The recent horrific earthquake in Haiti has spotlighted the need for preparation and planning in the event of an unforeseen natural disaster. The banking industry, which provides essential financial services to its customers in a disaster, is particularly conscious of its responsibilities in this arena. And probably no U.S. banks are more conscious of the need to be prepared than those located along the infamous “Ring of Fire,” the area surrounding the Pacific Ocean that is prone to frequent, and often devastating, earthquakes.
In the wake of the Haiti disaster, BAI Banking Strategies questioned a selection of these institutions on their business-resumption plans, including Umpqua Bancorp of Roseburg, Ore., Bank of the Sierra, Inc. of Porterville, Calif., West Coast Bancorp of Lake Oswego, Ore., and Honolulu-based First Hawaiian Bank. All reported detailed plans in place to respond to national, regional and localized events that could impact their service delivery and data access.
“We take business-resumption planning very seriously,” says Jill Farrow, the vice president of finance for Umpqua Bank, which operates in Oregon, Washington and California.
Executives at these institutions say their disaster-recovery plans must take into account a multiplicity of different events, varying degrees of severity and locations of impact and the potential effect on different bank operations. While it may be relatively easy to keep open remote channels, such as Internet banking, for example, it’s also essential to keep at least some branch locations up and running for customers who need quick access to cash and other services.
These plans, the executives say, need to be updated and tested and communicated throughout the organization at least once a year so that any technological or practical issues can be addressed and all employees are aware of their roles and responsibilities.
Certain business-resumption issues hold true across virtually all financial institutions, such as ensuring that delivery-channel systems and customer data are backed up at a separate location, and maintaining a plan for the bank to communicate with both employees and customers. Other issues, however, must be handled according to the circumstances of each bank. These include deciding whether data back-ups should be handled by the bank or by a third party; whether the main external backup location should be located close to the bank or hundreds of miles away; and what other (sometimes non-traditional) service channels can be utilized to stay open and offer service.
Keeping the Branches Open
It’s often said that a failure to plan is a plan for failure. This applies very clearly in the area of disaster preparedness – especially in the banking industry, which operates with stringent regulatory policies and high consumer expectations around maintaining access to funds and financial data.
The $2.6 billion-asset West Coast Bank, which operates 65 branches along the I-5 corridor in Washington state and Oregon, as well as the Oregon Coast, is potentially exposed to both earthquakes and tsunamis. Jim Bygland, chief information officer and executive vice president, says the pressure to recover quickly from a disaster has increased in recent years. “The old thinking was that we could come back into operation in 24 hours,” he says. “Now, people expect information at their fingertips – always.”
Farrow, Umpqua’s self-described “point person” for disaster recovery, says she monitors RSS feeds from the Centers for Disease Control and the U.S. Geological Survey daily and works with the business line managers throughout the year to review their departmental plans. “It’s like an army with a chain of command,” she says. Umpqua’s corporate disaster recovery plan is reviewed quarterly and tested annually, she adds.
The team that oversees disaster planning at the Bank of the Sierra also meets quarterly, says Mona Carr, the bank’s senior vice president and director of operations, who is also in charge of business continuity. She says that the bank has established priorities in terms of resuming operations, but that flexibility is needed depending on the nature and impact of the event. For example, she says, online access may in some cases be the easiest channel to maintain, but keeping open any branches is a priority. Since many customers may lack power or Internet access in the wake of a disaster, offering access to funds is critical.
Even in the case of an event so catastrophic that the bank’s primary data center is knocked out, Carr says Bank of the Sierra’s backup site can resume operations in four to five hours and support emergency phone lines and item processing and other services needed to keep the branches going. The bank also designates “area captains” based on geography, who can coordinate with each other depending on which areas might be impacted the hardest, to determine which branches can be kept open and how to get them staffed.
“Our main goal is to keep the branches running,” agrees Carol Ono, senior vice president for First Hawaiian Bank. She notes that operating on an island presents some unique challenges. Hawaii is more vulnerable to hurricanes and tsunamis than some West Coast areas and, in the event of an emergency that closes airports and harbors, the whole state could be effectively cut off from the continental United States and the outside world in general.
