If the Family Office Goes Offline, Who Keeps the Critical Work Moving?

A family office business continuity plan is credible when it lets the team make the next authorized decision without its usual person, system or office—and later prove what happened. A backup can restore a file. It cannot decide whether a capital call is genuine, whether a substitute may sign a payment, or what the family should be told while values are incomplete.

This guide tests one fictional Monday-to-Wednesday systems interruption, followed by Thursday payment and Friday reporting decisions. The numbers, deadlines and recovery targets are illustrative office choices, not provider guarantees. The exercise exposes where a plan relies on one login, one person or an undocumented exception before an actual disruption does.

01Decide Which Family-Office Work Cannot Wait

Start with a business impact analysis, not a list of hazards. Ask what happens if a function stops for four hours, one day or three days: which obligation becomes late, which person loses essential support, and which decision cannot be reconstructed afterward? Ready.gov's business-impact guidance connects the consequences of disruption to recovery strategy.

For a family office, critical work may sit across bank accounts, trust entities, investment partnerships, property companies and personal support arrangements. The order depends on the family's obligations and contracts. A family report can often wait; a payroll run, medical support payment or capital-call deadline may not. The plan needs the legal entity and account for each task, because an alternate cannot move money merely because the family office coordinates it.

Write down four thresholds for every critical process:

• Maximum tolerable interruption: when the delay harms the family, staff, an asset or a contractual position.
• Recovery time objective (RTO): the office's target for resuming that process, chosen from the impact analysis—not a promise that every provider will meet it.
• Recovery point objective (RPO): the maximum tolerable data-loss window, measured from the last recoverable point. A restored backup can still miss later approvals, which must be reconciled from external records.
• Manual-mode limit: what can be done without the normal system, who authorizes it and when the office must stop.

Do not use an arbitrary “all systems back within 24 hours” target. Payments, confidential documents and portfolio reporting depend on different systems and providers. Ready.gov separates IT recovery from the wider continuity plan; the latter also needs people, alternate work methods and communications.

02Write the Authority and Recovery Map

A useful plan fits on a live contact and authority map. Name a continuity lead, a substitute, the legal actor for each entity, the bank or provider contact, the source record, and the person who can approve an exception. Store an accessible protected copy outside the affected system. Test that it can be opened without exposing credentials or sensitive family data to personal accounts.

An alternate is not a new power of attorney or a substitute trustee by job title alone. Counsel and each bank or custodian must confirm the actual documents and account permissions. If a key authority is unavailable and no valid alternate exists, the plan must include a hold and escalation path, not an improvised signature. A separate succession plan handles lasting leadership change; this continuity map handles the immediate operational interval.

The office also needs an incident trigger: who declares the plan active, who records time and scope, who contacts cyber/IT help, and who decides whether ordinary channels are unsafe. Keep a call tree with an offline copy, alternate numbers and one source of status updates. Do not share payment instructions or sensitive portfolio data over an unverified channel just because the usual platform is down.

03Run a Three-Day Outage Through Actual Decisions

In the fictional Rowan office, a systems outage is discovered Monday morning and the CFO is unreachable. The outage lasts through Wednesday; Thursday and Friday test whether restored records are fit for use. A US$400,000 private-fund capital call is due Wednesday; property-company payroll and a material vendor payment are due Thursday; a family investment report is expected Friday. Assume no evidence yet that the outage is limited to one system. This is an exercise, not a prediction of what any real provider will do.

The continuity lead should open a dated incident record and decide which channels remain trustworthy. The team then tests each work item against the same questions: Is the obligation real? Does this entity have cleared cash? Who may approve it? Is the payee instruction independently verified? What evidence will be retained?

Rowan writes provisional exercise targets before the drill. Each RTO is the time by which a process must work through a tested fallback, distinct from the outside payment or report deadline. Each RPO is a time-based limit for the named data set, distinct from the proof required before action. Unknown means the office still has to test the source and provider; these are not bank or vendor guarantees.

The Monday decision record keeps the action gate separate from those recovery targets:

A target is met only if the drill proves that the fallback actually works and the recoverable point meets its RPO. A capital-call transfer stays held until notice, terms, destination, entity cash, investment approval, bank mandate and second check are verified. If a gate is unavailable, request an extension; only the fund counterparty can grant it. Confirm actual bank and processor cutoffs before adopting the sample times.

The first two days are not a race to pay everything. They are a race to preserve the right decision path while deadlines are visible. The incident log should show who checked each source, who approved or held a transaction, when the counterparty was contacted and what changed. A rejected payment is a successful control outcome if the instruction cannot be authenticated.

04Restore the Records Without Releasing a Bad Payment

IT recovery and business recovery meet at reconciliation. A clean-looking restored database may predate a fund notice, bank approval or payroll adjustment. After restoration, compare the last trusted backup with bank and provider records; replay only supported transactions; and inspect any manual-mode actions before allowing the normal workflow to resume. Ready.gov's IT recovery guidance emphasizes backups and restoration planning, but a recovered file alone is not proof that every transaction is correct.

For Rowan, the controller should account for every action taken during the outage: the capital-call notice and decision, any initiated or rejected bank instruction, the payroll run, vendor changes and the family message. Mark each reconciled, disputed or awaiting source. The approver should not sign a normal Friday report merely because the reporting system opens again.

The plan should also define how the office communicates a material delay: what is known, what is not yet verified, which deadline is at risk, who owns the next action and when the family will hear again. The message must avoid declaring the incident resolved before access, data and decision records have been checked.

05Test, Record and Maintain the Plan

Run a tabletop test with actual role-holders and at least one absent decision-maker. Do not move real money in the exercise. Ask participants to locate the offline contact map, the current bank mandates, a sample fund notice, a vendor-change procedure, the backup restore record and the family update template. A plan that names an alternate who cannot reach the records has failed a useful test.

Assign each failure an owner, due date and retest. Recheck the plan when entities, banks, signers, technology providers or key people change, and at a regular interval chosen by the office. Ready.gov recommends organizing a continuity team and testing the plan.

If the office is itself a FINRA member firm, FINRA Rule 4370 and its guidance create specific business-continuity obligations. That rule does not automatically apply to every family office. Counsel and compliance staff should map the actual registration, adviser and provider obligations before treating a generic template as compliance.

The useful deliverable is a short, maintained decision-and-proof map: critical task, deadline, entity, primary and alternate authority, trusted source, fallback channel, RTO/RPO, stop condition and evidence owner. The plan works when a missing person or system changes the route—but does not change who is allowed to decide or what proof the office needs before acting.