Natural disasters such as floods, earthquakes, tornados, and hurricanes can happen anywhere at any time, so it is important that banks are as prepared as possible for these events. How can you be as prepared as possible for catastrophes? By implementing a good, workable business continuity plan. A viable plan begins with a comprehensive approach to risk assessment, so the most probable disasters can be considered. Such planning often categorizes threats on a scale from high to low, according to both their probability of occurring and the impact each could have on the bank.
One of the first exercises in the business continuity planning process is performing a business impact analysis. By identifying critical business functions and resources and establishing time frames for recovery, the business continuity planning team can prioritize recovery efforts. The business impact analysis helps provide an unbiased look at what really matters when disasters happen.
You’ll also want to determine how much planning and preparing is the right amount for your bank. Incorporating basic principles of sound business continuity planning, such as identifying potential threats, assessing their potential impact, assigning priorities, and developing planned responses is a must. We have tools to help with your preparation: check out our Business Continuity Plan Policy, Business Impact Analysis template and our recent webinar Developing Your Business Continuity Management Plan.
The agencies have also provided guidance on the matter which can further help the bank in both preparing and in response to such disasters. For instance, the OCC issued a bulletin suggesting banks consider waiving or reducing ATM fees, temporarily waiving late payment fees or early withdrawal penalties, restructuring debt obligations when appropriate (although generally not longer than 90 days), expediting lending decisions when possible, and originating or participating in sound reconstruction loans.
The FDIC issued similar guidance that highlighted the unique challenges created by natural disasters, including communication and power outages, destruction of facilities, and interruption in availability of certain branches and ATMs. History has shown us that banks should anticipate communications disruptions and difficulty of staff to reach a recovery area. Banks should consider establishing an alternative facility if a financial institution is damaged or destroyed, prepare for the need to operate only in cash, and recognize the bank’s potential to aid other local banks.
The focus of preparation should be the potential impacts rather than the sources of the threat and what type of disasters you’re potentially facing. A threat that presents a low probability of occurring and a low impact may not warrant much attention. However, every threat that poses a high adverse impact generally warrants further consideration, regardless of the probability its occurrence. Additionally, banks should regularly test disaster recovery and business continuity plans to ensure their continued effectiveness for responding to changing business and operational needs.
A disaster like the recent Hurricane Ian, although infrequent, serves as a reminder why banks should implement business continuity and disaster recovery plans and work to make creative solutions to address unforeseen difficulties quickly. It may be impossible to prevent or anticipate all disasters, but banks must prepare and practice for them.