Exercising For Safety And Soundness

Submitted by: Eryn Tribble

Yes, for the next year or two your bank examiner may make the mistake of crediting you for exercising your disaster plan when you documented an actual crisis but let s take a step back and think about this before we consider it a win .

Experiencing a crisis or disruption does not meet the standard for exercising your plan and should not be adequate to count as testing your plan for many reasons. Including:

Blood pressure checkUnder best practice continuity management guidelines it is clear that establishing and testing an exercise program is not the same as documenting events that threaten or impact the business. These are two separate best practices.

FFIEC examination guidelines state The board and senior management should establish a testing program appropriate for the size, complexity, and risk profile of the organization and its business lines . Passively experiencing crisis does not demonstrate a testing program has been established and, no matter what the extent of the crisis, will it be appropriate for the size, complexity and risk profile of the organization. In fact, it may be counter productive and make you look unprepared because you didn t plan a test.

Community banks are likely to have experienced 6-12 crises in a year. What makes this one particularly meaningful? Did you document the other ones? What are your standards for documentation?

Test objectives were not set or met (no, survival does not count) and only one part of your response plan was tested. The test was not comprehensive.

Since you weren t planning to experience this problem, exercise controls were not in place when you had it. You can only manage what you measure.

Hypothetically, would you consider going to the emergency room because you thought you might be having a heart attack to be an indicator for your ability to deal with stress? Technically the answer is Yes . However, that s certainly no way to live and if this is your common practice then it indicates you don t really have a good plan for your health. The same is true for your organization. Why have a heart attack to wait to check and see if your blood pressure is too high? It s easier to use a blood pressure cuff and check your heart rate.

Let s speak the truth: This is not the attitude of a healthy, mature business and will not, for much longer, meet requirements for safety and soundness.

Now, before you get frustrated, I realize you don t want to do continuity management this way. You have a LOT on your plate that you d rather be getting to (call reports anyone?) and you re just not sure where to get started. So, DCS has set up some fantastic tools to make planning exercising EASY for you! Get excited now and bookmark this for future reference! First, go ahead and log that problem you had on our FREE Crisis Event Log. It s got a couple of brief questions to help you get down the information you need to learn from and properly document the problem.

Next, use our FREE Strategic Road Mapto get an idea about what a good, well-rounded financial institution can do on to build operational strength. NO, you don t have to do that big fail-over test right away. We actually recommend against it. Start drilling the little things first. Can you guarantee that you can contact everyone when they re not at work? Try your call tree out and write down what happens. That s a great test!

Another quick tip is to see what your IT provider is doing to test regularly. We often find out the IT department regularly tests failover procedures but rarely documents it adequately for oversight or examination requirements. All you have to do is start documenting! It s easy! You can do that!

We have also started a new product line: DIY Turnkey Continuity. We re building very strong key kits for your continuity tool case at affordable prices. We ve started with a data breach kit and will be releasing an exercise kit before the end of the summer. For our BOL friends, we are looking for pilot users to test these at a discounted rate! Private message me if you re interested. Also let me know what other kits you re interested in. Pandemic, social media and vendor management are on our list for 2013.

I hope these ideas help out. We realize you are doing everything you can to keep compliant and the business moving in a positive direction. Please let us know what else we can do to make your job easier!

About the Author: Eryn Tribble is a certified Associated Business Continuity Professional (ABCP) who offers experience and expertise in Business Continuity Management.For more details visit

diyturnkeycontinuity.com

and

dcsplanning.com

.

Source:

isnare.com

Permanent Link:

isnare.com/?aid=1809682&ca=Business+Management