You probably already have some kind of business continuity plan in place. The harder question is whether it’s recoverable, compliant, or both, because those aren’t always the same thing.

In November 2019, the Federal Financial Institution Examination Council (FFIEC) updated its BCP IT Examination Handbook and expanded its focus from Business Continuity Planning (BCP) to Business Continuity Management (BCM). The change makes sense: “planning” is only one part of the business continuity process. Business continuity management encompasses the entire process by integrating resilience, incident response, crisis management, third-party integration, disaster recovery, and business process continuity.

As a community bank or credit union, you’re required to develop a compliant business continuity plan that identifies your business processes along with their interdependencies, providing resilience to, and recovery from, all potential threats to your institution. BCM is designed to help organizations, regardless of size, location, or activity, minimize the impact of disruptions of any kind, natural or man-made, including cyber.

The new BCM guidance represents the first major update since 2015 and calls for all “entities” to rethink their approach to business continuity and be prepared to make appropriate plan revisions to meet these expectations. Entities are defined as depository financial institutions, nonbank financial institutions, bank holding companies, and third-party service providers. The use of this term is significant, as it pulls all interdependencies into the planning process.

With so much at stake, here’s what you need to understand about the BCM process and the key requirements for building your business continuity plan:

• Regulatory requirements relevant to a compliant BCM Program
• How to develop the business continuity management plan (BCMP)
• Pandemic planning and business continuity strategy
• The importance of integrating vendor management into the BCMP
• Steps to effectively update and test the plan
• The benefits of automating the BCM process

Regulatory Requirements

To comply with regulatory expectations, you’re required to focus on an enterprise-wide, process-oriented approach that considers technology, business operations, testing, and communication strategies that are critical to business continuity management for your entire organization, not just the information technology department. Regulations make it clear that you need to plan to perform your critical business functions, even if technology may be impaired or unavailable.

Auditors and examiners are also scrutinizing business continuity plans to verify that your methodology and plan structure closely adhere to the 2019 regulatory guidance. A key change in the guidance is the increased focus on resilience. Resilience is the ability to prepare for, and adapt to, changing conditions and both withstand and recover rapidly from disruptions, whether that includes deliberate attacks, accidents, or naturally occurring threats or incidents. Two keys for understanding resiliency are the terms “withstand” and “recover,” with an emphasis on withstanding adverse events. In the past, business continuity planning has been focused more on recovery, but now the FFIEC has placed a heavy focus on resiliency. The goal is for you to be more proactive and minimize having to implement traditional recovery measures down the road. When going through the BCM process, build resilience in from the very beginning to successfully meet regulatory expectations.

How to Develop a BCMP — What to Include in the Plan

You likely already have some sort of BCMP in place. The question we raised earlier, whether it’s built to be both recoverable and compliant, comes down to what’s actually in it. With the new changes to the guidance, you may be wondering what specific changes you’ll need to make to meet these new expectations.

Your plan should consist of all the steps required to ensure key products and services remain available to your customers or members. The BCMP consists of five phases: risk management (Business Impact Analysis, Risk/Threat Assessment); continuity strategies (Interdependency Resilience, Continuity and Recovery); training and testing (exercises); maintenance and improvement; and board reporting.

Your BCMP should be a “live” document that keeps pace with any changes in infrastructure, strategy, technology, and human resources. As soon as your plan is board approved, test it, and initiate a new draft plan. At any point in time, you should have both an approved plan and a live draft to accommodate changes.

Pandemic Planning and Business Continuity Strategy

In the past, you were required to have a separate pandemic plan, but the new FFIEC guidance instead expects you to assess and manage pandemic risk alongside all other possible disasters. This means your BCM plan is the pandemic plan, and you must analyze the impact a pandemic can have on your organization, determine recovery time objectives (RTOs), and build out a recovery plan.

Pandemic planning is different from natural disasters, technical disasters, malicious acts, or terrorist events, because the impact of a pandemic is much more difficult to determine due to differences in scale and duration. Pandemics also directly impact your institution’s and third-party employees rather than targeting infrastructure or technology-based interdependencies. Cross training and succession planning should be a key part of your pandemic planning process to ensure operations can continue even if key individuals are unavailable.

