Disaster can strike at any time, so regulators require banks to prepare for disaster recovery and make business continuity plans, ensuring that banks can serve customers throughout a crisis. But how best to prepare? “Mitigate the risk from the beginning,” says Roberta Witty, vice president at Gartner Research and a former IT risk manager with what was then known as Chase Manhattan Bank.
When Superstorm Sandy hit in late October, banks like North Jersey Community Bank, a $822-million asset institution based in Englewood Cliffs, New Jersey, and Sun National Bank, a $3-billion asset bank headquartered in Vineland, New Jersey, called upon years of preparation. Planning began for North Jersey Community Bank shortly after its founding in 2005, and the plan is updated twice annually, changing based on what is going on in the environment. “We weren’t sitting here on the Saturday before the storm going, ‘Oh my God, what are we going to do?’” says Frank Sorrentino, chief executive officer of North Jersey Community Bank. “We know exactly what we’re going to do, [and] how we’re going to do it.”
When disaster strikes, it helps to have backups. Many banks, including North Jersey Community Bank, relied on generators to provide power so branches could continue to serve customers despite power outages. But generators can fail. The back-up generator for North Jersey Community Bank’s headquarters and operations center in Englewood Cliffs was temporarily out of commission due to problems with natural gas in the area. The bank had planned in advance for this type of situation back in 2006, when the bank, at roughly $200 million, was significantly smaller. Sorrentino planned—and opened—a secondary operations center in Hackensack, New Jersey. “We were a very small bank at that time, so the cost of creating a second operations center was very high,” says Sorrentino. ”But I recognized that we needed this disaster recovery capability and backup.” Everything was duplicated in Hackensack, including file servers, phone systems, Internet connections, and data, and was available when Sandy struck.
At Sun National, data redundancies were in place to ensure that mobile and online banking remained available. “We have several backup sites,” says Tom Geisel, chief executive officer of Sun National Bank, and systems were “tested and re-tested.” Banks must be also careful to secure back-up data outside of the area potentially affected by a disaster, says Witty. Sun National never had to use those back-up systems during Sandy, and online banking remained accessible. For customers that lost Internet connectivity, Sun National provided laptops and air cards within the branches so customers could access their accounts and online banking.
Adaptability is key. When Hurricane Ike hit Galveston, Texas, in September 2008, Moody National Bank, an $872-million asset bank based in Galveston, was prepared for a power outage. Unfortunately, the bank did not anticipate the storm surge that brought eight feet of water into its main office. It was two weeks before the National Guard allowed anyone back onto the island. Once employees and residents were allowed to return, they conducted business at card tables while repairs went on around them, says Owen Cheney, chief information office at Moody National Bank. Fortunately, their data was stored in two different places—Houston and Austin, Texas, which was largely unaffected by Ike. Online banking was available during the disaster, as well as ATM and debit card availability.
Workforce resilience is vital to a solid business continuity plan. In particular, “a community bank has a lot of concentration risk,” says Witty, with facilities and employees all in the same area. While Sandy did provide several days warning in which banks could reposition staff, personal safety did make business a secondary concern. “In any situation like this, our primary concern and focus is the safety and security of our employees, customers and their families,” says Geisel. North Jersey Community Bank, in the interest of public and personnel safety, closed all locations when New Jersey Governor Chris Christie announced that the area was under a state of emergency. The bank re-opened to limited hours the next day, and used its four courier vans to help customers and employees. Sun National prepared for staff unavailability by ensuring that key employees had a “back up” employee to step in when needed.
Communication is crucial for employees and customers. Sun National used as many communication avenues as possible, including the bank’s website, hotlines and social media. Both Sun National and North Jersey Community Bank found social media to be extremely important, with both banks using Facebook and Twitter to communicate to the public during the disaster. Social media was a part of the banks’ disaster recovery plans. “People will communicate via social media when all else fails,” says Sorrentino.
For the CEOs of North Jersey Community Bank and Sun National Bank, Superstorm Sandy proved to be the ultimate test in business continuity—one they feel their banks passed with flying colors. Sorrentino was in Paris, France, when Sandy hit the New Jersey coast. The extensive planning allowed the bank to function without Sorrentino there, he says. Neither CEO would make any significant changes to future planning at this time. “I’m very proud of the planning that our team did corporate-wide,” says Geisel, “and I’m even more proud of how they executed.”