There are an estimated 22 credit unions with $5.7 billion in assets and significant loan portfolio exposure to counties hardest hit by the hurricane. These credit unions hold mortgage and auto loans in the affected areas that, when combined, exceed 50% of their net worth, according to the NCUA. Credit unions with a high degree of exposure to devastated communities could experience significant losses.

These were some of the sobering facts presented at a League of Southeastern Credit Unions webinar in November. The webinar featured best practices and lessons learned from executives who managed their credit unions through the worst hurricanes in American history. NCUA officials also shared their insights about how they work with credit unions throughout the recovery process.

The $278 million, 31,278-member Louisiana Federal Credit Union in LaPlace, La., was substantially impacted by Hurricane Katrina in 2005, the nation's costliest natural disaster, and Hurricane Isaac in 2012.

"These two events helped us perfect our disaster recovery," Louisiana FCU President/CEO Rhonda Hotard said. "In addition to having a [disaster recovery] plan, testing the plan is so critically important."

After testing its plan based on a disaster simulation, the credit union reviews each step it took to respond to the disaster, discusses how each step could have been done differently or better, and makes necessary updates or improvements to the plan.

"The plan really needs to be something that you can use, not something that you just put on the shelf and pull out when the NCUA comes," she said.

Hotard identified critical priority areas that credit union executives need to include in their disaster recovery plans. The first is to ensure the credit union has sufficient cash, because employees and members need money for immediate needs following a storm. Cash is even more important than debit or credit cards because members and employees may not be able to use them after a destructive storm takes down power lines.

The credit union was unable to get new cash reserves from the New Orleans Federal Reserve because it had been closed for some time following Hurricane Katrina.

Credit unions may want to identify another Federal Reserve Bank location where they can get cash, and/or plan to securely remove cash from other branches that may close after a storm.

It is also important to contact local law enforcement and state police before a disaster strikes to acquire the proper identity credentials that will allow staff to access branches as soon as possible after a storm passes.

"Building access and security become really, really big issues especially when you are in an area that has been impacted," Hotard explained. "We learned that sometimes when you think you can get back to your building, law enforcement may not allow you to have access."

Investing the time to develop a comprehensive crisis communications plan that is very specific for staff and member communications is another top priority.

"We have defined roles within our organization on who has the authority to communicate both to our staff and to our membership," she explained. "We know [beforehand] how often the message will go out [to staff and members]. We know what the messages will be."

During Hurricane Katrina's aftermath, when there were widespread power outages, many members were concerned about whether their direct deposits and Social Security payments had been posted. To find out that information, many members drove to branches.

"So we put yard signs in front of the branch and wrote with Sharpies the dates of the direct deposits that had been posted and when they could expect their money," Hotard said.

For disasters, Louisiana FCU also activates an emergency page on Facebook just for staff members.

"When staff evacuates and they're disbursed throughout the region or state, they may have access to communications and can go online to get updates," she said.

It's also important to require employees to update their contact information when they plan to temporarily move in with relatives before, during and right after a storm.

A return-to-work policy is also important; Louisiana FCU found some employees are eager to return to work while others become anxious about returning to their workplace.

"You need to let them know what the expectations are as early as you can," she said.

During the recovery process, credit unions should provide their employees with water and food at the branches, call centers and other offices. Also, make the water and food available for members, if possible, when they visit branches.

Hotard noted employees are cross-trained so that every staff member knows how to do basic teller transactions that are most in demand after a disaster.

She also recommended credit unions install a backup power generator at every branch.

"That has really afforded us the ability to be the first financial institution to open every time a storm comes through," she said, noting it can strengthen a credit union's reputation and brand.

In addition, when the branches cannot be reopened, it is critical to make sure your IT systems are regularly backed up and your credit union has an IT backup location in a different geographical area to ensure online and mobile services continue to function.

Hotard also advised credit unions to review their insurance policies annually for any gaps in coverage, particularly for things you may think you don't need, but probably will need when the time comes.

Managing the credit union's risk and losses following a storm is one of the most important elements of business recovery, but only after determining that all of your employees are safe, and that assistance and resources are provided for employees who have been affected by the storm and their families.

"We were in disaster mode from the 23rd of August to the 13th of September," Rhonda Pavlicek, CFO for the $3.3 billion Texas Dow Employees Credit Union in Lake Jackson, said. After Hurricane Harvey turned into a tropical storm, the torrential rains dropped more than 60 inches of water and caused massive flooding across southeastern Texas. Hurricane Harvey, which claimed 107 lives, was the second most costly disaster in U.S. history, leaving behind more than $125 billion in damages.

The credit union helped employees find temporary housing and daycare, provided meals and tried to be as flexible as possible with their return-to-work plans.

"This is really key for us and is part of our [recovery] plan, too, because we want our employees to be as solid as they can so they can be there to support our members through the crisis," Pavlicek said.

Because of the extensive flooding, Pavlicek said there were initial concerns about how to assess the risks and losses of the credit union's mortgage portfolio, which holds just under $1 billion in mortgages.

TDECU pulled the addresses of all members with mortgages, then overlaid that information with data from vendor CoreLogic and its data analytics tool to get a first look at which homeowners could be extended forbearance based on FEMA's disaster designated area regulations, and which homeowners could end up becoming slow pays.

The CoreLogic tool helped the credit union assess potential risks and determine how much capital to set aside in its loan loss reserve accounts, which also satisfied the NCUA examiners, according to Pavlicek.

Chris Bryant, director of supervision of NCUA Region III, said the independent federal agency uses a risk model that is weighted on particular areas specific to the disaster because no two disasters are the same.

"For example, during Hurricane Harvey, we did some risk assessments that were based on the amount of real estate that was in the flood zone," Bryant said. "We weighted some of our risk models heavily on real estate [of credit unions'] members would have in flood areas and whether flood insurance actually covered homes in those areas."

Once those risk assessments are completed and credit unions are ranked from high risk to low risk, examiners follow up with those credit unions to determine how they are measuring their losses and monitoring their members.

"If your answers are good and we're satisfied, we'll probably leave you alone and let you do your business the best that you do your business," Bryant said. "If your answers are not good and we don't have a good feel that you've got the situation covered, then we will probably pay closer attention to you."