The key elements of this BCP include:

1. Identification of the impact of a range of potential disasters or disruptions on:

• • key business functions;
  • employees;
  • premises;
  • systems;
  • records;

2. Procedures to mitigate, respond to, and recover from a potential disaster or disruption;
3. Communication within WAPC, with key service providers, and with clients;
4. Processes for the “back-up” of key [firm] records;
5. Alternate site(s) for the resumption of operations;
6. Assessment of the adequacy of WAPC’s outside service providers used for key functions;
7. Plans for updating, and testing the effectiveness of the BCP.

Firm Information

Summary Business Description

WAPC is a Canadian based investment management firm that works primarily with high net worth families providing risk-managed investment oversight, review and asset allocation.

The firm’s Family Office Investment Program (FOIP) includes investment audit and review, centralized custody and reporting, institutional level investment due diligence, manager search and selection and the use of Passive, Active, Private and Risk-Managed strategies.

Critical Business Processes & Procedures

Given the nature of WAPC’s business as described above, the critical issues in servicing clients are:

Maintaining our relationship with our clients, including maintaining communication channels to allow clients to reach WAPC and WAPC to reach clients.

Maintaining our ability to manage our clients’ portfolios, including, where required, the ability to buy and sell securities for our clients. This is WAPC’s primary service obligation to our clients at all times.

Our BCP focuses on maintaining and recovering our ability to provide these services in a timely manner as our top priority. Other aspects of WAPC’s operations are less critical and time sensitive.

We believe that the maintenance of appropriate communication channels (see “Communication Channels”) allows WAPC to maintain our relationship with clients.

As outlined in “Critical Service Providers”, however, the key responsibility for WAPC in this area is the maintenance of access and connectivity to service providers, systems and applications. We believe that the maintenance of appropriate communication channels will allow WAPC to fulfill these obligations.

Primary BCP Contacts

Contact information for the BCP Team, as well as all other WAPC members, should be reviewed and updated regularly.

1.1.1 BCP Ownership
Responsibility for implementation of the BCP, WAPC ’s ability to provide service to clients and maintenance of operations rests the Chief Operating Officer (COO).

Ownership of the BCP specifically shall belong to the COO. The COO will be responsible for reviewing, revising and updating the BCP as necessary.

1.1.2 BCP Team

BCP Lead

As above, the COO shall be designated the BCP Lead. In addition to the duties associated with ownership of the BCP, the BCP Lead shall initiate all response plans, unless he is incapacitated or otherwise unable to do so.

BCP Support

All other members of WAPC shall act as BCP Support in the event of an Adverse Event occurring. They will provide support and services as directed by the BCP Lead.

Third-Party Service Providers

The third-party services used by WAPC have been separated into two categories, critical and non-critical, based on the potential effect suffered due to a loss of service. A list of third-party providers and relevant contact information shall be maintained.

1.1.3 Critical Service Providers

These services, if affected, present potential issues concerning client data and the effective everyday functioning of the firm. A loss of these services cannot be immediately replaced.

In determining what constitutes a “critical service provider”, WAPC considers degree of reliance (both number of services provided and the importance of those services), availability of alternatives, speed of access to alternatives, and most importantly, magnitude of the potential negative impact during an Adverse Event if the relationship is disrupted. Based on these criteria, WAPC’s service providers which warrants the designation as a critical service provider are:

Fidelity Clearing Canada ULC – is a carrying broker and provides execution, clearing, custody and back-office support services to Canadian brokerages and portfolio management firms.

National Bank Independent Network – is a carrying broker and provides execution, clearing, custody and back-office support services to Canadian brokerages and portfolio management firms.

Ndex Systems – supports WAPC’s Portfolio Management, Customer Relationship Management, Securities Management, Trade Order Management, Compliance, Fee Management, Operations and Reporting.

SS&C Advent – supports WAPC’s Portfolio Management, Customer Relationship Management, Securities Management, Trade Order Management, Compliance, Fee Management, Operations and Reporting.

SGGG Fund Services Inc. – provides fund valuation and recordkeeping.

1.1.4 Non-Critical Service Providers

While a loss of service would create an inconvenience in the firm’s activities, these services do not pose a threat to client information and confidentiality. Should one of these services become unavailable to WAPC, it can be readily replaced by another service provider with minimal impact on the firm. Non-critical service providers are:

Telephone / Internet – Shaw Communications

Office Structure

1.1.5 Physical Location

WAPC’s head office is located at: 201 Portage Avenue 25th Floor, Winnipeg, MB R3B 3K6.

Key contacts for access to the building, and updates on the status of the building, building safety, building utilities and building services and systems during an Adverse Event are found in Schedule A to this Appendix.

1.1.6 Alternate Sites
During an Adverse Event in which access to our primary location was unavailable, the principals of WAPC would work from their respective home offices.

Each home office is equipped with necessary computer equipment and peripherals, and telephone and high-speed internet access.

Responding to a Disruption Event

Adverse Events

For purposes of this BCP, we have characterized the range of potential disasters and disruptions, collectively, as “Adverse Events”.

1.1.7 Impact of Adverse Events

WAPC must plan for various types of events. The Adverse Events have been separated into three categories based on their impact on WAPC’s operation. They are:

• Internal: Affecting only WAPC e.g. failure of our computer or phone system, or incapacitation of an employee;
• Local: Affecting the building or block. e.g. a fire or attack on our building; and
• Broad: Affecting critical infrastructure over a wide area. e.g. power outage or collapse of entire phone network.

By their nature, the Broad Adverse Events create a greater impact, as not just primary, but alternate sites and communication channels may be impacted. As well, the operations of key service providers and others we do business with may also be impacted.

