RSM Resources

The U.S. Department of Labor estimates that more than 40 percent ofbusinesses, including community banks, never reopen following adisaster. Is your banking institution prepared for a major businessdisruption?

The nature of banking makes disaster planninguniquely complicated. Consider a bank’s dependency on computerizedoperations, electronic record-keeping, and automated check processingand fund transfers. It all adds up to a challenging recovery scenarioshould your bank be unable to conduct regular operations for any reason— much less a major disaster.

Where to start?

Ifyou’re an executive at a growing bank, chances are you’re familiar withyour disaster recovery plan. But you should review such plans annuallyto make sure they’re still relevant. This evaluation process requiresquestioning the plan’s assumptions for risks and their potentialeffects on your business. Be sure to involve key employees, from theback room to the front office, in your review. Unless your employeesknow your continuity plan and how to implement it, your plan is likelyunworkable.

To quickly assess the quality of a businesscontinuity plan, consider the extent to which it addresses some of thecommon mistakes banks make in planning for disasters. Ask yourself thefollowing questions:

• Do you invite critical vendors to help test your continuity plan?
• Does the plan address what to do — and how to do it — if key personnel are unavailable?
• Does the plan address employee and customer safety?
• Is the plan approved by your board of directors?
• Does the plan include manual work procedures?
• Does the plan include a media relations strategy?
• Do key managers and front-office personnel know and support the plan?
• Do you provide periodic training on key plan provisions?
• Does the plan include the management of records for insurance claims?
• Does the plan include returning the focus of your services from disaster recovery back to normal operations?
• Does the plan address how to maintain required regulatory controls during the disaster recovery period?

If you answered "no" to any of these questions, you need to update your disaster recovery plan.

Conduct risk analysis

Bankrisk managers often develop continuity strategies at both theoperational and credit risk levels. At the operational level,strategies must ensure that customer service delivery commitments andobjectives are achieved. At the credit level, it’s crucial to ensurethat business interruptions affecting the customer’s business will notaffect credit quality — that is, the customer’s ability to meet paymentobligations.

According to a recent article in the RMA Journal,published by the Risk Management Association, three factors placepressure on banks to regularly update their continuity planassumptions: recent global events, new business and service deliverymodels, and increasing use of service providers and vendors.

Forcing the issue of adequate testing

Banksshould review and test their continuity plans annually. Tests andexercises should not be conducted to "trip up" participants. Rather,they should raise awareness of capabilities and identify areas forimprovement. Tests might include a structured walk-through or actuallyshutting down operations and attempting a recovery.

Banks thatperform the latter typically conduct such a test on a weekend tominimize business disruption. Experts agree that, at a minimum, banksshould perform a parallel level of testing, meaning they should testcontinuity plans during normal business hours but without disruptingbusiness operations. Typically, the IT group leads such a test withoutthe service-delivery staff, who continue to serve clients. The risk ofconducting parallel tests is that at least part of your staff is notadequately prepared to provide feedback on the accuracy andcompleteness of the plan, nor are they as familiar with what to do inan emergency.

Where and how will you conduct business?

Designatingan alternate operating site is a top disaster-planning priority. Whatis the best alternate site? That depends on the findings of your riskanalysis. Thoroughly test the chosen site to confirm its viability.Testing enables you to practice the moves that would allow you tomaintain operations in a disaster with little or no inconvenience toyour customers.

Testing also allows you to resolve potentialproblems that could affect the chances of maintaining operations.Keeping problems to a minimum and knowing how to resolve them are keypoints in a successful recovery. Remember, pressures on personnel willbe immense during recovery. As a result, solving problems can takelonger than in a normal work mode — as much as five to 10 times longer,because the pressure to resolve them may cause other problems.

Rationalizing expectations

Inregions unaccustomed to severe weather conditions, the threat ofexperiencing a business-altering natural disaster is generally low.It’s also commonly thought that if public infrastructures areunavailable, customer service delivery expectations decrease. But don’tjump to conclusions: Public expectations can increase during disasters.

Forbetter or worse, disasters are big news — which presents opportunity.Consider taking advantage of the inevitable media coverage of adisaster in another community to explain to customers and vendors howyour bank has planned for a similar situation. Communicate both thepreparations you have made for business continuity, as well as helpfulsuggestions for what customers themselves should do to protect theirfinances in the event of a disaster. For example, stress that neitherthe bank’s nor the government’s insurance covers contents ofsafe-deposit boxes. Even the bank doesn’t know what the contents are,so customers should insure the contents of their boxes.

Even local disruptions have big impact

Managingthrough a disaster can have consequences far beyond the walls of yourown institution. A recent study by the California Bankers Associationconcluded that the loss of check processing in the Los Angeles areawould affect California’s economy in three days, the nation’s economyin five days and the world’s economy in seven days. A disasteraffecting your bank or several banks in your area could result in aripple effect locally, nationally and internationally. So, foreveryone’s sake, follow the Boy Scout motto: "Be prepared."