The devastation and loss due to Hurricanes Harvey, Irma and Maria should be a wake call for all financial organizations to have respective disaster recovery plans in place, but oddly the opposite sometimes holds true.
“Strangely these events do not result in immediate disaster recovery reaction,” said Kirk Drake, founder and CEO of Hagerstown, MD-based credit union service organization Ongoing Operations (OGO). “Usually two to three years after the event there is an uptick, but during that first year there is almost [no action].”
During and after Hurricane Harvey, OGO conducted a survey of Texas-based credit unions to assess average recovery times. A forthcoming report tracked 400 credit unions from when they announced they were having issues due to the storm, segregated by services such as e-commerce versus call center versus branch/headquarters.
“We watched each day as that week went on and what was is interesting is that compared to Katrina or Sandy, which we had six or eight credit union client declarations, this time we had one between Irma and Harvey,” said Drake.
The reason for this low impact is due to a substantial improvement in credit unions preparedness for these types of events, said Drake, adding that his firm has roughly 150 clients.
“We just didn’t see the impact from an IT perspective that we have seen historically,” said Drake.
Due diligence
In the majority of cases, being steps ahead of a disaster of any magnitude is the best way to ensure that an organization will remain operational, explained Scott Teel, CEO of the Denver, Col.-based Agility Recovery. His company counts 600 credit unions as clients, which represent 1,800 to 2,000 physical locations.
“During Hurricane Harvey we did recover roughly 12 clients in various capacities, but we don’t yet have the final numbers for Hurricane Irma because some organizations are remaining on alert status,” said Teel, speaking to CU Journal shortly after that storm.
Many of these “recoveries” are easy to remedy, said Teel. These include a phone redirection from an impacted branch to an operational branch. In other more serious cases, the company deploys generators and fuel.
“Some of these locations were totally flooded out, so we are recovering them in mobile branch units in the credit union’s parking lot,” said Teel. After major storms such as Harvey or Irma, takes a damaged credit union an average of 30 to 90 days to be fully back up and running, he added, but it could run longer depending on the scope of the damage and access to resources.
Over the course of a year, the average recovery time for all incidents — from a telephone interruption to a burned out building — is 14 days, said Teel. “Again this is just an average because some recoveries can take a matter of hours, while others can take more than two years,” he added.
Score cards
When working with a credit union client, Drake said the first step is to administer a “business impact analysis,” which provides his team with how much potential risk and in what areas of the business model.
“We recommend reviewing that every 18 to 24 months,” said Drake. “We also recommend table top exercises once or twice a year.”
All OGO clients receive a “score card” once per quarter that is juxtaposed against the disaster recovery solutions administered at other credit unions to determine best practices.
“If we see one accounting department that has a silly recovery strategy, it will be marked poorly in the score card and then we take deliberate action to help that credit union improve that area of the plan,” said Drake.
In Drake’s experience, 70 percent of CU departments take disaster recovery plans seriously. The other departments, he said, are more lackadaisical.
“In most cases the 30 percent is comprised of branches and member service representatives that seems to take it less seriously because they may feel it doesn’t add to their productivity,” said Drake. “But if you take accounting or IT, the discipline that comes out of managing a robust disaster recovery plan adds a lot of value in how they manage risk in other areas of the business.”
Pushing DR plans to the limit
While recent hurricanes have brought a focus on disaster recovery plans and efforts, Teel said there are a lot of different causes of communication and power interruptions.
“This is not what credit unions should be thinking about, it’s more about how they are going to recover these two elements to branch locations,” said Teel. “The cause of the event is less important to how you plan to recover from the event.”
To ensure a credit union is ready for anything, Teel said CUs should annually push existing disaster recovery plans to the absolute limit.
“Come up with scenarios that you know that your plan might fail and try to work toward situations that can overcome those failures,” said Teel. “Football teams continue to practice throughout the season; they don’t stop practicing after preseason. The same approach applies to [disaster recovery] plans.”
