Business Continuity: Trends and Planning

Jim Jerving
November 30, 2006

Business continuity planning has changed radically in the last decade due to a confluence of events—both man-made and natural—as well as technology advances. In the past, planning for business continuity consisted of ensuring that the credit union’s core processor would be up and running as soon as possible in the event of a business disruption.

Regulators today expect that credit unions will develop an enterprise-wide business continuity plan, whereby every critical business function is examined for its response to disruptions. Business continuity is a team effort that requires the participation of all employees and all business units.

The tipping point came during the planning for Y2K. Billions of dollars were spent in preparation of a worldwide computer shutdown. When January 1, 2000 passed with few incidents, critics charged that nothing happened except the enrichment of information technology consultants. But the former is precisely the point—the goal of business continuity is to minimize damage and to recover operations. Y2K was a valuable exercise; it forced organizations to become better prepared for the next business disruption.

One of the lessons learned from Hurricane Katrina and other recent disasters is that credit unions, because of their cooperative nature, have advantages that banks and other financial institutions lack. The people helping people ethos was tested during the hurricane and the shared branching network triumphed. When credit unions in New Orleans were disabled, those on the share branching network were able to maintain services and communicate with members.

Determining other critical partnerships and relationships is a critical part of the planning mix. Valued partners are those that help to return services to the members and organization as quickly as possible. Recent disasters indicate that community organizations—Red Cross and Salvation Army to name two—often take the lead in recovery when government efforts falter.

NCUA does not have a business continuity regulation at this time, although it may issue one in the future with the increased focus on preparing for catastrophic events. Regulatory guidance has been in the form of alerts, examiner questionnaires, and letters to credit unions. So, it would be more accurate to say that NCUA requires certain actions in business continuity and recovery.

NCUA requires all federally insured credit unions to have comprehensive, written, updated, and tested disaster recovery and business resumption contingency plans—collectively referred to as contingency plans—for all critical resources. The latter includes everything from power sources and information systems to the credit union’s physical offices and its employees.

The credit union’s board of directors and senior management are responsible for developing the appropriate contingency plans, or assigning this task to a work group representing all areas of the credit union. The credit union is required to perform a business impact analysis to determine the impact certain events would have on the institution’s critical resources.

During times of disaster, members want two things from their credit union—cash to fund emergency needs and assurance that their money is safe. When telecommunications and electricity are down, ATMs and debit or credit cards become worthless and the disaster areas quickly revert to cash economies. Members need large amounts of cash to pay for critical goods and services. Lending takes on a new logarithm, one that focuses on the primary needs of the member.

The call list or phone tree was cited by most of the individuals interviewed for this report as the crucial part of the business continuity planning. Phone trees, though, take time and the message often become distorted as it passes from person to person. And with recorded announcements, there is no method to know if the message has been received. Some companies are using automated systems that can send messages to large groups that use different devices—cell phones, pagers, or e-mail. And the systems are able to tell if the message has been received.

Remote access becomes a valued asset during a business disruption. Employees can attend to critical tasks and access important data while facilities are disabled. Some organizations are issuing laptops to key employees and provide secure access to corporate networks via virtual private networks. These companies are also using online collaboration tools that allow remote workers to communicate and share files with colleagues. These options can be expensive, but some vendors are experimenting with software that will allow access only during an emergency, similar to shared networks offering emergency use.

This executive summary is from a white paper by Jim Jerving entitled “Business Continuity: Trends and Planning.” See the complete paper at www.cunacfocouncil.org/tools/research.html.