A Glimpse into Business Continuity Planning, and More

With the horrific hurricanes of 2005, business continuity planning is front and center in many of our minds. The wrath of Mother Nature has brought into greater focus the importance of having an active and effective continuity program. Like most organizations, Empire Corporate has always maintained a disaster recovery plan. In response to 9/11, and to the August 2003 major blackout, Empire committed additional resources and attention to developing a holistic business continuity program. I’d like to share with you here what Empire has learned while developing its business continuity plan as it may assist your credit union. A Business Culture What does this increased focus of business continuity mean? In the past, disaster recovery was viewed primarily as the responsibility of the information technology department. Now, it is a part of our business culture, and addresses every business function. We follow a best-practice approach in continually developing and maintaining its program. Business continuity planning follows a perpetual lifecycle. It starts with analyzing the business to determine functional priorities. It then assesses the continuity risks associated with each business process. Strategy and plan development can then be performed. Training, testing and plan maintenance activities follow, leading back to further analysis of the business. Basically, the cycle never ends. When we develop our own business continuity plans, we realized that a top-down commitment is critical. Executive level sponsorship, and the support of our entire management team, was integral in developing and implementing a comprehensive program for the corporate. When we consider business continuity strategies and plans, member service is always given the highest priority. For example, in an effort to reduce the potential impact that power failures could have on our member credit unions, we have a back-up power system at its Albany, New York, headquarters. That’s a must-have these days. We also implemented a systems recovery solution providing higher availability for critical business processes. Advances in data replication and storage technology have substantially reduced the time required to recover and resume these functions. In addition, we implemented several new member and internal notification and communication solutions. The corporate utilizes a combination of internally hosted applications and databases, along with Internet-based vendor solutions, to support their member communication plan. We follow the same approach with respect to our internal communication plan. Previously, we used a call-tree approach for staff emergency communications. However, last year the corporate implemented a broadcast notification solution that allows us to instantly reach all of our employees, at all branch locations, simultaneously. We’re evaluating this solution as a possible member notification tool as well. Business continuity planning was also aligned with the corporate’s information security, compliance, project management and facilities management functions to form a new Operational Integrity Department. The new department manages operational risk, assures regulatory compliance, and integrates industry best practices. We also emphasize that exercising and maintaining the business continuity plan is a priority at the corporate. Without continued attention, plans can become quickly outdated and useless. Practice and ongoing validation is essential. Tips For Your Credit Union What guidance does Empire offer natural-person credit unions? First, continuity plans should consider a broad range of events. This includes planning for the impact from the types of natural disasters probable in your geographic area. Second, credit unions also need to address events that are smaller in scope, but that may have a higher probability of occurrence, such as a corrupt account database, a temporary telecommunication interruption, delayed coin & currency deliveries, or an ATM malfunction. When analyzing your business operations, the dependencies associated with each business function should be identified. Then they should be evaluated to determine if they represent single points of failure, and whether they require appropriate back-up alternatives. And very importantly, with respect to incident management, communication is critical. Credit unions should adopt an incident management process that includes a member, vendor, business partner and service provider communication plans. It is highly recommended that business partners have your credit union’s current contact information at all times, and that you have the same for them. Keep back-up copies of this information-and your Business Continuity Plan and all communication plans-in a secure off-site location.