigger was used
  • whether contacts and authority were current
  • how long each critical action took
  • which dependencies failed
  • whether reconciliations were complete
  • who owns remediation and its deadline

A plan that has never been exercised may contain assumptions that fail under stress.

Common Mistakes

  • Using broad language such as “seek alternative funding” without naming sources or draw conditions.
  • Assuming insurance proceeds or asset sales will arrive immediately.
  • Testing technology while ignoring cash, collateral, customer, and counterparty effects.
  • Relying on one person, bank, site, vendor, or communication channel.
  • Omitting service restoration, reconciliation, and return-to-normal criteria.
  • Treating a regulatory template as a substitute for organization-specific analysis.

Do Not Confuse the Term

A contingency plan is different from an accounting contingent liability, which concerns a possible obligation under the applicable accounting framework. It is also different from a reserve fund, although available reserves may support a response.

Official Sources

FINRA Rule 4370 applies to FINRA member firms. Other organizations and jurisdictions may have different contractual, regulatory, fiduciary, or operational requirements.

  • Operational Risk: The process, system, people, third-party, and external-event failures for which response and recovery may be needed.
  • Liquidity Risk: The risk that cash, funding, collateral, or market capacity is unavailable when obligations must be met.
  • Risk Mitigation: Actions that change exposure before a disruption or reduce its consequences.
  • Risk Retention: The deliberately retained loss layer that may require reserves, liquidity, capital, or response capacity.
  • Financial Risk Management: The broader governance process connecting exposure, limits, controls, monitoring, and escalation.

FAQs

What is the difference between contingency planning and risk mitigation?

Risk mitigation changes the exposure or its consequences. Contingency planning prepares actions if a defined disruption occurs or a mitigation fails. One control can serve both purposes, but the decision logic is different.

How often should a contingency plan be reviewed?

Review should follow material changes in operations, systems, vendors, financing, locations, or obligations. Regulated entities may also have prescribed review or testing requirements.

Is a cash reserve a contingency plan?

No. Cash can be a resource within the plan, but the plan must also define triggers, authority, payment priorities, communications, operational actions, and recovery.

Educational Use

This article provides general financial education. It is not personalized business-continuity, investment, legal, regulatory, banking, accounting, or emergency-management advice.

Browse Risk Management