The value of a robust business continuity program increases dramatically with the complexity of the business. Twenty years ago the average 'active' member may have accessed the credit union weekly to deposit a paycheck and take out cash. Today, a typical 'active' member accesses the credit union multiple times in a day through debit card and credit card transactions, bill pay, ATM, account to account transfer and more. An outage at almost every credit union today, for even a short period of time, is a dramatic experience for both the members and the credit union's employees. Creating a program that has ongoing value to the entire business, developing a process that is accessible and simple to follow and designing a testing program that is sustainable are the keys to creating a viable business continuity program (BCP).
Provide Value throughout the Organization
Often BCP is viewed as a needed item only to fulfill the regulatory requirement from the National Credit Union Administration. At a minimum NCUA requires credit unions to:
- Conduct a Business Impact Analysis
- Conduct a Risk Assessment
- Develop Business Continuity Strategies
- Develop a Business Continuity Plan
- Test and Maintain the Plan
NCUA's requirement of course adds motivation to complete business continuity plans. The regulations and letters continue to be developed by NCUA. In letter 08-CU-01, released in February 2008, NCUA addresses the need for credit unions to establish plans to manage a pandemic event. Also, NCUA regulations part 748 and part 749 include guidelines for preparing for a catastrophic event.
A successful business continuity plan can add much more value to the credit union beyond fulfilling a regulatory requirement. Business continuity planning and testing can help audit the entire operation at the credit union. A successful program moves BCP beyond the IT department and into the business area of the organization. Successful programs use BCP to:
- Find the single points of failure in the organization. Do you have critical operations in your credit union that are known by only one person? Does your procedures document for a critical operation say --- “Ask Jen how to handle this?” A business continuity program can uncover these issues.
- Audit the operations and processes of the credit union. Many credit unions have a few critical processes and documents that have been in place for decades. The people doing the process know they work fine, but may not have considered ways to streamline the process to save time and money. Business continuity programs provide a built-in incentive to audit critical processes that tend to get ignored.
- Cross train employees in order to distribute the risk. A good business continuity plan will build in the need to cross train employees. This helps make a more effective program and increases the strength of organization.
Develop a Simple and Accessible BCP
For some credit unions, the business continuity plan is reviewed once every six months. An email comes from the IT department with a 150 page document that credit union leaders are asked to review. Other credit unions have found value in providing a plan that is accessible daily and incorporated into the regular communication within the organization. This can help overcome those common reactions about BCP such as:
- Business continuity is an IT problem. BCP is for everyone in the organization. A credit union Chief Information Officer can explain what will fail. The credit union operations and business units can explain what will happen to members if something fails. A program that involves more employees will increase buy in and make the program more valuable.
- A disaster will never happen to us. Phone systems go down all the time and never make the newspapers. What would happen if your phone system was out for three days? Would this impact the way members perceive the credit union? What will you do if there is a fire in the records department, cards area or share draft? Disasters can be regional, but they are more likely to be focused only on your organization. Thinking through the contingencies for critical operations, even for local and individual events, will be valuable for the organization.
- We can deal with the issue when it happens. Most credit unions are too complex to be handled this way. There are probably 30 year employees at the credit union who remember the times when they came in and hand posted a few transactions at 4am after an outage. On a very small scale this may work. The complexity of the organization, the expectations from members for service and the intensity of the competition for members does not allow credit unions to handle outage events without preparing.
Creating a business continuity plan that is worked into the regular operation of the credit union can help make the program more valuable.
Test regularly – No Test is ever a failure
Testing is an extremely important part of the business continuity program. The best opportunity for learning how contingencies will actually work is through a test. Plus, failed tests can be a great way to fix a critical process.
Some credit unions have found value is testing that is both scheduled and unscheduled. An unscheduled test, such as a phone outage, can be an excellent way to document the process for handling an issue if a major outage event occurs. Also, testing can be simple. Testing for a phone tree process can be done by announcing a casual day – via the phone tree. How does the system work?
The keys to a successful test include:
1. Set goals for the test. Testing early in the process of a business continuity program should have very clear objectives and have a limited in scope. As the program progresses the testing should become more complex.
2. Determine the participants. The crisis management team does not need to be actively involved in every test. Set the parameters and bring in the correct people.
3. Identify roles and responsibilities
4. Coordinate with vendors – In many credit unions, vendors play a key role. In most tests a vendor will need to be notified. Typically, for a scheduled test, 60 days notice will need to be given to the vendor.
5. Execute and monitor the test
6. Debrief and document the test – Talk through the test with the key players. Even if the test fails, something can be learned each time.
7. Measure whether the test was successful
Business continuity programs with viable tests are likely to provide the best opportunities for learning. Testing shows the shortfalls in process and helps the credit union find the needed solutions.