When a credit union suffers a disaster, whether it be from aHurricane Sandy, Winter Storm Athena, the floods of last spring,tornadoes of summer, earthquakes from anytime, political unrest —whatever disaster de jour presents itself, it is critical torestore service as soon as possible.

While data recovery is really important (after all, who has whatmoney in which account is pretty critical), it is probably not theimmediate concern to the member standing outside the closed creditunion door.

“Where's the data?” isn't the most important thing in today'sbandwidth and cloud computing. What is most important is how weprovide service to our membership. I guarantee you that that memberstanding outside the front door could care less where data isstored, how dispersed the cloud is, or what disaster recoverypreparations were made. The only thing that member wants is accessto his or her money.

You see, in any crisis, “Cash is King”. Since the power andinfrastructure are not working because of saltwater in undergroundtunnels, because the streets are blocked with debris, becausepeople trying to recover their homes can't get to work, because thecredit union lobby is knee deep in mud from the flooding, thecredit union isn't open.

It is immaterial if the data is 200 miles away or 300 milesaway. What is key is that the credit union can't get to it. A planwritten by a vendor providing backup data center services onlyaddresses part of the problem — the data and IT services. Itdoesn't address the overall operations of the credit union. Itdoesn't get a single member the cash needed to buy groceries ordrugs or fuel.

The answer to the problem was only mentioned briefly in the lastparagraph of an otherwise great article — Resiliency.

A resilient credit union is focused on one thing — continuedservice to the membership. In order for that to happen, theplanning needs to put in place backups for three things: People,Places, and Processes. Unfortunately disaster recovery planningalone only partially addresses the Processes part of the picture.

Putting backups in place requires a close look at the threatsand risks imposed on the credit union, discovering the most likelyrisks and putting mitigations in place to reduce their impact orduration. For example, if a widespread, long-term power outage willshut the doors, investing a couple thousand dollars in an emergencygenerator is a pretty logical choice.

If loss of Internet access separates the tellers from the coredata, ensuring availability of a current trial balance might becheap insurance. If food poisoning from the recent chili cook-offtakes staff out for a week, a backup source of people (as in sharedbranching or reaching back to recent retirees, or shared staffingwith a sister credit union) would be a smart move. If the buildingis inaccessible because of structural damage or other habitabilityissues (consider sewer backups during a flood), backups shouldinclude a place to set up shop that is available to both staff andmembership. This might be a corner table in a coffee shop, and thecost for that arrangement might be a purchase of some coffee shopgift certificates to give to members.

Processes (and the data behind them) get the greatest focus, andfor the most part, it should. Remember, however, that virtuallyevery process we use began with a relatively simple manual process.(Remember passbooks?) Very often, real resiliency can be achievedby preparing to operate off-line for an extended period oftime.

Every backup, whether it be for people, places, or processes,needs three things to work: 1. Practice. 2. Practice. 3. Practice.That's right, just because the credit union writes it into a planand puts that plan on the shelf in a three-ring binder doesn't meanit will work.

Not only does practice make perfect, practice finds the holes inthe plan that might prevent it from working as expected. This isn'tthe same as a DR test, where we find out if the equipment works asadvertised. This is a training, learning, and skills honing eventwhere resiliency is built.

Resilience doesn't happen in isolation. It doesn't occur becausea business continuity planner writes a plan. It doesn't occurbecause the NCUA examiner has looked at the business continuityplan. It occurs because of a solid C-level commitment. It is acharacteristic that becomes built into and is an integral part ofthe organization's culture. It is a long way from disaster recoveryplanning.

Resilience ensures the credit union is there for the membership,which ensures the membership remains with the credit union.

And, after all, that's what we want, isn't it?

KenSchroeder is vice president of business continuity at CorporateOne in Tallahassee, Fla.