Mistake #1: Only focusing on the buildings

“Surprisingly enough, with a hurricane the biggest issue most people are going to have is power,” Agility Recovery VP and General Manager Paul Sullivan said. During Superstorm Sandy, he noted, 60% to 70% of Agility's clients had power issues but no structural damage. About half of Agility's clients are banks and credit unions, according to the company's website.

Sullivan recommended either buying a generator or having a contract in place with a vendor who will guarantee delivery of one. And don't forget about the fuel.

“Either you insist that the vendor you are going to use will provide you fuel, or you have your own fuel agreement in place,” he said.

Mistake #2: Planning for only a few days of crisis mode

Expect to be down for a week or less if all you've lost is power, Sullivan said.

Structural damage, on the other hand, could cost three to nine months, depending on the situation.

In both cases, if the credit union hosts its own website or has its own email or imaging servers, salvaging equipment is crucial, CU Answers Business Continuity and Recovery Services Manager Jim Lawrence said. Shared branching could help, he noted.

“They could travel to wherever the closest credit union is on the same platform. They can log on, view their member information, perform their functionality, their features,” he said.

But in many cases, credit unions' branches or head offices will need dedicated temporary quarters. That can be tricky, Sullivan said, because members are creatures of habit — they want to go to the same location and talk to the same people.

Employees have the same needs, he said.

“You need to make it as easy for them to come to work as possible,” he noted. “Let's say it's a hurricane in Miami and you tell them that the closest hot site is in Jacksonville; how many people are going to travel there? Not a whole lot. If you tell them that we're bringing in a mobile facility or a mobile bank branch, and it'll be here in 48 hours, you just come to your normal place of business, you're going to tend to get them back and working for you.”

Mistake #3: Not probing third-party vendors

“These days, you have to know where your vendors are located, not necessarily your salesperson. You need to know where their data centers are located,” Lawrence said. “I know (during) Hurricane Sandy, there were some cases where some vendors were unable to recover in an adequate period of time or at least what their planned period of time was. They were unable to continue providing those services. Those are things that often a credit union will not think of.”

A lot of credit unions think they have reciprocal agreements with other credit unions or with third-party vendors for space or internet access after a disaster, but unless there's a signed contract, it's safe to assume all bets are off when the storm actually hits, according to Sullivan. Credit unions need to demand that third-party vendors have disaster recovery plans, he added.

'What if whoever provides you cash can't get there? That's an important element. What about your core processor? Are they going to be there when you need them? Then what if you have third-partied your IT functions to a local IT company down the road, and they happen to be affected and don't have enough staff to be able to support you and the other 30 customers they have?” he said.

Mistake #4: Assuming people will come to work

Actually finding the employees is one thing. Sullivan said phone trees are useless if people at the base of the tree aren't available to make the calls; a better option is an automated alert, email or text system. Getting employees to show up for work is another. After a disaster, employees are far more concerned about the welfare of their families and property than about clocking in.

Credit unions need backup staffing plans — and they could include people who have retired from the credit union, Sullivan said.

“Why not put a program in place that continues to train those retired employees?” he said. “Bring them in once a quarter, train them on any new processes, buy them lunch. They'll be quite happy to do that. It gives you a pool of resources that you can call upon at time of disaster should you need it.”

Mistake #5: Leaving the plan on the shelf

First of all, the plan shouldn't physically be on any shelf — it should be in electronic form and stored in the cloud so people can access it offsite and from multiple devices, Sullivan said.

“Often, credit unions that do not test their plan, they're cited for it in an examination or audit,” Lawrence added. “Their response is almost always, 'I just don't have time,' because either it's complex, or it's an interruption to operations, or I don't have enough staff. I say start small and then grow incrementally, and then increase the scope of your testing plan each time. If you install a redundant communications at a branch, do a failover test. You can even do those during off hours, just in case it doesn't work as expected.”