Your financial constitution is constantly at risk of being victim to natural or manmade disasters.

While you can’t prevent random acts of nature, it is possible to protect your institution’s and customers’ assets from being lost by investing in business continuity.

It doesn’t matter if your financial institution is a massive corporation or a small bank, the effects of any of these events could be devastating to your bottom line.

There is no surefire way to avoid specific risks, but there are things you can do to protect your business.

But what exactly does this entail?

Developing an effective business continuity plan and a disaster recovery plan will help your compliant team perform its best due diligence.

Doing this will give your institution the best chance possible to recover quickly with minimal damage.

What Is a Business Continuity Plan?

Business continuity entails the creation of plans for high-risk events that will disrupt business operations.

A BCP plan aims to keep the business running during disasters, so you don’t suffer losses that could include public trust or even legal action resulting from failures during the high-risk event.

It includes prepared strategies to ensure the continued operations should any possible disaster become a reality.

Take for example, companies that lost customers’ personal information to data breach.

They experience an outcry of displeasure and lack of trust by their customers which results in loss of customers’ business.

It is therefore important to invest in business continuity plan so as to ensure that your business does not suffer such consequences during disasters and high-risk events.

It is important to note that different companies have different necessities when it comes to business continuity; therefore, determining the best plan for your organization needs is of primary concern.

You should be able to determine the type of disaster that could affect your business and the degree of its impact.

You will then need to create a business continuity plan based on the company’s projected risk, potential damage or loss in financial terms, and your current capabilities in providing services to customers during the disaster.

The plan that you come up with should be one that allows you to provide key products and services when people are most in need of them.

A business continuity plan should include:

• Research and analyses of possible threats and assessment of these threats to your institution
• A list of the main tasks needed to keep operations going during a disaster
• A written strategy of how to quickly restore your institution’s operations once the disaster has subsided.
• Instructions for personnel safety in the event of certain disastrous events
• Information regarding data backups and cloud backups
• Instructions for collaboration between the different institutional departments
• Assigned responsibilities for each role

Disasters may range from natural disasters such as fires, hurricanes, earthquakes, environmental contamination and diseases etc. to manmade disasters such as terrorism or sabotage on financial institution’s infrastructure e.g. software programs, electricity generators and security systems etc.

Why is Business Continuity Important?

Business continuity is a vital part of protecting corporate assets and avoiding downtime.

The following are some specific examples as to why business continuity planning is so important:

1) The average cost of one minute of network downtime for an international financial institution is $20,000. That number may vary depending on other factors such as GDP or industry type. However, it’s easy to understand how quickly costs can spiral out of control.

2) An estimated $338 billion was lost worldwide due to natural disasters in 2010. It is predicted that these types of events will only become more frequent and intense as our climate changes.

3) A survey conducted by the Cloud Security Alliance found that 44% of respondents experienced a cloud security breach in 2013. In the same survey, the percentage of those that believe their cloud provider took too long to detect or resolve the issue was 59%.

4) A study conducted by Symantec Security Response found that 35% of organizations surveyed had been hit by malware attacks so severe they were forced to completely shutdown their business.

5) A study conducted by IBM found that 80% of organizations do not have a full-time designated staff member for continuity planning.

The takeaway is clear: Business continuity and disaster recovery plans are critical to help avoid the costs associated with downtime, as well as the potential loss of life and property damage resulting from natural disasters.

Business Continuity and Disaster Recovery Planning

Businesses that don’t prepare for disaster scenarios tend to pay a higher price in terms of costs and downtime.

By developing a Business Continuity and Disaster Recovery (BCDR) plan, you can help your company reduce the effects of such disasters and safely recover when they do occur.

The potential impact to institutional operations include:

• IT operations
• Recovery
• Productivity
• Lost revenue
• Technical costs
• Business disruption
• Damage to reputation
• Damage to business relationships

By being proactive with an effective BCP, you can avoid costly downtime to your institution’s operations.

This will help avoid paying for an unproductive team, frustrated customers and a damaged reputation.

It will also help you maintain good standing with your business partners, suppliers and vendors.

It is important to always stay ahead of situations by carefully planning for potential disasters.

This can be done through effective business continuity planning, backed by the right BCP solutions in place before an event occurs.

How to Develop a Business Continuity Plan?

Consider the following when creating a business continuity plan:

• Identify place of business location
• Assess the impact of a high risk events on your operations, people and infrastructure
• Identify your key products or services that are essential to your customers during a disaster e.g. ATM machines, online banking etc.
• Utilize software programs that will allow you to create templates for different types of disasters e.g. fire, flooding etc.
• Reach out to a team of experts in business continuity planning such as a third party expert compliance team
• Establish early warning systems that will allow your financial institution to take precaution before an incident occurs
• Establish relationships with suppliers, business partners and vendors who can help you during disasters e.g offering temporary office locations or information on available banking software programs for online banking during disasters

It is also recommended that you establish a business continuity task force to help develop the plan and approve the final version before it’s put into practice.

The members of this task force should include department managers, IT staff, security specialists and risk management team members, so it is important to clearly define each member’s role in creating and overseeing the plan.

Business Continuity Plan Aspects to Address

There are several key aspects that should be addressed in the development of your business continuity plan.

Critical Functions: Your team must determine which functions and services will absolutely need to continue operating during a disaster.

People: It is crucial to ensure that all necessary employees can work from another location, such as at home or in temporary locations until the business is up and running again.

Supplies: You’ll need to identify how your staff will access supplies, such as office equipment, products for customers etc., during a disaster.

Customers: It is important to consider how services will be rendered to your customers during disasters.

Strategy: Strategies used by the institution to carry out company operations during a disaster should be developed.

