Is Your Disaster Plan Up to the Test?

By Brad Mundine, senior manager of CUNA Mutual Group’s Credit Union Protection Risk Management team

It’s 4 a.m. on Tuesday. Sirens begin sounding, and by 4:17 a.m., an EF3 tornado has torn through a small Midwest town, leaving a path of destruction. The credit union’s headquarters are almost a total loss, two branches have received minor damage and a fourth location was untouched. Phone and power lines are down, and dozens of homes have been leveled. Only 30 percent of staff members are able to report to work.

Where is this disaster taking place? Anytown, U.S.A. Not a real weather emergency, the scenario above is only a drill. This information has been distributed to personnel, and a four-hour simulation to test the credit union’s disaster recovery plan is now in full swing.

Putting Your Plan to the Test

The NCUA expects all federally insured credit unions to have a comprehensive contingency plan that is regularly tested. However, AT&T, which conducts an annual Business Continuity Study of organizations in major metropolitan areas across the nation, in 2011 found only 59 percent of respondents had tested their plans within the past 12 months.

In addition to developing a written disaster recovery plan and reviewing it semi-annually, credit unions should test their plans at least once a year. Simulating worst-case scenarios can identify weaknesses in the written plan and in its real-time, live execution.

Following these guidelines can help thoroughly test your credit union’s plan:

  • Develop life-like scenarios, with challenging problems including loss of Internet or phone service, staff shortages or inaccessible locations or data.
  • Engage individuals from different areas, making sure they understand the plan, procedures, roles and responsibilities.
  • Continue to introduce new problems throughout the simulation.
  • Ask your disaster assessment and recovery teams to take detailed notes throughout the drill, recording weaknesses or opportunities in the written plan or in the coordination.
  • Hold a post-mortem meeting to discuss what worked and what didn’t, reviewing the teams’ notes.
  • Maintain a detailed record of the simulation activity, noting weaknesses and adjustments. Keep a record for future audits or in the case of a real disaster when your planning may come into question.
  • Revise the plan and distribute the updated version to personnel.
  • Remember to re-test problem areas in future drills.

Frequency of testing depends on size and rate of organizational change at your credit union. At a minimum, annual testing is recommended, but many organizations perform tests two or three times a year or spread an annual test over several days.

Are You Covered?

Finally, CUNA Mutual Group recommends reviewing your property and liability insurance coverage annually, especially Extra Expense coverage limits. Based on industry information and our own experience, this coverage to help to restore operations following a covered loss or disaster is the most under-insured type of property insurance.

Resuming operations quickly (within 48 hours to meet NCUA requirements), is critical to your members, and having adequate coverage limits at each of your locations is a vital part of successful disaster recovery planning. An Insurance-to-Value guide is available in the Protection Resource Center at to help plan for these expenses.

Brad Mundine is Senior Manager for CUNA Mutual Group’s Credit Union Protection Risk Management team. He can be contacted at 800.356.2644, ext 5100, or

AT&T’s 2011 Business Continuity Study results can be found here

Strategic Link is the NWCUA’s wholly-owned service corporation, providing the Association’s member credit unions with exclusive high-quality, competitively-priced products and discounted services. Questions? Contact Sales & Marketing Associate Craig Reed: 206.340.4789,

Posted in Article Post.