Business Continuity Management: Business Continuity Preparedness

Best Practices
Lehman Brothers has instituted industry-leading best practices for business continuity. These best practices have been developed in conjunction with our internal audit, security, and technology groups, as well as external consultants. These best practices provide a guide for creating practical and effective business continuity plans. Lehman Brothers' processes are built with business continuity in mind, embedding the necessary resources and knowledge into our day-to-day operations.

Organization
Lehman Brothers has a dedicated Global Head of Business Continuity, who oversees the Firm's business continuity management strategy in the Americas, Europe and Asia. Regional, dedicated business continuity teams employ a standardized framework, throughout all Lehman Brothers locations, to address all business continuity issues. Our regional Business Continuity teams work closely with our business units, Information Technology, Corporate Security, Real Estate, and Human Resources to build and test business continuity plans.

Response
In the event of an incident rendering a Lehman Brothers location inaccessible, our strategy for continuing business is to ensure the safety and security of all employees first and second to continue critical business operations at predefined alternate sites.

To this end, Lehman Brothers has established incident management teams consisting of senior management and subject matter experts who will assess and direct our response to an incident. In addition, business unit continuity teams comprised of representatives from sales, trading, operations, regulatory, financial control, and technology, will provide continuity of critical business functions.

Integral to our business continuity strategy is employee awareness and training; employees are aware of their roles and responsibilities when business activities are disrupted.

Incidents of Varying Scope
The impact of a potential future business interruption is impossible to predict. Lehman Brothers' business continuity plans have been written to account for incidents of varying scope, including building-wide and city-wide disruptions. In all cases, the plans will allow Lehman Brothers to continue to do business, albeit at a reduced capacity, and meet its client obligations within the business day. Region-wide incidents, however, are far more complex and difficult to plan for. While Lehman Brothers plans to continue to do business regardless of the nature of the incident, recovery from a significant region-wide business disruption depends not only on the availability of alternate workspace, but also on the survival of telecommunications carrier infrastructure, mass transit capabilities, and firm personnel among other things.

In the event of a significant regional disruption, Lehman Brothers would leverage its world-wide footprint and out-of-region mainframe recovery to provide clients with access to accounts and funds. Redirection of main telephone numbers would provide clients with the ability to reach an out-of-region recovery site, wherever it may be.

Regulatory Requirements and Industry Standards
Lehman Brothers maintains regular contact with regulatory bodies such as the SEC, the Federal Reserve, and the Department of the Treasury to ensure that our business continuity plans meet or exceed industry requirements. Lehman Brothers is also an active participant in financial services industry groups dedicated to business continuity planning, including the Securities Industry and Financial Markets Association (SIFMA) and Futures Industry Association (FIA) business continuity committees.

Technology
Lehman Brothers employs a dual data center strategy to protect all critical client data and access to the data. Critical data is replicated in real time between data center sites to ensure that no data would be lost in the event of a failure.

The Firm's mainframe system is managed by a third-party provider who can recover data at an out-of-region data center.

Lehman Brothers has implemented a robust telecommunications infrastructure, using multiple vendors feeding circuits from multiple central offices to allow maximum network resiliency. In the event of a complete site failure, telephone numbers can be re-routed to an alternate Lehman Brothers branch.

Implementation, quality assurance and change management procedures are designed to incorporate disaster recovery readiness into our daily operations.

Lehman Brothers has identified an alternate location for each of its production sites. Should a site become unavailable, the alternate location will provide service to clients who would otherwise be affected.


Conclusions
True to our mission statement, our business continuity program ensures that we are One Firm — defined by our unwavering commitment to our clients, our shareholders, and each other.

Disclaimer
Lehman Brothers asserts that, to the best of its knowledge, all of the information contained in this document is accurate, and that Lehman Brothers has created business continuity plans that meet or in its opinion exceed, industry standards and regulatory requirements. In the event of an actual significant business disruption, Lehman Brothers will make every reasonable effort to enact these plans as written. However, the plans summarized above are highly dependent upon critical infrastructure and resources that Lehman Brothers maintains no control over, including, but not limited to: electricity, telecommunications, water, external exchanges, market utilities, and clearing houses. Furthermore, Lehman Brothers cannot guarantee that it will be able to fully implement the plans summarized herein if a significant business disruption results in substantial loss of life.