Organization: All factors connected to the management, communications of personnel and roles of personnel.

Defining Procedures: The procedures to follow during an event should be defined and communicated accordingly.

Testing Plans: A plan must be tested regularly to ensure it can accomplish its goals in the face of potential disasters.

Applications and data: Software required conducting business operations and ensuring staff have the tools needed to access data.

Processes: Processes linked to critical business processes and IT processes relied on for regular operations.

Technology: The infrastructure, network, equipment and hardware that is used for continuous operations and applications for data.

Facilities: The plan should include a disaster recovery site in the event the primary site is damaged, unsafe, or destroyed.

The Importance of Communication Within Your Business Continuity Plan

There are several ways that your business continuity plan should be communicated to team members.

Communicating the Plan by Department: In this scenario, each department has a person assigned to communicate the individual plans within that department.

Communicating the Plan Through IT: Your IT staff can provide necessary information through email blasts, intranet posts etc.

Implementing a Master Disaster Recovery Plan: The team responsible for the business continuity plan can create and maintain a master disaster recovery plan that is shared with senior management.

Documenting Your Processes: The processes in place to recover from disasters should be documented and well communicated through training sessions, staff meetings etc.

Daily Business Activities: Listed below are several activities your staff should complete on a daily basis as it pertains to business continuity planning.

Organizing Disaster Recovery Kits: Each member of the team should be responsible for creating and maintaining their own emergency kit at their workstation, as well as in the office.

Banking Affairs: Make sure employees are aware of which checks have cleared, which ones need to be voided and which ones are out for deposit.

Filling Out Insurance Claim Forms: Team members must learn where to find these forms, how to fill them out, who they can speak with etc.

Entering Emergency Contact Information: Make sure staff members have updated all of the necessary contact information in case something were to happen during an emergency.

Updating Contact Lists: These lists should be updated with the necessary information of all team members, including home addresses, work locations etc.

Creating Checklists for Daily Activities: Make sure your staff is properly checking off items on their daily to-do list. This will allow them to complete tasks according to priority and ensure nothing is overlooked.

Maintaining the IT Infrastructure: Ensuring software, hardware and servers are properly maintained is crucial to business continuity planning.

Testing Your Business Continuity Plan

It is important that your team tests their business continuity plan on a regular basis.

You can conduct these tests by role or department, as this will allow you to understand the weaknesses in each team member’s individual contribution to business continuity.

You can also choose to test the plan as a whole, which is known as full-scale testing, depending on how frequently you want to conduct tests.

You can use different methods to document your findings and solve any issues that occur while testing the plan:

Create a Drill Tracking Sheet: Use a simple spreadsheet to track the date and time of your drill, as well as who participated and what was covered during the test.

Create an After-Action Report: Ask team members participating in the drill to write up their own after-action report following completion of testing.

Complete an After-Action Review: A meeting should be scheduled with all department managers along with any staff members who were involved in the testing to discuss their findings.

Implement Ways for Your Business Continuity Plan to Automate Tasks: You can implement new technologies or software solutions that will allow your business continuity plan to run more efficiently.

This includes automated data backups, streamlining processes etc.

Reviewing and Updating Your Disaster Recovery Plan

No matter how well the institution is currently running, you need to ensure the organization is running optimally.

This can be accomplished by reviewing and updating your disaster recovery plan on a regular basis, such as every six months or at the end of each calendar year.

Although it may seem like an arduous task, these steps will become easier for you and the team with time.

As new plans are implemented and processes are streamlined, you can make minor changes to your plan.

Remember, when you are performing these steps, always put the customer’s needs first.

Outline software and hardware needed in case of emergency: These items should be plainly outlined on a list so that if an emergency were to arise, all members of the team would know exactly what they need to bring with them.

Properly testing the plan: Testing is necessary, but can be stressful if unprepared. You should create a drill tracking sheet that details who participated in the drill, what was covered and when it occurred so that testing becomes easier with time.

Reviewing results of drills to identify weaknesses: Look back on previous tests to uncover any weaknesses that you may have previously overlooked.

Identifying areas for improvement: Your team should always be working on improving weaknesses and implementing changes to the disaster recovery plan so that nothing gets missed. After all, it is a living document and should continue to evolve with time.

Implementing ways for the plan to automate tasks: It has never been more important for businesses to make themselves stand out in the current digital age. This means taking advantage of new technologies and software solutions that can streamline business continuity plans.

Factors that Affect Your Disaster Recovery Plan

When it comes to business continuity planning, there are many factors that can affect your disaster recovery plan.

Some of the most salient factors that you should remember when working on your disaster recovery plan include:

Size of Business: The size of the organization will determine which type of software solutions and hardware are needed for the plan to run smoothly.

Comprehensiveness: The more comprehensiveness your business continuity plan has, the easier it will be for you to recover from a disruption.

Compliance: Requirements for compliance vary depending on which industry you work in and where your company is located.

Staffing: Having an adequate number of staff members will determine the company’s ability to recover from a disruption quickly.

Costs: If your organization cannot afford the costs associated with business continuity planning, it may be best to wait until you can make changes to ensure this plan is in place.

Timeliness: A well-timed plan will produce the best results for any disruptions that occur.

Business continuity planning is vital to help ensure your business can recover from a disaster in the event something were to happen.

Conclusion

An excellent business continuity plan and disaster recovery plan are the best ways for your institution to remain compliant with current laws and regulations.

It will also provide peace of mind knowing that you are ready in case disaster strikes, so your customers can carry on their business without worrying about the security of their personal information.

Radd, LLC’s experienced professionals can help you create an effective BCP tailored to your institution’s specific needs.