Every credit union will inevitably experience a disruption to its operations, and it need not take a catastrophe like Hurricane Katrina to cause it. While natural events (e.g. earthquakes) and man-made disasters (e.g. terrorist attack) make headlines, credit unions are vulnerable to a multitude of everyday risks that can halt critical operations and undermine member service. A power outage, an ice storm, fraud, and security breaches are just some of the many risks that credit unions need to consider and plan for.
It is difficult to predict both the probability that these risks will occur as well as the impact they could have on one’s credit union. Nonetheless, it is important for credit unions to try to create as much certainty as possible by developing adequate business contingency plans.
What is BCP?
Business Continuity Planning (BCP) and disaster recovery planning are terms
that are often used interchangeably, for they both seek to prevent and/or minimize
the impact of a disaster on a credit union’s operations. In general, BCP is
a process that seeks to identify all the major risks a credit union needs to
consider as well as the steps that must be taken to maintain mission-critical
operations should the event occur. A BCP plan seeks to inventory all the major
risks that can affect a credit union and, for each event, determines both the
business impact and the probability of occurrence.
Once the risks, impact, and probability are understood, management needs to determine how much risk it is willing to tolerate. For example, a credit union in Texas may tolerate the risk that a snowstorm will adversely impact branch operations given the low probability of a snowstorm; a New Hampshire-based credit union, however, may have to develop stringent contingency plans since a snowstorm is much more likely to adversely impact the credit union and its members.
Over-Planning For The Worst
While the natural tendency for a credit union may be to scale back expectations in the event of a disaster, credit unions need to over-prepare to maintain adequate member services. Jim Hanisch, executive vice president at the CO-OP Network says that credit unions must have “zero tolerance for downtime” and take the necessary precautions well before a business disruption occurs to ensure the smooth flow of operations and customer service.
Stan Swenson, chief executive officer of Northrop Grumman FCU ($528 million, Gardena, CA), agrees. Credit unions need to “raise the bar” and establish “higher standards” for themselves. In the event of a business disruption or disaster that affects your members, this is exactly when “your members need you most.”
Lessons From Katrina: The Importance of a “Second Site”
There are a number of important lessons from Katrina that credit unions should
consider as they rethink their BCP plans. Last week’s article (click
here) discussed the importance of preparing contingencies for communications
and liquidity in the event of a catastrophe. Another important lesson for all
credit unions is the importance of geographical diversification.
According to CO-OP Network’s Hanisch, those credit unions that recovered the most quickly tended to be the ones that had secondary locations—either through other proprietary branch locations or via their vendor/CUSO relationships. Credit unions with remote back-up capabilities in place before the hurricane were more likely to continue to provide vital services to their members during and after the storm.