The Resilient Credit Union By Kenneth Schroeder MBCI, MBCP

OK, the auditors just left. You got glowing marks for your asset management, your interest rate risk controls, your credit risk analysis program, and your investment portfolio. You got outstanding comments for your asset recovery, your lending sales, your customer service, and personnel management.

Yes, they looked at your business continuity plan….well, maybe only a cursory glance. The 600-page printout from your planning software kept one examiner busy for days as he was wading through it. On paper, you had it all covered—loss of IT infrastructure, robbery, fire, tornado, blizzard.

You had a semblance of a Business Impact Analysis. You had a spreadsheet with a risk assessment. You had a plan for the pandemic. Your succession of command plan is locked in the safe. You’ve tested your core processor failover, even though the “test” was carefully scripted by your service provider.

But...could you really survive a disaster? Could you bring the right processes back into operation in time to prevent the loss of members and prevent the loss of reputation?

Where does that 600-page plan reside? Does anyone ever actually use it? Who had it out during the IT test? How may staff had it with them when you evacuated the building during the last fire drill? Even more importantly, when does anybody ever look at it? The week before the examiners arrive and the 4 days before you conduct a business continuity exercise?

Wait a minute, did you say a “business continuity” exercise?  How does that differ from the IT “test” of the fail-over procedures for the core system?

Here’s how it differs. The business continuity plan exercise focuses on the restoration of critical business functions of your credit union. It focuses on lending being able to work from a different location. It focuses on which staff can actually work from home. It checks that those offices who say they can work from home actually can. It determines how much work the call center can do if they are forced to relocate.

Oh, by the way, sitting a bunch of managers around a table once a year and “table talking” the exercise just doesn’t cut it in my book.  You see, the goals behind the exercise are to learn what works and what doesn’t, to understand the limitations of the assumptions you make about your environment, to maximize the training of all staff, to solicit input from all levels of the organization on how to improve the plan, and the process behind it.

You only accomplish these goals if you force your staff out of their comfort zone. Sitting around a table is far too comfortable. How many times do you hear during a table-top, “Well, if this were a real event, I’d do this and I’d do that!” “This scenario just isn’t real!”  “That’s not what we’d do if the real event occurred!” Those comments come because they are not prepared for the unexpected.

You need to understand a few things about crisis management in order to successfully survive an incident. There is actually a methodology for crisis management called ICS, the Incident Command System. Your reaction team should be based on these ICS principles.

But I’d like to get you to consider crisis management from your own perspective, and consider my nine points to ponder:

• First, in a crisis, you’ll never have enough information to satisfy your discomfort. You’ll never have all the questions answered.  There will be lots of stuff you don’t know—and sometimes you never will until well after the event is resolved. 
• Second, you’ll never have enough time to be comfortable with making your decision. You’ll always be looking for one more piece of information.  You’ll always be waiting to hear one last update from a staff member. But the crisis clock ticks on, while you suffer from analysis paralysis.
• Third, understand what constitutes a crisis. Regina Phelps said, "It isn’t the event itself. Events come and go. It only becomes a crisis when your credit union falters in its mission because of its inability to respond to the events in such a way as to preserve your operations."
• Fourth, a crisis won’t necessarily reveal all its ugly sides at first glance. The ice storm knocks out power, your water pipes freeze, and your entire computer room and operations areas are flooded. The hurricane takes out your communications infrastructure, and you don’t have a trial balance or enough cash to deal with the members needing cash.  When managing a crisis, you’ve always got to be asking, “When’s the next shoe going to drop, and how’s it going to affect us?”  If you aren’t asking these questions, you are going to be in for a rude awakening.
• Fifth, the best thing you can do is make the right decision. The next best thing you can do is make the wrong decision. The worst thing you can do is make no decision. Your organization is a collective of your employees. Think of each one of them as an “action arrow,” with each pointing in some random direction. Decisions do one critically important thing: they align the arrows together. You create focus at your organization. Ok, maybe the decision wasn’t the right one (go back to my first and second points.)  Now all you need to do is change the focus by redirection…you already have their attention.
• Sixth.  You can plan for any event, but it will always be the wrong event. You’ll plan for the last event, just as armies always plan for the last war. The event is never exactly what you planned. The crisis exists because you didn’t mitigate all the factors.That said, planning is the key.  It doesn’t matter how well you plan, you will always have to modify it based on the exigencies of the event. There are several reasons this happens. The people you plan on having are on vacation in the south of France. The event is never a single event, but often multiple events, some local and some area-wide. Oh yes, boil the key elements of the plan down to wallet-sized checklists that make sense. Pages in your plan that tell staff how to use hair dryers to dry out water-logged documents aren’t worth the paper they’re printed on.
• Seventh.  If you don’t consider your mission, your plan will be useless. “But,” you say confidently, “our mission is to serve our members!  What can possibly go wrong with that?” Here’s my humble take on your mission: “Your mission is to safeguard my assets and deliver them to me when I need them. What does everyone need in a crisis?? CASH! I don’t care how big or small your credit union is, everything in your plan should focus on cash. Remember that BIA that prioritizes your business functions?  Well, everything should take back seat to cash. And you’d better have it available when your core processor is down. That means a trial balance available off-line. You’ll lose members if you limit them to $300 “because the system’s down”.
• Eighth.  You can’t manage a crisis if you don’t practice it. You have to build muscle memory so that many of your actions you need to do in a crisis are reactions because you’ve trained for it.  When you fall out of an airplane, you can’t build your parachute on the way down. You’d better have it ahead of time, and more importantly, know how to use it. Exercise your plan.  Not just the tabletop chat, but a real exercise. Make those tellers operate off-line for half a day.  Make the loan department relocate to where your plan says they will (and make sure they can operate from there). Make sure IT can actually recover the servers and infrastructure they support.  Make sure your vendors can deliver to alternate locations or provide the kinds of service you need in a disaster (Spoiler alert:  Many vendors are sized for day-to-day operations, not the surge you’ll need in a crisis!)
• Ninth.  Understand what affects your reputation. Yes, you’ve got a Twitter account, a Facebook page, and of course your website. But do you know if any members have said unkind things about you? Do you have a plan to manage a reputation attack? This can create as great a crisis as any fire or tornado. Rebuilding a physical disaster is a piece of cake.  Rebuilding a reputational disaster is a problem of immense proportions, and I don’t know any credit union staff that’s ready to tackle it.

Many of you may have noticed that the title of this article was “The Resilient Credit Union.” Ideally, “resilience” means never having to recover your business.  It means you can continue operating despite it.  With proper mitigations, good exercise, a plan that works, and trained and motivated staff, your credit union can become resilient.

Your planning, along with my nine points of crisis management, will put you in a position to survive your disaster, not simply survive the examination.  All the high exam scores don’t mean anything if you can’t continue to provide service to your members.

After all, they need their cash when they need it, not just when you are able to deliver it.

For more information and helpful tips on how to prepare your organization for disaster, Download the Definitive Guide to Disaster Planning for Credit Unions.