Forward. My Plan Today. Continuity / Disaster Recovery Planning. bank s current Business Continuity / Disaster Plan

Transcription

1 My Plan Today Forward 1. Discuss the responsibilities of Business Continuity / Disaster Recovery Planning 2. Provide a Framework for Accessing your bank s current Business Continuity / Disaster Plan 3. Provide steps for developing an effective plan

2 Who is responsible for Business Continuity Planning at your Bank?

3 The Board Internal Auditor I/T Manager General Manager

4 Mock Disaster Scenario - End of Month Day before the Government Pay Day Suddenly, some local tourists who had been outside taking pictures ran into the bank screaming; It is an Earthquake, Take Cover Quick 4 Centurion Disaster Recovery Services

5 Mock Disaster Scenario - End of Month Day before the Government Pay Day 5 Centurion Disaster Recovery Services

6 Centurion Disaster Recovery Services 6

7 Remaining Bank Branch

8 Centurion Disaster Recovery Services 8

9 9 Centurion Disaster Recovery Services

10 Centurion Disaster Recovery Services Have you thought about your employees and your customers?

11 Mock Disaster Scenario - End of Month Day before the Government Pay Day 11 Centurion Disaster Recovery Services

12 Mock Disaster Scenario - End of Month Day before the Government Pay Day 12 Centurion Disaster Recovery Services

13 Common products may not be available

14 Centurion Disaster Recovery Services Financial support is key to your customer s livelihood.

15 Your bank after the Disaster Your Bank

16 Your bank after the Disaster

17 Who is responsible for answering the questions from your Shareholders; (Customers Investors Employees) after the Disaster?

18 The Recovery Timeline 0?? Hours TBD Recovery Time 18

19 Why is that most banks do not have an effective Business Continuity Plan?

20 The Board Internal Auditor I/T Manager General Manager

21 Top 5 Reasons for not having a BCP? 1. It costs too much money. 2. The myth that there is a plan in place that will work. 3. Let s just do enough to satisfy the auditors and examiners. 4. The disaster will never strike. 5. We are to busy with other projects that are of a higher priority.

22 We are asking the wrong question in; How much does it cost to build an effectivee plan? The question we should be asking is; How much is it going to cost us if we do not have an effective plan when the disaster strikes?

23 Disaster impacts to your business? IMPACTS Lost Revenue Accounting Records Fines and Penalties Vital Account Records Lost Financial Records Customer Service Work Flow Quality Life and Safety Public Opinion Social Issues Employee Morale Employee Stress

24 What is your cost of downtime? Know your downtime costs per hour, days, weeks... Productivity Number of employees affected x hours out x burdened hourly rate Damaged Reputation Customers Suppliers Financial markets Banks Business partners Expenses Temporary employees, Equipment rental, Overtime costs, Extra shipping costs, Travel expenses, Legal obligations, Staff debriefing Revenue Direct loss Compensatory payments Lost future revenue Billing losses Investment losses Financial Performance Revenue recognition Cash flow Lost discounts (A/P) Payment guarantees Credit rating Stock price

25 Risk Measurement - The Risk of a Disaster Occurrence Vs. the Cost of having an Effective BCP Program. Risk Degree Of Accepted Protection Risk

26 Risk Measurement - The Risk of a Disaster Occurrence Vs. the Cost of having an Effective BCP Program. Risk Acceptance Level Degree BCP/DR Of $ Accepted Allocation Risk

27 Management Justification & Approval Disaster Level of Readiness Vs Cost of Recovery Over Prepared Highly Prepared Moderately Prepared High Cost of Recovery Level of Commitment To Satisfy Examiners Medium IT Plan/Hot Site Only No preparations Low

28 Does you plan make the Bulls Eye Accessing your BCP

29 Plan Assessment Questions Is the Senior Team Committed? Has a formal BIA been conducted? Individual department plans in place? Recovery Strategies in place? Recovery Team (s) identified? Critical Documentation identified Designated employee call list documented