Ono and Gary Caulfield, First Hawaiian’s vice chairman of IT operations, head an emergency management team of 15 key people who are responsible for a variety of jobs, including damage assessment and communications. The team runs through disaster exercises annually, but also does a lot of planning with individual business units more frequently “so everyone knows what they’re going to be doing,” Ono says.
A disaster plan is not one-size fits all, bankers say; neither is it “set and forget.” Given the unpredictability of earthquakes, the widespread coverage area of many banks, and the rapidly changing pace of technology, it is increasingly important to have a multi-faceted strategy that takes into account how a natural disaster could impact different locations in various ways. “The most fundamental thing is you really need to test the plan, and not just on paper,” says Jim Holly, president and CEO of the Bank of the Sierra.
‘Test and test and test’
Sometimes the ramifications of even a distant quake can impact an institution. Bank of the Sierra is located at least 75 miles from the San Andreas Fault, ground zero for most of the country’s biggest earthquakes. Even so, Holly notes, a major shaker there could result in flooding or fires throughout the region afterwards, which could significantly impact his operations.
“The best thing is to test and test and test,” says Carr. The Bank of the Sierra recently began conducting a quarterly run-through in which it shuts down its primary corporate systems and routes all of its work through its backup site in Fresno, Calif.
Farrow says that Umpqua’s plan takes into account issues such as local geography – many of Umpqua’s service areas in Oregon lie along the Willamette River. “We need to consider, if the bridges are down, where are you going to go?” Farrow says, adding that the bank takes into account where employees might report on an interim basis.
West Coast Bank faces similar issues. The bank operates in locations that rely heavily on bridge access, as well as areas in the interior of Oregon and Washington far from main highways. The bank’s plan considers the potential threats in these areas as well as the access to resources and transit that might remain after a disaster.
“The disaster recovery plan is tested regularly to keep people fresh,” Bygland says. A by-product of this frequent field-testing is that employees are also ready to apply those skills when the bank faces other interruptions, such as an inordinate amount of snow or even a bomb threat, he adds.
Beyond regular testing, other disaster planning elements consistent across all institutions include the need to back up channel support technology and customer data at an off-site location and a communication strategy to allow bank managers to reach out to employees and customers, even if it’s only by short-wave radio. For example, at Umpqua, Farrow maintains a listing of local and regional media outlets in all the communities where the bank operates. The bank could message online customers through its Web site or e-mail. It could also contact employees via an automated phone message or through the bank’s Intranet in the case of emergency, she says.
All the banks questioned for this article operate at least one backup site to protect their channel systems and their information. West Coast Bank, for example, contracts with SunGard Availability Services, the Wayne, Penn.-based software and IT services company, to manage its off-site backup location in Arizona, according to Bygland. The bank also works with SunGard to run major simulations annually, he adds.
Bill Hughes, director of consulting services at SunGard Availability Services, says that the banking industry is better prepared than most for potential disaster because it faces so many regulatory requirements for data integrity and protection. “Banks also have a natural resiliency,” Hughes adds. “If other channels are down, customers can go to a branch. If that branch is closed, they can go to another branch.”
Umpqua manages its own duplicate data systems in California and Oregon. While both backup sites are located on the West coast, within the bank’s operational area, Farrow says “the likelihood that an earthquake would take out both Oregon and California is extremely remote.” She says Umpqua decided not to back up via an outsourcer because it doesn’t want to stand in line with other clients of the vendor should a major disaster strike.
Bank of the Sierra also manages its own disaster recovery site, in Fresno, California, which replicates all of the bank’s data and can support item processing, emergency online access and phone lines, according to Carr. She says bank executives didn’t want to be scrambling to a more distant location if they needed to manually access software, hardware or systems.
First Hawaiian’s off-site is located decidedly more far afield, in the continental Midwest, because that area is not prone to the earthquakes, tsunamis or hurricanes that could befall the bank’s operational area, according to Caulfield.
Ms. Hoffman is a freelance writer based in Poulsbo, Wash.