When the unexpected happens. (Fundamentals).

A business disruption can be as simple as a power failure or as complex as a terrorist attack. Regardless, you will need to have a plan to minimize interruptions to both your bank and your customers. Marketers have a role in this readiness process.

In a scene that could only be imagined by a Far Side cartoonist Gary Larson, office buildings burned while flood waters swirled several feet deep, preventing firefighters from battling the blaze, On April 18, 1997, after a winter of record snowfall, the swollen Red River of the North breached its banks and flooded Grand Forks, N.D. Within hours, a catastrophic fire erupted, burning 11 buildings in the center of old downtown. Three of the buildings belonged to the First National Bank.

The effect of the disaster could have been catastrophic for the bank. Fortunately, however, as the waters rose on Friday night, the bank moved its computers to a branch office 80 miles away. Employees who had sought safety in local shelters or left the area were contacted and mobilized. By Saturday night, the bank's main offices were gone, but its computer systems were up and running, along with much of the bank's supporting operations.

While many banks have planned for the worst, it's doubtful that many of them have considered the likelihood of a disaster of this magnitude. Although they might be able to recover from a minor business interruption without a formal plan, all financial institutions require comprehensive planning in order to respond to a catastrophe. Such plans are not only prudent, but also are required by bank regulators. Unfortunately, many disaster-recovery plans don't go far enough. Some rely on their data services provider to develop and maintain contingency plans. Others prepare only cursory plans or only make plans for the recovery of data processing operations--without considering such issues as telecommunications, office space for critical operations or the effects on their customers.

Disaster planning is an area that marketers can play a role, particularly in regard to such important issues as media management and public relations.

Beyond planning for the recovery and restoration of data-processing services, banks must also consider a number of other issues in order to develop a comprehensive, effective crisis response and business resumption plan, including developing:

* An organization to develop, test, maintain and execute the plan.

* An assessment of the threats to continued operations.

* Plans for responding to a crisis and determining the appropriate parts of the business resumption plans to activate.

* Plans for restoring the operations of individual business units such as accounting, deposit operations, loan operations, trust and others.

* Plans for maintaining and testing disaster recovery plans.

Organizing to plan

A first step is to identify the bank personnel who will be responsible for preparing and maintaining crisis response and disaster recovery plans. These people are typically business unit managers most responsible for day-today operations. Their primary responsibilities are to identify the potential business disruption threats, determine the most critical operations within the bank, prepare the necessary plans to respond to a crisis-including mobilizing personnel-and maintain and test the plans. The person who will manage the effort will be called the contingency planning manager. For this position, you need to identify someone who commands enough respect within the bank to get the job done. While most banks designate the technology manager for this role, other managers can be just as effective.

A second group of managers should be designated to serve as the emergency management committee (EMG). These are typically the most senior managers, charged with evaluating the disaster and deciding which response is the most appropriate, given a particular disaster scenario. The EMC will be responsible for deciding what actions are most appropriate to take and when--and to what extent--to activate the disaster-recovery plan. For example, notifying the computer hot-site provider that the bank is declaring a disaster may result in a significant expense, even if three hours later the bank determines that operations can be maintained at the current location.

EMC members are also primarily responsible for media management and public relations during a disaster. A marketing professional should be involved in creating a media management plan in connection with the disaster-recovery plan. All communications with the press and regulators during the disaster should flow through the EMC.

It is important that EMC members be provided a place to meet, away from those areas most likely to be affected by a disaster. Designate specific people, an assessment team, to evaluate the nature and extent of a problem and to keep the EMC informed as the crisis situation develops.

This is also a very good time to begin identifying the various business units in addition to data processing, throughout the bank, that will require a business resumption plan. These business units include deposit operations, loan operations, electronic banking, wire transfer, accounting, trust, international operations, human resources and the branches. Designate a business unit manager and an alternate to be responsible for developing the plan for each of these areas.

This is also a good time to recognize that the organization required to restore operations will be quite different than the one required to support day-to-day operations. Each of the business units will need assistance in relocating to new offices, finding critical documents, and setting up computers and telecommunications. They may also require extraordinary physical security, such as on-site guards, fireproof file cabinets and other equipment--as vaults, safes and alarm systems may not be readily available in the relocation sites. Develop an organization to execute the business resumption plan that includes not only the EMC, assessment team, contingency plan manager and business units, but also support teams, such as voice and data communications, computer user support, security, personnel, purchasing and transportation. These functions will be critical.

Assessing business disruption threats

The potential threats that might interrupt financial institution operations, both during and after normal business hours, are many. They include computer equipment failure, telecommunication failures, fire, flood, tomado, hurricane, earthquake, electrical outage, terrorism and civil disturbances. No plan, however, can address every potential threat or combination of events.

In conjunction with assessing threats, determine which business units and which services or business processes within those units are the most critical. It may not be costly to forego processing a loan application for three or four days, but not processing checks for that period of time could be costly. In making this assessment, consider the potential dollar impact of disrupted operations, the impact of the disruption of a particular service on customers and the availability of internal and external resources to restore them.

