I’ve personally reviewed and/or audited somewhere close to fifty business continuity/disaster recovery (BCP/DR) plans over the past decade.  I’ve also written or edited several of those as well in the past five years since moving into professional services for financial institutions.   Furthermore I’ve participated in roughly a half-dozen tests while still working within the infrastructure during the first part of my career.  Suffice to say I have at least an informed opinion regarding the viability of any such BCP/DR strategies.

Fundamentally there are a few varieties of  BCP/DR plans:  Those that are current and viable, those that convince your examiner that it’s current and viable and those that may have been viable years ago but bear no resemblance to your current business profile.  And beyond those there’s the worst of BCP/DR realities, the non-existent one.  But really in the end what your current state of preparedness comes down to is this – either you’re ready for an event or you’re not.   And in the past forty-eight hours that’s been made abundantly clear in the form of how many of my clients affected by Hurricane Sandy have navigated through what’s now clearly one of the worst weather events in my lifetime.

Around noontime yesterday (October 29, 2012) as weather conditions worsened and major metropolitan areas were literally shutting down for business I started checking up on a few clients.  The first thing I did was visit the website of every client that my practice has assisted with their BCP/DR strategy – each of them had updated their website to announce that branches in the affected areas were closed.  Some had a pop-up window with the update, others had a message displayed in either bright red letters, bold font or both.  As a standard design consideration each of them also had phone numbers clearly displayed and when I called a sampling real people answered and were available to assist me.  I inquired of a few of them where they were physically located and they were all located remotely and not on site in affected areas (much to their credit they were reluctant to share too much information).   The second thing I did was visit the website for a few clients whose BCP/DR plans were tagged during an audit/assessment as either being deficient or missing.  The websites were not updated and in all but one case I only learned that they were closed for the day after calling into a branch (one had an 800 number that was redirected to a real person).

Now I know this wasn’t a very deep or meaningful test of anyone’s ability to continue operations in the event of a disaster.   But what it did prove is that those institutions who had plans that were current and whose management team knew to rely upon had already thought through the little things that make a difference.   Someone knew to update the website, management knew to reroute calls away from unmanned branch locations.  I can only assume that the appropriate parties desginated to do so also contacted their regulators to inform them of their closing and that a phone chain was initiated informing staff thus keeping them off the roads and safe.  And because an important part of the plan creation/update process is both training and testing stakeholders are able to navigate through the decision tree and take appropriate related steps without having to think through it – one of the biggest challenges confronting management during a crisis.  The very best part of having a viable and current plan is that all the thinking has been done in advance and has been reviewed and validated which greatly reduces the chances that something (or someone) will be missed.

Here’s a sanity test:  If you didn’t know exactly where to begin the decision-making process or who to engage you’re in need of a new plan.  And if you did know but can’t be absolutely certain that others would be able to do the same in your absence, you’re in need of a new plan.  One of the rebuttals I’ve heard all too often when identifying a deficient or missing BCP is that management knows what to do should some manner of disaster strike.  That may be true but what happens if key people are unavailable or can’t be reached?

Seriously, when something like Hurricane Sandy occurs it’s the best time to consider how you’re institution would fare when navigating such an event.  Block off an hour within the next week with your key people, pull out your BCP/DR documentation and try and step through how you’d handle things under similar circumstances.  In a very short time you’ll gain a sense of whether or not you’re prepared and if necessary afford you the opportunity to improve.

Trust me on this – you don’t want to be in the middle of a disaster scenario and find out that your plan doesn’t work.

It started me to thinking about how that sort of thing seems to have tapered off lately. I went back and searched my inbox for all FDIC correspondence over the past three months and I’m fairly confident it revealed a trend that such activities slowed down. Then I remembered a story I read today about how the bigger banks (e.g. Citigroup, Bank of America, etc.) are expecting to restore the issuance of dividends sometime this year for the first time in nearly three years. Fewer bank closures plus healthier balance sheets has to equal the end of the crisis, right? I mean, what other indicators are you going to look for to prove such a theory?  Bigger banks are generating profits, surviving banks are managing to keep their balance sheets sufficiently above water, so now we can all breath a collective sigh of relief, finally.  What a great way to end the week and sail off into a three-day weekend, right?

But then I remembered another story I’ve been tracking, the one about how analysts expect 2011 to set all kinds of ugly records for foreclosures of private residences.  One expert estimated that nationwide 1 in 50 homes will experience some form of foreclosure activity and that 1.2 millions homes will actually be repossessed by the banks.  That’s a lot of housing inventory about to be added back to the books, a bundle of legal expenses about to be incurred and a tremendous hit to any banks balance sheet.  So in addition to not receiving the anticipated revenue from the lost loans, the banks now have to face the harsh reality that much of the real estate coming back onto their books isn’t worth quite what they appraised it for when the loan was issued. It makes me think that while the rate of closings might be slowing, it’s nowhere near the end.  Plus as I’ve shared with you in the past, banking industry insiders that I’ve talked to are firm in their belief that until the commercial real estate market experiences a serious correction, the bleeding can’t end and the healing can’t begin.

If you want to gain a visual understanding of the enormity of the foreclosure crisis beyond just numbers, check out the Google Maps real estate feature which allows you to display foreclosed properties in any view. I played with it a bit and was stunned by how much of just about any geographic area I have connections to was covered in little red dots.  Seriously, seeing it in front of me like that was shocking despite my being intimately aware of the numbers.

So I’m thinking that until the concept of foreclosure returns to its previous status as rare and uncommon, the banking crisis is not quite over. Until the value of a banks portfolio is solid and reliable, the bank itself cannot be.  It’s just plain common sense. I’m no economist and I’m no real estate expert but I can’t figure out how anyone can legitimately declare the crisis over until the underlying cause is satisfactorily addressed. Plus I still know way too many people who are out of work or who are certain they’re about to be; what’s going to happen when they run out of savings?

I want this to be over as much as anyone (probably more considering too many of our clients are still worried on keeping their doors open and not so much on standard compliance issues).  But I’m not going to believe we’ve turned any corner in a meaningful way until those Friday FDIC bank closing emails return to their previous status of being rare and unusual.