• A February Nor’easter, also known as Winter Storm Nemo, that hit the Northeastern U.S. and parts of Canada, resulting in heavy snowfall and hurricane-force winds.
• Torrential rains in April that led to several deaths and severe flooding in Missouri and Mississippi.
• An outbreak of tornadoes in Oklahoma in May and June that resulted in widespread destruction and many fatalities, with related storms leading to record-breaking rains in North Dakota, New York, and Vermont.
In recognition of the June 1 start of the 2013 Atlantic hurricane season, bankers are encouraged to develop an emergency preparedness and recovery plan. For those who have a plan, review and refresh it based on updated risk assessments and the incorporation of lessons learned from internal testing.
Financial institutions play a critical role in helping customers and communities recover from major events. Therefore, there are regulatory expectations that banks have a business continuity planning (BCP) process to ensure they maintain or resume operations quickly. These plans should include:
• Recovery, resumption, and maintenance of all aspects of the business—not just technology components.
• Enterprise-wide scope with prioritization of business objectives and critical operations essential for recovery.
• Integration of the institution’s role in financial markets.
• Regular updates based on changes in business process, audit recommendations, and lessons from testing.
• A cyclical, process-oriented approach that includes a business impact analysis and a risk assessment, plus risk management, risk monitoring, and testing.
The Federal Financial Institutions Examination Council (FFIEC) requires that banks test their enterprise-wide BCP at least annually, with more frequent testing required when significant changes have occurred in business operations.
Test findings and results should be documented for internal evaluation and analysis by business lines and support-function management, and an independent third party. The results, including gaps and problem resolution, should be reported to the board and senior management, and to risk and IT management.
Following a review of the findings, it may be necessary to update the BCP program to address deficiencies or issues and incorporate lessons learned, as well as recommendations for enhancing future test scenarios.
While you can’t control Mother Nature, you can control how well your bank is prepared to withstand and recover from weather incidents.
For more information on regulatory expectations regarding the BCP process, see the FFIEC Business Continuity Planning Handbook, available at FFIEC.gov. Members can access ABA’s Emergency Preparedness Toolbox via the “Member Resources” section of aba.com.