Assign priorities to each business unit and to their respective services. This information will be invaluable in determining which business units to restore first and how to allocate scarce resources, such as office space, telephones, fax machines, computers and support personnel.

When assessing threats and the criticality of business units, consider the following:

* What is the probability the threat will occur?

* How much warning time will the bank have of the threat?

* Will the effect on on-going operations result in a significant disruption extending more than three days?

* To what extent will critical customer services be affected?

* What will the costs to restore operations be?

* Will relocation sites and replacement equipment readily be available?

Also, consider the unusual. For example: What happens if one of the bank's vendors--let's say its Internet services provider--is hacked or attacked in such a way that it cannot continue to provide service to the bank, and hence the bank to its customers? Is this considered in the disaster planning effort? It should be since threats to computer operations and services are growing daily.

Developing business resumption plans

Once potential threats are understood and critical operations have been identified, develop appropriate responses. Keep in mind that responses to different threats are often similar. For example, it matters little if the central operations center cannot be occupied because of a fire or tornado. Those operations must be relocated regardless. A great deal of effort is often wasted trying to tailor a specific plan to meet every imaginable threat or crisis. First Interstate Bank of California attributed its successful response to a 1987 fire to its earthquake disaster planning and testing.

To provide a framework for developing plans, you must make certain assumptions. For example, major emergencies--such as fire, utility failure, and weather-related disasters that could last for several days, significantly interrupt operations and require relocation of a significant number of employees--become a primary focus of the plan. Other assumptions might be made, such as:

* Only one facility will be affected at any given time.

* The banks disaster-recovery hot site will be available for use.

* The majority of the bank's staff will be available to implement recovery plans.

* Needed replacement equipment, such as desktop computers, telephone equipment, modems, servers, and so forth, will be readily available.

* Outside resources, such as temporary personnel and technical assistance will be readily available.

Making decisions about these assumptions is important, as banks do not have unlimited resources to provide for business resumption.

Key to the development of business resumption plans is knowing what services need to be restored and in what priority--and what people, office space, equipment and information are required to restore them. In addition to having each business unit identify its critical services and functions, have them identify the minimum amount of office space they'll need to relocate those functions to, the critical personnel that will be required, and the minimum, critical equipment they'll need when they get there. Relocation space can be obtained from a variety of sources, included unused or underutilized space in existing bank buildings and branches or in hotels and temporary, leased office space. Options for relocations sites also include: (1) hot sites, locations prepared with furniture, telephones and computers for a specified number of people, (2) warm sites, locations which are unfurnished or sparsely furnished and cabled for phones and computers but not yet equipped with them, and (3) cold sites, empty office spa ce with no cabling. The key is to identify these spaces, and which business units will be relocated there, before the disaster occurs. This information is also critical to the support teams in preparing for disasters.

The following elements are also critical to any response plan:

* Procedures for notifying key personnel, mobilizing them and transporting them to the appropriate site to begin business resumption activities.

* Identification of forms, supplies, key reports and customer or accounting information that will be needed at the relocation site.

* If the bank is highly centralized, specific plans might be developed for relocating all main office or central operations personnel and operations to relocation sites. Plans might also be developed for the failure of the bank's data processing center or central operations area. Problems at these locations may not require relocation of the entire bank's operations and administrative staff, only those connected with the disrupted operations. Specific plans might also be prepared for evacuating and relocating a single branch office facility.

* You should not ignore short-term emergencies in the planning process. The potential impact from even a short-term disruption can be significant. And worse, sometimes short-term problems grow into larger problems. The failure of one unit in an electrical substation in the Chicago Loop in 1999 was considered to be a "short-term" problem. However, by the end of the day, the entire substation had failed and power was disrupted in the entire business district for an extended period of time. Plans should be prepared for addressing such evolving situations by the EMC.

It is important to remember the human element in crisis response plans. A disaster may strike while employees are at work. It is critical to develop evacuation plans for all business units, as well as other life safety plans for responding to incidents like bomb threats and medical emergencies. Designate fire wardens to lead evacuations and searchers to make sure no one is left behind when a building is evacuated.

Communicating with customers

As important as it is to begin restoring your bank's operations after a disaster, it is equally critical to keep customers aware of what is happening. When Hurricane Bob struck New England in 1992, it disrupted electric service in many communities. By chance, electric service in one Massachusetts community was restored on one side of Main Street before it was on the other. Unfortunately, a bank that was rumored to be in regulatory and financial difficulty was located on the side of Main Street where service was not restored. When banks on the other side of the street reopened--and the one did not--customers were certain that the regulators had intervened. A good deal of effort was required to reassure some customers that this was not the case.

