I have the privilege of helping credit unions with their business continuity planning, doing plan reviews, facilitating exercises, conducting business impact analyses, rewriting plans and educating staff and boards. One thing I've discovered as I find credit unions struggling with their business continuity planning is a mission statement that misses the mark. Since aspects of business continuity planning flow from the credit union's mission statement, this can be a problem or, in this case, an opportunity to improve both.
When I ask, "What's your mission statement?" many staff members stand up proudly, salute and recite something like, "Sir, The mission of Acme FCU is to serve our members with distinction, efficiency and professionalism." I've heard this type of answer far too often, and it causes me some serious concern.
So what's wrong with that answer? All it answers is how you'll provide service, but it says nothing about what that service actually is. The description you gave could just as easily apply to the community bank around the corner. A real mission statement has to say something about what you do.
If I walk into your credit union with a sock full of quarters to open an account and ask the question, What's your mission? As soon as you responded with the service statement, I'd sling my sock of quarters over my shoulder and walk out.
When I open an account at your credit union, what I really want to know is how you'll manage the money I entrust to you. That means your mission statement should sound a bit more like, "The mission of Acme FCU is to safeguard our members' money and make it available to them when they need it."
Notice that a bank's mission statement would probably be something like, "Our mission is to maximize the rate of return for our stockholders." Yes, that's right, you now have a delineating distinction between you and the banks.
That doesn't mean you can't have goals that relate to image, efficiency and professionalism. However, now that you've told me I should trust you with my money, I'll plunk my sock full of quarters back down on your desk and open that account.
So how does all of this relate to business continuity? Actually, it's a really simple correlation.
Your mission statement is the starting point for the prioritization of your recovery efforts.
Business functions that deal directly with the mission statement should be recovered first. You need backups for the people who do the work. You need a backup place to work if the building is inaccessible. You need a backup process in case the primary process fails. That means tellers, member service, ATMs, loans--the direct member-facing functions. They are all involved in getting the members their money when they need it. Business functions that do a secondary role, like vehicle title maintenance, collections and accounts receivable, get recovered next. Functions that provide the background support get restored last, which might include budgeting, some facilities functions, vehicle repossessions, legal and basic HR functions.
In a disaster, every business function that's directly related to the mission statement I've described becomes critical. When your mission statement focuses on distinction, efficiency and professionalism and a disaster strikes, none of these characteristics provide your membership what they need, namely access to their money. And need it they do. In any crisis, cash is king. ATM's don't work if they can't get serviced or if the communications or electricity is down. Your teller lines don't work if your cash supplier didn't deliver or the CDM's are locked up without electric power. You can't process an emergency loan if your processing systems are down, unless, you have adequate backup for these functions.
That isn't to say each of these secondary and background functions doesn't have recovery roles, but recovery of these functions shouldn't be your primary focus. Human resources, for example, could take on a disaster relief role for staff, families and members. Someone could forego repossessions to help your IT staff set up desktops.
Notice how the change in mission statement has realigned a lot of activities and priorities without a lot of wailing and gnashing of teeth? Instead of recovery activities becoming based on which vice president shouts the loudest, they become based on impact priorities. Of course, there is still a lot of work to be done by completing your business impact analysis and following through with the other planning steps. But all those other planning tasks have now become a lot easier.
Simply stated, an effective business continuity plan really is a logical outcome of a correctly formulated mission statement.
Ken Schroeder is vice president for business continuity at Southeast Corporate. He can be reached at 800-342-0203 ext. 4125 or firstname.lastname@example.org