The Federal Financial Institutions Examination Council (FFIEC) expanded its focus from business continuity planning to business continuity management when it updated the Business Continuity Management booklet in 2019. The shift asks you to look beyond the plan itself and examine how resilience is built into operations, third-party relationships, testing, and management decisions.

For your community bank or credit union, that is more than a terminology change. Your business continuity program has to account for the services customers rely on, the vendors behind those services, and the point at which an interruption causes unacceptable harm. Five observations can help you apply the FFIEC business continuity guidance to your current program.

1. Resilience Starts Before Recovery

Resilience appears throughout the FFIEC booklet. The term describes an entity’s ability to prepare for changing conditions, withstand a disruption, and recover quickly. The disruption may come from a deliberate attack, an accident, or a naturally occurring event.

Traditional business continuity planning often concentrated on recovery after an outage. The updated guidance puts more attention on what allows a critical service to keep operating or limits the effect when it cannot. That includes planning for the loss of a service provider or another dependency before the interruption occurs.

Resilience belongs at the beginning of the business continuity management process. You should identify the controls, alternatives, and operating decisions that can reduce the effect of an outage rather than relying on recovery procedures alone.

2. The Guidance Reaches Beyond Financial Institutions

The booklet uses the word entity in places where earlier guidance referred to an institution. That broader language brings bank holding companies and third-party service providers into the scope of the discussion.

Critical vendors need to participate in your business continuity program. You should understand how your core provider, technology service providers, cloud providers, and other critical third parties prepare for disruption and restore service. A contract does not remove your responsibility to understand those capabilities.

This requires more than collecting a vendor’s continuity plan once a year. Your management needs enough information to evaluate whether the provider’s recovery assumptions support your own priorities and customer obligations.

3. Maximum Tolerable Downtime Replaces Familiar Language

The updated booklet uses maximum tolerable downtime (MTD) in place of maximum allowable downtime (MAD). MTD is the total period the system owner or authorizing official is willing to accept for a business process disruption after considering its effects.

In practical terms, MTD marks the point where recovery becomes impractical or losses become unacceptable. The underlying concept is close to MAD, and the booklet allows either term. Still, you should understand the updated language and be prepared to explain how your downtime limits were set.

An examiner may look past the label and ask whether your recovery priorities reflect actual dependencies, customer impact, and the time required to restore supporting systems.

4. Exercises and Tests Serve Different Purposes

The booklet distinguishes an exercise from a test. An exercise involves people and processes and validates part of the business continuity plan or related procedures. A scenario-driven tabletop session is one example. Participants work through a simulated event and practice the decisions and responsibilities assigned to them.

A test verifies the quality, performance, or reliability of system resilience in an operating environment. It may involve recovering a critical asset, confirming backup and restoration capabilities, switching to supplementary power, or testing circuit failover.

You need both. Exercises show whether your people understand the plan and can coordinate under pressure. Tests provide evidence that your technology and infrastructure can perform as expected. One cannot stand in for the other.

5. Guidance Still Shapes the Examination

The booklet states that it does not impose requirements. It describes practices examiners may use to assess an entity’s business continuity management function. Supervisory guidance is not the same as a regulation, and examiners cannot base an enforcement action on guidance alone.

Even so, the booklet tells you how examiners may evaluate the program. If you take a different approach, be ready to show why that approach fits your operations, risk, and dependencies. The burden is on you to make the reasoning clear and support it with evidence.

Following the guidance where it fits can make that conversation more direct. When you depart from it, your leadership should understand the decision, document the rationale, and confirm that the alternative still addresses the underlying risk.

The 2019 guidance gave you more to evaluate than a yearly plan update. It asks your leadership to look at resilience across the full program, including third parties, downtime limits, exercises, testing, and decisions that do not follow the booklet’s stated practices. Those areas should stay visible as your systems, vendors, and customer services change.