FFIEC guidance states that your BCMP should include five key elements to address the unique challenges posed by a pandemic event:

1. A preventive program including monitoring of potential outbreaks; educating employees; communicating and coordinating with critical service providers and suppliers; and providing appropriate hygiene training and tools to employees
2. A documented strategy that provides for scaling the institution’s pandemic efforts to align with the current six-stage CDC framework
3. A comprehensive framework of facilities, systems, or procedures that provide the organization the capability to continue its critical operations in the event that large numbers of the institution’s staff are unavailable for prolonged periods
4. A testing program to ensure that the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue
5. An oversight program to ensure ongoing review and updates to the pandemic plan

The Importance of Integrating Vendor Management into the BCMP

You likely rely on third-party service providers, or vendors, to conduct business on a day-to-day basis, like most banks and credit unions today. When you outsource key functions to a service provider, it creates a reliance on that third party and exposes your institution to the risk of not being able to resume operations within pre-defined recovery time objectives in the event of a disruption. The FFIEC now expects critical third-party providers to be active participants in your BCM program, and it’s likely that regulators will require you to have a detailed understanding of the resilience capabilities of your core/technology service providers, cloud providers, and others moving forward. When creating your BCMP, you have to account for all interdependent third-party relationships and identify the potential consequences a third-party disruption might have on your operations.

The criticality of the product or service the vendor provides is directly related to the criticality of the dependent process it supports, as identified by your business impact analysis. Some questions to consider include:

• How important is this vendor to what we do?
• If they fail, how many of our dependent services would be negatively impacted?
• How challenging would it be to replace this vendor?

Vendor criticality is expressed in terms of Recovery Time Objectives (RTOs), and you assign the same RTOs to the third-party vendor as you have to the underlying process the vendor supports. If you’ve identified a two-day recovery time objective for a particular process, any underlying vendors will also inherit that same two-day RTO. In the event that a vendor cannot match that RTO, validated by testing, you must have a contingency plan in place, such as alternative procedures or providers, to compensate for the gap.

Successfully integrating vendor management and business continuity planning is essential for you to understand your actual recovery capabilities by validating whether or not your third-party providers have sufficient recovery capabilities to meet your recovery objectives.

Importance of Exercises and Tests When Updating the BCMP

Exercises and tests are important parts of the process, and your BCMP is not complete until the plan has been thoroughly tested. The handbook makes an important distinction between exercises and tests in the BCMP process, defining an exercise as a task or activity involving people and processes that is designed to validate one or more aspects of the BCMP or related procedures. A test, on the other hand, is performed to verify the quality, performance, or reliability of system resilience in an operational environment. The handbook emphasizes the importance of both exercises and tests to demonstrate resilience and recovery capabilities.

Exercises and testing verify the effectiveness of your plan by validating all recovery time objectives, help train your team on what to do in a real-life scenario, and identify areas where the plan needs to be strengthened. Examiners are also verifying that your BCMP has been tested and that you’re able to execute the plan if and when the need arises. Because the financial industry is considered part of the nation’s critical infrastructure, testing, exercises, and training will continue to be a focus going forward.

Every test should start with a realistic scenario drawn from the top threats identified by the risk management phase of your planning process. Top threats are those determined to have both high impact and high probability ratings. While initial testing of a plan can be relatively straightforward, you should strive to extend the scope and severity of the exercise with each consecutive test, making the tests consecutively more complex and including different individuals. Conducting the very same test with the same participants every year will not satisfy examiners, nor will it give your management the assurance it needs.

In addition to the senior management and information security roles defined in your plan, your testing team should include key department heads with detailed knowledge of the processes and functions impacted by the scenario. Tests should cover the steps departmental managers must take to complete functions manually or in an alternate way, and all departmental specialists should be included in your exercise and testing program. There are two reasons for that: the first is so they’re familiar with alternate procedures in emergency scenarios, and the second is to make sure you have backups, or successors, to your primary recovery resources. Succession planning is another hot-button item with examiners now because of the pandemic.

While regulators require proof of exercises and testing annually, more frequent testing is indicated whenever a previous test uncovered significant gaps in your plan, or if there are significant internal changes to processes, infrastructure, or personnel.

Automating the Planning Process

To help streamline this time-consuming process, you can automate repetitive portions of business continuity planning. Automating these activities eliminates the need to update cumbersome spreadsheets and manually copy and paste information from various reports and previous assessments. The 2019 guidance requires a number of changes to your existing plan, some subtle and some significant.

An automated BCP solution will also help guide you through the entire BCMP process, ensuring that all required elements are included as they’re necessitated by regulatory guidance changes. Automating the planning process makes it easier and much less time-consuming to perform your annual plan updates, allowing static portions of the plan to carry forward while incorporating changes wherever necessary. Any automated solution should also make it possible to identify all material plan changes from year to year, so your management and board approval is easier.

Conclusion

Business Continuity Management is a critical process for your bank or credit union, regardless of size and location, and your plan is central to that effort. To streamline the planning process, integrate business continuity into all business decisions, conduct periodic reviews of your plan, and perform regular testing. Everyone in your organization, from the tellers to the board, should understand the importance of business continuity planning and how their unique role fits into your institution’s overall business continuity strategy.