Morgan Stanley 2009 Annual Report Download - page 115

Business Continuity Management is an ongoing program of analysis and planning that helps ensure a recovery
strategy and required resources for the resumption of critical business functions following a disaster or other
business interruption. Disaster recovery plans are in place for critical facilities and resources on a company-wide
basis, and redundancies are built into the systems as deemed appropriate. The key components of the Company’s
disaster recovery plans include: crisis management; business recovery plans; applications/data recovery; work
area recovery; and other elements addressing management, analysis, training and testing.
The Company maintains an information security program that coordinates the management of information
security risks and satisfies regulatory requirements. Information security procedures are designed to protect the
Company’s information assets against unauthorized disclosure, modification or misuse. These procedures cover a
broad range of areas, including: application entitlements, data protection, incident response, Internet and
electronic communications, remote access and portable devices. The Company has also established policies,
procedures and technologies to protect its computers and other assets from unauthorized access.
The Company utilizes the services of external vendors in connection with the Company’s ongoing operations.
These may include, for example, outsourced processing and support functions and consulting and other
professional services. The Company manages its exposures to the quality of these services through a variety of
means, including service level and other contractual agreements, service and quality reviews, and ongoing
monitoring of the vendors’ performance. It is anticipated that the use of these services will continue and possibly
increase in the future.
Legal Risk.
Legal risk includes the risk of non-compliance with applicable legal and regulatory requirements and standards.
Legal risk also includes contractual and commercial risk such as the risk that a counterparty’s performance
obligations will be unenforceable. The Company is generally subject to extensive regulation in the different
jurisdictions in which it conducts its business (see “Business—Supervision and Regulation” in Part I, Item 1).
The Company has established procedures based on legal and regulatory requirements on a worldwide basis that
are designed to foster compliance with applicable statutory and regulatory requirements. The Company,
principally through the Legal and Compliance Division, also has established procedures that are designed to
require that the Company’s policies relating to conduct, ethics and business practices are followed globally. In
connection with its businesses, the Company has and continuously develops various procedures addressing issues
such as regulatory capital requirements, sales and trading practices, new products, potential conflicts of interest,
structured transactions, use and safekeeping of customer funds and securities, credit granting, money laundering,
privacy and recordkeeping. In addition, the Company has established procedures to mitigate the risk that a
counterparty’s performance obligations will be unenforceable, including consideration of counterparty legal
authority and capacity, adequacy of legal documentation, the permissibility of a transaction under applicable law
and whether applicable bankruptcy or insolvency laws limit or alter contractual remedies. The legal and
regulatory focus on the financial services industry presents a continuing business challenge for the Company.
111