About two hurricanes hit the United States every year, accordingto the National Oceanic and Atmospheric Administration. Andaccording to FEMA, only 11 states avoided their wrath between 1851and 2012: The rest either bore the brunt of the storms or fell preyto their aftermath.

That puts a lot of credit unions at expensive risk, consideringthe average hurricane causes $1.8 billion in damage.

But simply having a business continuity plan doesn't mean acredit union is ready to take on a hurricane.

Here are a few big mistakes that could leave any credit unionunderwater.

Mistake #1: Onlyfocusing on the buildings

“Surprisingly enough, with a hurricane the biggest issue mostpeople are going to have is power,” Agility Recovery VP and GeneralManager Paul Sullivan said. During Superstorm Sandy, he noted, 60%to 70% of Agility's clients had power issues but no structuraldamage. About half of Agility's clients are banks and creditunions, according to the company's website.

Sullivan recommended either buying a generator orhaving acontract in place with a vendor who will guaranteedelivery of one. And don't forget about the fuel.

“Either you insist that the vendor you are going to use willprovide you fuel, or you have your own fuel agreement in place,” hesaid.

Mistake #2:Planning for only a few days of crisis mode

Expect to be down for a week or less if all you've lost ispower, Sullivan said.

Structural damage, on the other hand, could cost three to ninemonths, depending on the situation.

In both cases, if the credit union hosts its own website or hasits own email or imaging servers, salvaging equipment is crucial,CU Answers Business Continuity and Recovery Services Manager JimLawrence said. Sharedbranching could help, he noted.

“They could travel to wherever the closest credit unionis onthe same platform. They can log on, view their memberinformation, perform their functionality, their features,” hesaid.

But in many cases, credit unions' branches or head offices willneed dedicated temporary quarters. That can be tricky, Sullivansaid, because members are creatures of habit — they want to go tothe same location and talk to the same people.

Employees have the same needs, he said.

“You need to make it as easy for them to come to work aspossible,” he noted. “Let's say it's a hurricane in Miami and youtell them that the closest hot site is in Jacksonville; how manypeople are going to travel there? Not a whole lot. If you tell themthat we're bringing in amobile facility or a mobile bank branch, and it'll be here in48 hours, you just come to your normal place of business, you'regoing to tend to get them back and working for you.”

Mistake #3:Not probing third-party vendors

“These days, you have to know where your vendors are located,not necessarily your salesperson. You need to know where their datacenters are located,” Lawrence said. “I know (during) HurricaneSandy, there were some cases where some vendors were unable torecover in an adequate period of time or at least what theirplanned period of time was. They were unable to continue providingthose services. Those are things that often a credit union will notthink of.”

A lot of credit unions think they have reciprocal agreementswith other credit unions or withthird-party vendors for space or internet access after adisaster, but unless there's a signed contract, it's safe to assumeall bets are off when the storm actually hits, according toSullivan. Credit unions need to demand that third-party vendorshave disaster recovery plans, he added.

'What if whoever provides you cash can't get there? That's animportant element. What about your core processor? Are they goingto be there when you need them? Then whatif you have third-partied your IT functions to a local ITcompany down the road, and they happen to be affected and don'thave enough staff to be able to support you and the other 30customers they have?” he said.

Mistake #4:Assuming people will come to work

Actually finding the employees is one thing. Sullivan said phonetrees are useless if people at the base of the tree aren'tavailable to make the calls; a better option is an automated alert,email or text system. Getting employees to show up for work isanother. After a disaster, employees are far more concerned aboutthe welfare of their families and property thanabout clocking in.

Credit unions need backup staffing plans — and they couldinclude people who have retired from the credit union, Sullivansaid.

“Why not put a program in place that continues to train thoseretired employees?” he said. “Bring them in once a quarter, trainthem on any new processes, buy them lunch. They'll be quite happyto do that. It gives you a pool of resources that you can call uponat time of disaster should you need it.”

Mistake #5: Leaving theplan on the shelf

First of all, the plan shouldn't physically be on any shelf — itshould be in electronic form and stored in the cloud so people canaccess it offsite and from multiple devices, Sullivan said.

“Often, credit unions that do not test their plan, they're citedfor it in an examination or audit,” Lawrence added. “Their responseis almost always, 'I just don't have time,' because either it'scomplex, or it's an interruption to operations, or I don't haveenough staff. I say start small and then grow incrementally, andthen increase the scope of your testing plan each time. If youinstall a redundant communications at a branch, do a failover test.You can even do those during off hours, just in case it doesn'twork as expected.”