'Expect the best. Prepare for the worst.' While the comment was used by motivational speaker Zig Ziglar to explain an approach to selling, the words are perfect for a business continuity discussion. According to the National Credit Union Administration, 139 credit unions with over $3.4 billion in assets were affected by Hurricane Katrina. Of these, 69 credit unions were initially reported as not being operational or capable of communication in the days following the Hurricane.
Business continuity programs are more important than ever. The complexity of credit unions, the expectations from members for service and the intensity of the competition for members forces credit unions to be ready for a disaster. According to a study by the Institute for Business and Home Safety, an insurance industry trade group, 25% of the businesses that close during a disaster will not re-open.
The value of business continuity programs is clear. Many organizations, including credit unions, have not actively tested their programs according to survey data. According to a study by the Association for Financial Professionals, only 24% of businesses had tested their business continuity plans.
Recommendations from NCUA
In credit unions, the focus on business continuity programs is growing. In 2007 National Credit Union Administration (NCUA) released appendix B to part 749 that provided the guidelines for business continuity programs in credit unions. In this section of the regulation, NCUA recommends credit unions adopt a program with the following elements:
- A business impact analysis to evaluate potential threats
- A risk assessment to determine critical systems and necessary resources
- A written plan with the following:
- Persons with authority to enact the plan
- Preservation and ability to restore vital records
- A method for restoring vital member services
- Communication methods for employees and members;
- Notification of regulators
- Training and documentation of training to ensure all employees and volunteer officials are aware of procedures
(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant
(5) Annual testing.
Developing a Successful Business Continuity Program
NCUA’s recommendations for a business continuity program help focus credit unions on how to prepare. There are some key elements of a business continuity program that help ensure its success. Creating a program that has ongoing value to the entire business, developing a process that is accessible and simple to follow and designing a testing program that is sustainable are the keys to creating a viable business continuity program (BCP).
(read full article about 3 Keys to a Successful Business Continuity Program)
Testing a Business Continuity Plan
One of the most challenging aspects of a business continuity program is developing a viable testing plan. US Community Credit Union, a $107 million credit union based in Nashville, TN, has completed an annual test of their business continuity plan for more than ten years.
Each year the credit union assesses their business continuity program by completing a risk assessment. The management team, or crisis management team, reviews the risk assessment and schedules a test 30 days later. The tests vary each year. Recent tests have focused on the closing of the downtown area, breach of security and a pandemic event. Key employees are divided up into three teams – Business Recovery, Departmental Recovery and IT recovery. Some of the outcomes of the test include:
- Can a teller understand and implement the business continuity plan if other managers are not available?
- What are the critical single points of failure that can impact the business? i.e. only one person at the CU knows how to handle check returns.
- What other processes are critical to the organization that were missed in the assessment?
- For a pandemic event, what other methods can be used to operate the credit union in the event that limited public contact is needed?
The credit union’s actual testing of the business continuity program allows for the organization to truly understand the flaws – and fix the issues. For the credit union there is no such thing as a failed test. They learn each time.