Enterprise Resilience

IIF CAPITAL – ENTERPRISE RESILIENCE & OPERATIONAL CONTINUITY FRAMEWORK

Document Ref: EC-ERP-2026

Classification: Public Corporate Disclosure

1. Executive Summary & Program Architecture

Resilience is a foundational pillar of IIF Capital’s corporate culture and operational principles. It dictates how we govern our business, mitigate risks, and fulfill our fiduciary duties to our clients.

IIF Capital’s Enterprise Resilience Program (ERP) integrates four critical competencies:

Operational Resilience: Safeguarding core business services against system failures.
Business Continuity Management (BCM): Ensuring personnel and process availability.
Disaster Recovery (DR): Preserving technology, data assets, and infrastructure.
Crisis Management (CM): Executing coordinated strategic responses during disruptive events.

Our frameworks are engineered to meet or exceed international institutional standards and strictly comply with the legal and regulatory mandates of the jurisdictions in which we operate.

2. The Six Pillars of IIF Capital Resilience

Our resilience framework is built upon six interconnected operational elements:

                  +-----------------------------------+
                  |   ENTERPRISE RESILIENCE PILLARS   |
                  +-----------------+-----------------+
                                    |
     +------------------------------+------------------------------+
     |                              |                              |
1. Preparedness & Planning     2. Risk & Site Resilience      3. Exercises & Testing
     |                              |                              |
4. Third-Party Oversight       5. Crisis Management           6. Training & Awareness
     +------------------------------+------------------------------+

2.1. Preparedness and Planning

IIF Capital structures its operational readiness through a comprehensive three-tier planning methodology:

Business Impact Analysis (BIA): Conducted annually by each business unit to evaluate the financial and operational impacts of a critical process disruption. The BIA maps internal dependencies and critical third-party services, establishing the formal Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for every core business service.
Business Recovery Plans (BRP): Actionable, pre-validated procedures designed to sustain the continuity of operations during disruptions. These plans encompass fallback strategies for essential personnel, core applications, third-party workstreams, and physical facilities, including Staff Absenteeism Plans tailored for pandemic or regional emergency scenarios.
Disaster Recovery Plans (DRP): Technological fail-over frameworks designed to restore infrastructure across a spectrum of technical failures, ranging from individual server corruptions to entire data center facility or cloud region outages. Each DRP embeds an Incident Management Plan (defining command structures and escalation matrixes) and a Communication Plan (governing stakeholder updates).

2.2. Risk Assessment and Site Resilience

We perform exhaustive, annual Site Risk Assessments across our global office network. These assessments evaluate localized vulnerabilities, including natural disasters, civic unrest, regional utility failures, and climate change impacts.

To eliminate single points of failure, IIF Capital mandates built-in technical redundancies:

Infrastructure Layer: Primary and secondary production systems are distributed across geographically separated data centers and multiple cloud regions, utilizing near real-time data replication.
Connectivity Layer: Each corporate hub is supported by physically diverse network circuits, secondary telecommunications providers, and automated backup power grids.

2.3. Exercises and Testing Strategy

To ensure that recovery plans are operationally viable and that key personnel remain proficient, IIF Capital executes rigorous, risk-based annual testing schedules:

Operational & Technical Fail-overs: Live data center and cloud region fail-over drills to validate application functionality and confirm RTO benchmarks.
Workforce Adaptability: Regular remote access testing—reinforced by our core hybrid work model—alongside physical relocation drills to dedicated alternative offices and work-transfer simulations between global teams.
Advanced Stress Testing: Executing a strict spectrum of testing methodologies (including Tabletop simulations, Live Drills, and Full-Service Specific Testing) to challenge our Impact Tolerances against severe but plausible scenarios.

2.4. Third-Party Oversight Framework

Vendor and contractor vulnerabilities are governed through our institutional Third-Party Risk Management Framework.

Targeted Evaluations: We perform targeted due diligence on the operational resilience, BCM, and DR capabilities of critical service providers during onboarding and through ongoing oversight schedules.
Scenario Validation: Our resilience testing regularly simulates the complete loss of key external vendors to validate our internal backup strategies and ensure uninterrupted service delivery.

2.5. Crisis Management Command Structure

IIF Capital operates dedicated monitoring structures to track global threats to our personnel, facilities, and technology 24/7. Disruptive incidents are managed via standard response workflows and escalated to our Crisis Management Framework when material thresholds are breached.

The framework guarantees:

Structured Command & Control: A formalized local, regional, and global crisis team layout featuring designated primary and alternate leaders to maintain clear decision-making authority.
Mass Communication Infrastructure: An emergency notification system capable of distributing urgent updates to staff via SMS and email across corporate and personal devices simultaneously.
Stakeholder Transparency: In the event of a material disruption, our dedicated relationship teams initiate transparent, real-time disclosures to impacted clients.

2.6. Training and Awareness

To embed a culture of readiness, all IIF Capital personnel undergo mandatory, continuous education initiatives:

Annual Emergency Preparedness Training: Compulsory all-staff digital courses covering basic security and threat response protocol.
Interactive Simulations: Active business unit participation in localized business recovery and technical disaster tests.
Targeted Learning Sessions: Periodical briefings focusing on evolving global risk vectors, such as advanced social engineering, phishing risks, and cyber-hygiene.

3. Regulatory Compliance & Governance

The Enterprise Resilience Program is backed by an executive governance oversight structure. Program performance metrics, annual BIA outputs, and exercise audits are regularly examined by IIF Capital’s internal audit teams and presented periodically to the Board of Directors and external financial regulators.

Our framework proactively aligns with evolving global operational compliance mandates, including the EU Digital Operational Resilience Act (DORA), ensuring that our ICT risk management, incident classification models, and third-party risk strategies remain fully compliant with international financial sector laws.