Invocation of the BCP

The BCP shall be consulted and put into operation upon the occurrence of any of the above adverse events, being internal, local or broad, or upon any of the above critical business process and procedures being affected.

Upon an Adverse Event occurring, the COO shall make the determination of what actions are required. Each Adverse Event is going to involve a unique set of circumstances, so the response must be tailored to each. See Schedule A to this Appendix for a general response plan to Internal, Local and Broad Adverse Events.

Communication Channels

Our primary communications channels serving our primary location are telephone, cell phone (phoning and texting) and internet (email) access.

All telephone calls to the primary contacts are twinned to their WAPC business phone and cell phone. In addition, all voice messages left on the business phone line are forwarded to the individual’s email account.

WAPC’s phone message system is not physically resident in our office, meaning that messages left by clients or service providers on our primary phone numbers can be accessed remotely by voice-message and email. The message greeting heard by callers can be changed remotely, allowing us to customize the message to the circumstances of the Adverse Event, and pass on pertinent alternative contact information to clients, service providers, or other callers.

Primary email accounts can be accessed remotely through a third-party service provider allowing us to receive and send email communications to and from our primary accounts from any location where internet access is available.

If an event affects normal business operations, the principals shall determine to what extent communication needs to be provided. This may be limited to each other if the event is relatively minor, or made broadly to all employees, clients and other related parties in the event of a major disruption. Communication will be made via email and/or phone as appropriate in the circumstances. This notification shall be sent as soon as reasonably possible and outline the circumstances of the situation, the changes being made and the effect on the firm.

Back-Up of Records

WAPC’s office documents are hosted by secured file servers & are included with Wellington-Altus Private Wealth Inc.’s backup and disaster recovery plan with secure replication to offsite datacenters. These files would include trade records, fund correspondence, and fund reports. Backups can be utilized for WAPC’s operations at alternate locations and can also be used to recover from an Adverse Event and repopulate files and records at the primary location if they are lost or damaged.

Cybersecurity

Cyber Crime is defined as “a harmful activity, executed by one group through computers, information technology systems and/or the internet targeting the computers, information technology infrastructure and internet presence of another entity”.

To manage the risks of a cyber-threat or cyber-crime, WAPC should be aware of these risks and take appropriate protective and security measures necessary to safeguard both WAPC and its clients. WAPC will:

• Educate staff on the importance of, and their role in, ensuring the security of WAPC’s and client information and computer security;
• Follow guidance and best practices from industry associations and recognized information security organizations;
• As appropriate, conduct regular third party vulnerability and security tests and assessments; and
• Perform ongoing review of the adequacy of existing systems, such as its internal controls and risk management systems.

WAPC’s cybersecurity policies and procedures are outlined in detail in our Policy and Procedures manual.

Maintenance of BCP

Testing of BCP Effectiveness

Our primary means for testing the effectiveness of the BCP are occasions when the principals of WAPC are traveling or working remotely from our alternate locations. During these periods, we continue with full operations of WAPC and full provision of services to our clients. Because these “tests” occur in real time, with real systems and real operations (as opposed to simulations), we believe that they represent robust tests of the internal components of WAPC’s BCP and the capabilities of WAPC’s alternate sites and alternate communication channels. These testing opportunities occur several times during the year.

Each time a test is performed, the individual(s) performing the test will document the test, including the date, details and results of the test. Upon conclusion, the results will be reported to the principals for review and analysis. Changes will then be developed and implemented as necessary.

Review and Assessment of the BCP

On an annual basis, the BCP will be reviewed for accuracy, completeness, and practicality of implementation. Whereas the testing of the BCP in the previous section is a “hands-on” exercise in the functionality of the BCP, the annual review will be a theoretical assessment aimed at ensuring that the scope of the BCP is adequate and envisions the potential range and impact of various threats to the normal operations of WAPC.

As the owner of the BCP, the COO will review and assess the BCP. This process will involve evaluating the effectiveness of the BCP, including the testing reports as above, logging the deficiencies and updating as necessary.

Updates to the BCP

The BCP will be updated:

• At any point when our testing of the BCP uncovers deficiencies
• At any point when there is a material change to WAPC’s operations, key service providers, location, or information pertaining to the primary BCP contacts
• At any point when our annual review and assessment of the BCP exposes missing or weak elements in our existing BCP.

SCHEDULE A: ADVERSE EVENT RESPONSE PLAN

The response plan implemented will generally follow the same format regardless of whether it is an Internal, Local or Broad event, although the specific steps and actions taken will vary. In each Event, the following plan should be followed:

• Notify the Response Team Lead. The Response Team Lead will then implement this Plan.
• Determine what steps are necessary to respond. This may include:
  • An initial communication to other Response Team members, certain work groups or the entire firm, as applicable.
  • Whether alternate work locations are necessary to be activated.
  • An estimation of the duration of the event and what can be done to fix rectify the Event and restore operations.
  • Whether the Event affects clients immediately and to what extent. Communication may need to be prioritized.
  • Contacting external parties for information or guidance, such as a third-party service provider or legal or compliance counsel.
  • Send communication to other firm employees. This may be via communication trees, a firm-wide email or other means as appropriate. The communication should include a description of the Event and steps to take.

Send communication to clients.

Send communication to other service providers, regulators and any other relevant party as necessary.

Invoke measures to rectify the problem, as able.

Once business operations have been restored to normal, send a follow-up communication to employees, clients, service providers, regulators and any other party previously given notice.

Review the Event, assess the actions taken and determine whether changes can be implemented to avoid or reduce the effect of the incident in the future.