If you haven’t tested your disaster recovery plan—it isn’t really a plan

You will probably never find a convenient time to run a test of your credit union’s business continuity (aka “disaster recovery”) plan. The only thing you can know for sure is that the worst time to test the plan is during an actual crisis. In a May 2009 Webinar, CUNA Mutual experts outlined three methods that credit unions can use to test business interruption plans:

1. Structured walk-through: This is a preliminary step in the overall testing process that can be an excellent training tool by itself. Involve all the employees who play critical roles in conducting your credit union’s business interruption procedures. Read through the plan together, step by step. Note any issues that arise during the walk-through, and clarify them before moving on to the following simulations.
    
2. Technical “hot site”: Your plan should include procedures for running operations from alternate sites. The term “hot site” refers to a pre-determined facility where the credit union will have access to its data, and the ability to conduct transactions. This is a demanding test to set up, but it provides critical hands-on experience. A hot site test should require employees to mobilize in the remote facility, establish communications with the necessary employees and vendors, and perform actual processing.
    
3. Disaster simulation: The most practical type of simulation may be the “table-top” format, where the exercise is conducted in a conference room or series of rooms, where employees can gather in functional groups. It generally takes two to four hours. You need a credible disaster scenario fully written, including a series of events that happen in timed segments. A facilitator explains the hypothetical events as they happen, and employees must carry out key elements of your business interruption plan. (See the sidebar for more details about table-top simulations.)

Involve employees from every part of your operation—and your board of directors, if possible—in testing your business interruption plan. It helps if people from across the credit union have already been involved in creating the plan. Remember that not all employees may be available to work during an emergency, so if you put the business continuity planning in the hands of only one or two people, you’re at greater risk of a disorganized response.

Disaster planning experts provide guidance

A recording of CUNA Mutual’s Webinar “It’s Not A Plan If You’re Not Testing It” is available for no charge to Bond policyholders at cunamutual.com. The Webinar covers the material in this article and much more. It is led by CUNA Mutual’s Mike Retelle, Chairman of the Disaster Response Team, Glen Engle, Business Continuity Coordinator, and Vince Wagner, Risk Manager and Credit Union Protection expert.

Retelle, with more than 29 years of experience in handling disaster-related claims at credit unions, says that regulators require credit unions to have a business continuity plan, and to test it—but that’s not good enough. “You have to ask yourself, ‘Do I have a plan that is going to succeed? Am I still going to be able to serve my members?’ Having a plan that simply meets the regulatory requirement isn’t really a plan,” he says.

Retelle recommends that CUNA Mutual policyholders take the free online risk assessment  to learn more about the strengths and weaknesses of their credit unions’ risk exposures and insurance packages.

Insurance products offered to credit unions are underwritten by CUMIS Insurance Society, Inc., a member of the CUNA Mutual Group.

(((SIDEBAR)))
Who should be at the table
in a disaster simulation?

Why don’t more credit unions test their business interruption plans more often? Because the tests interrupt business.

You can gain valuable feedback on your plan, however, with a “table-top” disaster simulation held at your credit union, usually in about two to four hours.

Create a disaster scenario that’s logical for your credit union location. Have groups of employees work through the business interruption plan in timed segments, with a facilitator announcing each event as the scenario plays out. Focus on who should be doing what and when. Limit verbal communication between groups if, in a real disaster, they wouldn’t be in the same room.

CUNA Mutual’s May 2009 Webinar, “It’s Not A Plan If You’re Not Testing It,” includes a checklist of who should be involved in a table-top disaster scenario:

Facilitator: Explains the scenario, announces changing events, and keeps time. Consider using someone from outside the credit union, for an objective outlook.
Recorder/scribe: Tests are for learning and adapting the plan—be sure to record everything that happens and capture feedback from all participants.
Recovery team members: Those who, according to your business interruption plan, are in charge of carrying out the plan.
Business process owners: It’s good for business process owners from throughout your organization to learn about one another’s roles in the event of a disaster.
Observers/key stakeholders: Your senior management and board of directors should observe the test. Also consider bringing in representatives from branches other than the one being tested. Business partners such as data processors, facilities managers, and insurers can gain (and offer) valuable insight during a test.

Learn more
CUNA Mutual policyholders may watch a recording of the Webinar free at cunamutual.com, in the Credit Union Protection Resource Center.


Form number: BOND-0509-07A5
©CUNA Mutual Group, 2009 All Rights Reserved.