Only about one-third of small or medium-size U.S. businesses have a comprehensive disaster recovery plan, according to Gartner, a technology and research advisory firm.
That statistic doesn’t surprise Paul Sullivan, vice president and general manager at Agility Recovery, a CUNA Strategic Services alliance provider. He’s often surprised by how many credit unions don't have a recovery plan in place.
September is National Preparedness Month, so Credit Union Directors Newsletter sought insight from Sullivan about issues boards should consider when assessing their business continuity capability and approving their NCUA-mandated recovery plans.
Q What are the key elements to a successful disaster response?
Sullivan: First, you need a plan. But a plan is just a piece of paper.
Second, you also need a place to go should your facility become unusable. That mitigates risk because you need to restore operations as quickly as possible. You don’t want to put doubt in anyone’s mind because it’s far too easy for consumers to take their business elsewhere.
And third, you must test the plan. That can be as simple as a tabletop exercise—bringing in all the stakeholders, running through a scenario, and making sure everyone knows their roles and responsibilities.
Rather than calling it a “test,” call it an exercise. A test says pass or fail. With an exercise, you can learn from it, and enhance your capability.
Q. Besides natural disasters, what other events should CUs anticipate?
Sullivan: The majority of what we see are isolated incidents. At one financial institution, a $2 nut that connects a water pipe to a second-floor toilet failed and the entire first floor flooded.
Credit unions are always updating or remodeling, and that typically means closing the branch for some time. But what if work crews find asbestos and they need to take abatement measures, and you can’t get back into the facility?
The biggest thing we see is power outages, which often are completely unrelated to the credit union. We’re so reliant on the network these days, whether it be phone or Internet. How do you restore your business if you don’t have access?
Q. How do you construct a plan that assesses every possible scenario?
Sullivan: Any plan has to be flexible, and it has to be a guide.
Are there going to be things that happen that we didn’t think about? Absolutely. But with a good plan, you can adapt quickly.
Another key is spreading responsibility. In a lot of organizations, leadership will turn to somebody—whether they’re in security, information technology, or risk management—but no one person can handle that.
An effective program must be built with a team in mind, and you must have management support to test it and implement it, if necessary.
This article initially appeared in Credit Union Directors Newsletter, which provides strategic insights for policy makers. Subscribers can choose to receive the print edition or PDF version.