Planning for Continuity

Rather than rely on disaster recovery plans to pick up the pieces after a business disruption, banks are shifting their focus to business continuity plans to keep operations running through a disaster.

Following the terrorist attacks of Sept. 11, 2001, the banking industry realized that no business is immune from catastrophic events. The severity of the 2004 and 2005 hurricane seasons, however, taught financial institutions that disaster recovery programs alone cannot protect their businesses, forcing banks to reevaluate the strength of their backup plans.

With the destruction wrought by Hurricane Katrina still largely visible, banks have renewed their focus on preparedness as they rethink their risk management strategies and bolster their business continuity plans.

"These events forced banks industrywide to take a long, hard look at how effective their disaster recovery plans might have been in these instances," says Michael Croy, director of business continuity for Forsythe Solutions Group, a Skokie, Ill.-based provider of technology infrastructure solutions, of the severe hurricanes that hit the United States in 2004 and 2005. And financial institutions that were directly impacted by these brutal storms learned firsthand how unprepared they really were, he adds. "Damage [from Katrina] was so severe in certain regions that some banks couldn't bring up applications until January [2006]."

Even more sobering are predictions that some organizations may never recover. Several industry sources cite research that predicts that 90 percent of unprepared companies that suffer 10 days of data center downtime for any reason will be out of business within a year.

"Every minute of downtime—planned or unplanned—costs the institution more than just millions of dollars," explains Mark Vanston, senior adviser for business continuity and enterprise risk strategies for Palo Alto, Calif.-based Hewlett-Packard (HP). "It can also cost them the confidence of those who depend on that institution. This includes customers, suppliers and business partners."

Thus, the banking industry now strives toward the lofty—though critical—goal of business continuity. Rather than rely on disaster recovery plans that help them get back to work after a catastrophic event, banks are focusing on business continuity plans, frameworks that are established to keep them operational in the first place. While these plans clearly highlight the importance of hot sites, banks also have learned that Web-based communications networks and imaging solutions could be the tools they need to survive a catastrophe.

The Best-Laid Plans

Even the best-laid plans can encounter unexpected challenges. So experts suggest that banks update their business continuity plans on a quarterly basis and regularly test their continuity frameworks.

"Business continuity exercises are a must to ensure [their] effectiveness," says Romir Bosu, CEO for CompuShare (South Coast Metro, Calif.), a provider of information technology consulting and solutions for the financial services industry. "A battery of potential scenarios guides staffs through mock recovery plans. This ensures their effectiveness."

Thus, management teams are strategically restructuring their plans to account for every possibility. "Every scenario, every possibility needs to be accounted for," says Kim Waller, managing director for Scarborough, a division of Financial and Professional Risk Solutions, the Chicago-based holding company that is owned by Aon Corp. "Drills need to be exercised and plans need to be put into action. This will ensure that banks can get back to business and take care of their customer commitments."

Galveston, Texas-based Moody National Bank ($860 million in total assets) clearly understands the importance of business continuity planning and testing. After escaping the 2004 hurricane season unscathed, Moody executives didn't want their luck to run out. "We hadn't touched our plan in awhile, so we began updating it at the end of 2004," recalls Betty Bisesi, the bank's assistant vice president, IT operations manager. "By February 2005, we had a [new] plan in place," she continues. "Using the plan as a guide, we began running exercises with upper management and acting out mock scenarios within each department."

Moody's efforts paid off when Hurricane Rita threatened Galveston in mid-September 2005. When the Texas island was evacuated, Moody sprung its continuity plan into action with the help of Jack Henry & Associates' (Monett, Mo.) Centurion Disaster Recovery division, which maintains 10 business continuity hot sites across the United States. These pseudo-branches are outfitted with telephone lines, Internet connections and hardware and software that enable a small staff to service customers. Before Rita hit in the predawn hours on Saturday, Sept. 24, Moody set up shop at a Jack Henry/Centurion hot site located in Lenexa, Kansas.

"We normally do our annual testing at the hot site located in Allen, Texas. However, we could not use it in September because there were Jack Henry New Orleans customers already at the hot site," Bisesi explains. "We were able to open some branches for business on Sunday."

Hot to Trot

Jack Henry isn't the only technology provider that offers banks the use of hot sites. Taking a proactive approach toward business continuity, HP has invested $100 million to build what it calls business continuity and recovery centers. Designed to get customers back up and running in minutes, these secure facilities help banks proactively maintain, recover or resume their critical business processes following virus attacks, natural disasters and other unforeseen events, according to HP's Vanston. Currently, 76 facilities operate in regions across the Americas, Africa, the Middle East, Asia Pacific and Europe, he notes.

"These new centers offer an adaptive infrastructure that helps our customers to manage change, while reducing complexity and cost," asserts Vanston. "Our centers address our increasing customer demand and help our customers build a resilient IT environment that can easily accommodate tomorrow's needs," he adds. "HP's mobility solutions also allow employees to connect to systems and data remotely in case of a disaster."