With the publication of the latest FFIEC Business Continuity Planning Booklet this past month, BC4SB continues to help credit unions meet the new regulations. BC4SB currently has over 700 credit unions using it to meet the FFIEC requirements as well as recommendations from the NCUA.

In total, over 1,200 financial institutions currently use BC4SB to build their business continuity plans, protect their assets and assure their members that they can depend on their credit union in times of crises. BC4SB is a strategic partner of CUNA Strategic Services. 

The new FFIEC BCP Handbook reiterates and strengthens the need for senior management and board involvement in the business continuity program. Since BC4SB is an online tool, it is accessible to anyone within an organization with an Internet connection and BC4SB’s plan approval feature ensures that the senior management and board are kept up-to-date on planning activities. 

The new guidance also advises credit unions to take into account pandemic planning. Each subscription of BC4SB comes with a pandemic planning module, which takes into account all activities needed to deal with response to this type of disaster. 

Included in each version of BC4SB are:

• A Risk Assessment and business impact analysis (BIA) module which be used to help identify risks and establish mitigation strategies. The booklet recommends credit unions conduct a BIA and risk assessment as the first steps for building a business continuity program.
• The online solution also includes strategies, procedures, tasks and recommendations for building plans according to the FFIEC booklet.
• The Test My Plan feature and many features of the product enable credit unions to meet the other requirements regarding plan exercising and maintenance.
• In addition, each subscription of PLANet includes a pandemic planning module, 24×7 support, standard reports, online training and access to Strohl’s archive of BCP information and monthly newsletters on planning.

1. Anticipate and Pre-Program Content - While the challenge of any emergency is to deliver unique and timely content, a significant portion of the content programming can be done in advance to anticipate needs.  Developing classes of content in advance can enable better use of proactive outbound systems, which will significantly alleviate the crush of inbound traffic during emergencies.
2. Spread Demand by Leveraging Virtualization and Multi-Agency Capabilities - Agencies that spread capacity across multiple agencies and facilities dramatically reduce peak load volumes.   The advantages of such an approach are seen in the growing use of 311 systems.   Bringing together multiple agencies helps streamline the emergency response process and funnel inquiries to a central source.   This creates a more efficient framework than independent responses from multiple public and private sources.
3. Overestimate Capacity Needs - Emergency access demands inevitably lead to spikes in volume.   Government organizations should err on the high side of expectations rather than cutting it too close when they estimate their capacity needs.
4. Incorporate Multi-Channel Capabilities - Five channels have emerged as the most important ones to support: e-mail, short-message system (SMS) text, self-service voice, live assisted service, and automated outbound calls.   The advantage of an integrated multi-channel approach is that it lets citizens enter the system from a variety of access points while still receiving consistent information and instruction.   Additional capabilities include fax support, integration with geographic information systems (GIS), and leveraging graphics capabilities such as 3G phones or video.
5. Leverage Emerging New Resources - A variety of new resources are available that most agencies have not yet tapped into, but should.   For example, in October, the U.S. government began establishing public-private partnerships with commercial mobile service providers to transmit emergency text alerts to mobile phones.  The Department of Homeland Security’s Federal Emergency Management Agency is acting as the agency that validates these emergency text notifications before they are sent to the commercial mobile service providers and then on to mobile phone subscribers.

In the last 12 months, British Standards have published the UK standard for business continuity (BS25999). This provides a comprehensive approach for organisations of all complexities. However, the vast majority of British businesses are small to medium enterprises (SMEs), for whom considerable interpretation of BS25999 is necessary, to successfully address their leaner organisational structures. Risk management publications and standards often ignore the SME sector; therefore this IIL study report has focused specifically on the sector. The study has researched how insurers treat business continuity in their evaluation of insurance proposals from SMEs.

The study also looks at what would make a difference in this process, as well as providing a simple approach to developing BCM for the SME. The approach is fully consistent with BS25999 but phrased in appropriate language and organisational requirements to suit SMEs. Furthermore, it includes an assessment methodology for both self and third party assessment. The study group members come from across the spectrum in relation to business continuity: insurers; brokers; advisers; practitioners; business. The combination has created a practical yet robust approach to BCM for SME businesses. The book, available very shortly, provides an excellent summary of the current position and valuable, practical guidance to businesses and the insurance community concerning BCM for the SME sector.