Emergency planning in the credit union industry has come a long way in the last 10 years, but even after Harvey and Irma, pros say they’re still seeing credit unions make some common mistakes.
Planning for the wrong problem
Wind and water can be devastating, but there’s often a bigger threat, according to Paul Sullivan, who is SVP of strategic business development at Agility Recovery, which has offices in Canada, Denver and Atlanta.
“Sixty to seventy percent of all disaster situations are power-related,” he said.
“If you can’t open that branch because you don’t have a generator to power the branch, it’s very frustrating for the members you service in the community,” Sullivan added.
Some credit unions do have generators, he said, but they often get the wrong ones.
“You’ve got to make sure that the generator power requirements are sized correctly so that they’ll work properly when they do get there,” he warned.
Using old data-backup technology
Sullivan estimated that at least 25% of credit unions are still using tape storage to back up their data. In most cases, credit unions aren’t even storing the tapes out of town, he said. The proximity leaves the data vulnerable to the same threats the credit unions are trying to mitigate.
“Credit unions often assume for data backup they can send it 10 miles away to a backup facility and then retrieve those tapes. Well, in the case of Houston, you wouldn’t have been able to do that,” he said.
It also takes too long to restore data from a tape backup, CU Answers Business Continuity Manager Jim Lawrence added. Members want access to their data — current data — right away.
“Having a strategy that requires you to ship tapes from the previous night’s backup to your secondary site — that’s no longer feasible, because data becomes stale so quickly,” he said.
Harvey and Irma may prompt many credit unions to get away from tape backup, Sullivan said.
“One of the things that people need to start embracing — I know a lot of organizations are — is the world of cloud backup and using those capabilities effectively, because it gets it out of the city you’re in, it gets it into that cloud and makes it so much easier to recover,” he said.
Focusing on physical assets
“One of the things that a lot of organizations forget is that your people are your number-one asset,” Sullivan said. “If you’re not working to prepare your staff and making sure they’re ready so that they can return to work and help the community, you really haven’t done your job in planning for a recovery situation.”
Most credit unions can’t just shut down for two weeks, so emergency plans must include strategies for helping employees find shelter and get to work when fuel is in short supply, he said.
“Think about carpooling so that people can get to work and you don’t have to worry about that fuel shortage. Even when you look back to Sandy, when that occurred, people didn’t want to come to work because they were afraid they weren’t going to get fuel and they did not want to get stranded,” he explained.
Assuming it’ll all work
Many credit unions need to test their emergency plans more often than they currently do, Lawrence said.
“Most of the standards and guidelines will say at least annually it should be tested. We push for every six months,” he said.
Table-top exercises can be effective ways to uncover response problems without the time and expense of full-blown tests, he said.
“Get the right people in the room: maybe department leads or different business units. Make sure they understand your recovery plan. If they have a specific role in that plan, they should understand what that is and be able to ask questions,” Lawrence explained. “With a table-top exercise, you’re not actually pushing buttons, but you’re kind of stepping through the process. It gives them a chance to say, ‘Hey, what about this, or what about that?’ That really helps to fill in the gaps you have in your plan.”
That’s not to say real-life drills aren’t necessary. They can be especially helpful for testing redundancies, he said. Credit unions that have multiple internet service providers are one example, he said. Doing a real-life drill can make sure the backup provider will work as expected.
Waiting too long
The day a hurricane makes landfall is the wrong time to start shopping for generators, wondering about data backup options or quizzing the staff on who’s going to take the morning shift.
“I hate to say it, but people still procrastinate,” Sullivan warned.
“Whoever is making a decision, make the decision,” he said. “Don’t procrastinate. That’s the best advice I can give.”
