It is immaterial if the data is 200 miles away or 300 miles away. What is key is that the credit union can't get to it. A plan written by a vendor providing backup data center services only addresses part of the problem — the data and IT services. It doesn't address the overall operations of the credit union. It doesn't get a single member the cash needed to buy groceries or drugs or fuel.

The answer to the problem was only mentioned briefly in the last paragraph of an otherwise great article — Resiliency.

A resilient credit union is focused on one thing — continued service to the membership. In order for that to happen, the planning needs to put in place backups for three things: People, Places, and Processes. Unfortunately disaster recovery planning alone only partially addresses the Processes part of the picture.

Putting backups in place requires a close look at the threats and risks imposed on the credit union, discovering the most likely risks and putting mitigations in place to reduce their impact or duration. For example, if a widespread, long-term power outage will shut the doors, investing a couple thousand dollars in an emergency generator is a pretty logical choice.

If loss of Internet access separates the tellers from the core data, ensuring availability of a current trial balance might be cheap insurance. If food poisoning from the recent chili cook-off takes staff out for a week, a backup source of people (as in shared branching or reaching back to recent retirees, or shared staffing with a sister credit union) would be a smart move. If the building is inaccessible because of structural damage or other habitability issues (consider sewer backups during a flood), backups should include a place to set up shop that is available to both staff and membership. This might be a corner table in a coffee shop, and the cost for that arrangement might be a purchase of some coffee shop gift certificates to give to members.

Processes (and the data behind them) get the greatest focus, and for the most part, it should. Remember, however, that virtually every process we use began with a relatively simple manual process. (Remember passbooks?) Very often, real resiliency can be achieved by preparing to operate off-line for an extended period of time.

Every backup, whether it be for people, places, or processes, needs three things to work: 1. Practice. 2. Practice. 3. Practice. That's right, just because the credit union writes it into a plan and puts that plan on the shelf in a three-ring binder doesn't mean it will work.

Not only does practice make perfect, practice finds the holes in the plan that might prevent it from working as expected. This isn't the same as a DR test, where we find out if the equipment works as advertised. This is a training, learning, and skills honing event where resiliency is built.

Resilience doesn't happen in isolation. It doesn't occur because a business continuity planner writes a plan. It doesn't occur because the NCUA examiner has looked at the business continuity plan. It occurs because of a solid C-level commitment. It is a characteristic that becomes built into and is an integral part of the organization's culture. It is a long way from disaster recovery planning.

Resilience ensures the credit union is there for the membership, which ensures the membership remains with the credit union.

And, after all, that's what we want, isn't it?

Ken Schroeder is vice president of business continuity at Corporate One in Tallahassee, Fla.