Editor's note: this letter is in response to "
Let's talk a minute or two about IT backup being the beginning of your disaster planning. I absolutely agree with the author that it isn't enough, but for a different reason. While IT backup is critical, it isn't the beginning of your planning, but rather the culmination of a business continuity planning process. Good business continuity planning is really business planning rather than IT planning.
In order to understand this difference, what we really need to ask is, "What are we trying to do with our planning?" That is the most important question-and the answer depends on your mission statement. Most credit unions, if asked what their mission is, will recite something like, "Our mission is to serve our members with professionalism, dignity, and efficiency!"
I think the mission should be more like, "Our credit union's mission is to safeguard our members' money and provide it to them when they need it." Everything else we do is gravy. Although credit unions like to think of their members as their "owners," the truth be told, most credit union members don't have the brand loyalty we like to think they do. These days credit unions have to cajole, convince, and confirm to members that their money is safe, and available when they need it, even during a disaster.
That leads us back to the disaster planning question of the article. To support the mission as I've stated it, business continuity planning should be focused on providing backup capability for three things: people, places, and processes. It's what I call the Three Ps.
People are critical because they are the interface to your membership. They are the ones who facilitate the transactions. They are the ones who assure members their money is safe. They are the ones who do the work in the credit union. If all your tellers go to their favorite watering hole to celebrate Suzy's birthday and all come down with ptomaine poisoning and are out for a week, who will serve your members? You've got to plan for that continuity now as opposed to "recovery" after the fact.
Places are what we refer to in the business continuity industry as "butts and chairs." People need a place to work. That means desks, chairs, phones, pencils, paper, post-it notes, and a roof over their heads that is preferably heated in winter and cooled in summer. If you don't believe this is critical, ask your sister credit unions who set up teller stations on folding tables in the parking lots of their credit unions following hurricane Katrina.
Processes are what you actually do. You have many processes, some of which are more time critical than others: accounts payable, payroll, teller operations, lending, collections, ATM operations, human resources, marketing, and training. The time criticality of these processes is what determines your recovery times. Although many of the primary processes you do are automated using IT support, the backup processes don't necessarily have to be. For example, tellers can operate off-line using printed trial balance reports. Loan applications can be taken manually. Yes, IT backups are important, and communications to your core processors are critical. But IT isn't a business process; it is a tool the business owners use to do the work more efficiently. Focusing initially on IT in your planning is putting the cart before the horse.
Yes, it is the focus on the three Ps that should form the basis of the business continuity planning. There are tools and methodologies that make sure you get it right-risk assessment, business impact analysis, strategy selection, and exercising the plan. But in every case, planning should begin with the owners of the business processes, not come back to them after IT has announced that they have backup schedules. This brings us back to the title of the article-if the beginning of your disaster planning is your business processes, those IT backups will follow as a logical consequence. Remember my suggested mission statement? Only business process planning will ensure we meet it, whether under normal circumstances, or during a crisis.
And in the end, that is what your members want and deserve.
Ken Schroeder, VP-Business Continuity
Southeast Corporate FCU, Tallahassee, Fla.
LETTERS TO THE EDITOR
Credit Union Journal encourages reader feedback. Letters to the Editor can be sent to Managing Editor Lisa Freeman at