Marketing's general role is to help build the value of the bank. During a crisis, marketing's role is to preserve the value of the business, and in that regard, its function is to communicate with customers and others. A media management plan that includes the following simple steps will help ensure that the bank's story is accurately portrayed and that customers are not left in the dark during an emergency:

* Designate spokespeople to handle requests for media interviews or otherwise deal with the media.

* Train spokespeople to handle interviews and media contact.

* Establish communications procedures to ensure that media inquiries are directed to the appropriate spokespeople and make sure bank employees are aware of them.

* Develop contact information for local media outlets, such as radio, television and newspapers so that the bank can provide them with current and updated information on its situation.

* Develop a listing of key customers, regulators, shareholders, suppliers and others who should be directly contacted in the event of a crisis or disaster and assign specific personnel to contact them. Make sure these personnel report the results of their efforts to contact these people.

* Prepare and maintain media kits that include appropriate general information about the bank, such as history, key officer profiles and photographs, current financial information, camera-ready logo and other appropriate photographs. The media kit should also include specific disaster recovery information, such as alternative telephone numbers to contact the bank, addresses of offices handling business for sites affected by the disaster, operating hours and other pertinent information.

You may not want all employees to assemble immediately after a disaster as they may only impede the recovery. Also, all critically needed employees may not be reachable by telephone or able to travel to a relocation site. Prepare employee information for broadcast over local media. This information should include assembly sites for employees requiring transportation to relocation sites or other instructions that can safely be relayed by general broadcast media.

Maintaining and testing the plans

Crisis response and business resumption plans are useless unless they are updated and tested, and personnel have been trained to execute them. Update the assessments and plans annually. Communicate them to all personnel and make sure that they understand their role in an emergency. Make the plan easily accessible over an Intranet or in manuals. Train personnel to execute the plan by holding mock evacuations and mobilizations, For example, execute the calling tree during an evening to determine whether all critical personnel can be contacted. Determine how long it actually takes to reach and mobilize them.

Test your computer backup plan annually, if not more often. Be sure also to test the data communications between the computer hot site and some of the more critical business unit relocation sites. Timely restoration of data processing and telecommunications will be critical when an emergency does occur. Test the entire plan by assembling the business unit managers, support team managers, EMC and assessment team members. Have the contingency planning manager walk the entire group through a simulated emergency and ask them how they will be affected by it and how they will respond. These simulations can reveal gaps in the plan, as well as serve as a valuable training exercise for the crisis-management team.

Emergency situations can happen without warning. When they do, there is little or no time for planning and organizing emergency response and business-recovery efforts. While the majority of disasters cannot be prevented, financial institutions can minimize their damage and restore operations more expeditiously by preparing, maintaining and testing comprehensive crisis-response and business-resumption plans.

HOW USEFUL WAS THIS ARTICLE?

Please use the postage-free Reader Opinion Card provided in this issue or leave a message at [phone]. You can also send comments by e-mail to [e-mail].

RELATED ARTICLE: Sidebar

A9/11 Disaster Recovery

The New York branch of Commerzbank AG was among those financial institutions that were able to continue business operations despite the terrorist attack last Sept. 11 at the nearby World Trade Center.

Commerzbank deals in wholesale banking for corporate and institutional customers as well as banks. More than 400 of the company's employees worked at New York's World Financial Center, which was flanked to the east by the World Trade Center.

While chaos filled the streets of Manhattan, Commerzbank employees maintained operations of the company's financial systems, with no indication of downtime to its customers--all due to a disaster-recovery project that was started only nine months earlier in December 2000.

The program was intended to ensure 100 percent data recovery with minimal downtime. The Commerzbank developed the plan with the assistance of consultants from Oracle Financial Services.

"Any significant downtime or data loss would have had a devastating effect on our new business development, credit rating, portfolio management, risk management, capital allocation, budgeting, and forecasting,' noted Gene Batan, vice president of systems and information technology, Commerzbank, North American region.

The objective was to replicate Commerzbank's core operations in a remote site.

Over a dozen persons worked through the summer with the goal of completing implementation by mid-October 2001. By September, explained Batan, every transaction logged from any location through the main data center in New York was immediately synchronized to the recovery site to prevent data loss. In the event that the main data center in lower Manhattan shut down, all applications would be accessible from the remote site.

Rapid recovery

While computers and other equipment at the World Financial Center initially continued to run on September 11, they relied on battery and generator power and shut themselves down later in the day.

"When disaster struck, the new system was still in the testing phase. Regardless, we were able to work successfully from our remote site, a full 45 days ahead of the planned project completion date."

The organization recovered all data and had all its production systems up and running again that evening at the business continuity site, located 30 miles outside the city. Commerzbank customers experienced no noticeable delay. 'Without our redundant systems in place, we most likely would have relied on a tape backup. This process could have taken a few days to as long as a week to complete," added Batan.

Ken Proctor is a senior consultant with Alex Sheshunoff Management Service, L.P, Austin, Texas. Telephone: [phone], extension 681. E-mail: [e-mail]