30 Business Continuity Plan Review Emergency / Evacuation Plan 3 0 Plan Elements In Plan Not In Plan Comments Succession Plan Escalation Plan Alternate Work Locations Identified Business Impact Analysis Conducted Recovery strategies in place to restore critical functions Recovery Timeline Identified Critical Documentation Identified Resource Requirements Identified per function Risk Assessment-Risks Identified and Prioritized

31 3 1 Business Continuity Plan Review Plan Elements In Plan Not In Plan Comments Media Spokesperson Identified Command Center Identified Plans per department with specific information for that team? Designated employee call list documented Manual Procedures Documented Notification List External Contacts Notification List Internal Contacts Recovery Teams Identified Recovery Tasks Identified for Personnel Forms & Documentation identified

32 Plan Elements In Plan Not In Plan Comments Core Processing System (Software) Recovery Strategy / Procedures Telecommunication Recovery Strategies Electronic interface recovery strategies, i.e. Internet Banking, Voice Response Vital Records Recovery Strategy Plan Testing Strategy Evacuation Drills Hot Site Test Recovery Team Exercises Maintenance Strategy Business Continuity Plan Review

33 The Business Impact Analysis Process Business Functions are initiated by a Trigger Event fax, phone, walk-in, , etc. or are self-initiated (task list or tickler) Functions are separated by Breakpoints. Breakpoints are natural interruptions of workflow when Decisions or Handoffs are required. Function #3 Approve / Deny the Loan Function 1 Receive Loan Application Note: Once the process is broken into the functional level, for each critical function identify: RTO Recovery Strategy Resources Recovery Procedures Alternate Recovery Location Team responsible for restoring the function. 3 3 Function #2 Credit Check Function #4 Mail Status Letter Function #4

34 Business Unit Identify Business Functions Function Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Loan Origination & Processing Complete loan interview and application Create outgoing wire information - wire funds Negotiate or approve non-conforming rate / products with originators Notarize documents Order third party documents and services as needed Prepare appraisal file for approval Prepare checks for approved and processed loans Prepare checks to investor for escrow Prepare commissioned originators report for payroll processing Prepare letters to borrowers on missing items or corrected documents Prepare loan sheet and generate quote 34

35 Determine Recovery Windows Functions to be Recovered Within 8-24 Hours Functions to be Recovered Within Hours Functions to be Recovered Within 48 Hours - 1 Week Customer Inquiries via phones Accept loan payments Account transfers Balance cash drawers Cash deliveries & balance vault cash Handle deposits & withdrawals Handle security issues Handle stop payments Issue cashier s checks Post drop box transactions Sell excess cash/coin to vault Order ATM cards/debit card Calculate debt ratio to income Calculate Payments using projection Screens Loan status calls Do cash advance Fund home equity loans Fund second trustee loans Issue onsite ATM cards Issue temporary checks Time frames are set by management Business activities are assigned a recovery window based on priority Do signature warranty File maintenance Bank by phone Bank online Notarize documents Open new accounts Order checks Order loan coupons Perform account maintenance Sell money orders Set up transfer of payment

36 Determine Recovery Strategies Core System Check Imaging Report Retrieval Document Imaging ATM / Card Processing Internet Banking Fedline Voice Response Statement Printing Internal Network (Voice Communications) Telephone Banking Call Center Operations Employees Facilities

37 Business Continuity Planning Steps Institute Maintenance Program Test Plans at Department Level Business Impact Analysis Business Continuity Program Document Plans at Department Level Risk Assessment Recovery Strategies

38 What steps are you going to take to ensure an effectivee plan for your bank?

39

40 Additional Information on BCP and Disaster Recovery Centurion Disaster Recovery ( US Department of Homeland Security ( Disaster Recovery Journal ( FFIEC ( American Red Cross ( Federal Emergency Management Agency (

41 Contact Information Tom Williams

42 Thank you for what you do for the People of the Caribbean.