MOLINE, Ill. – Should the day ever come, the staff at Deere & Company Credit Union will know what to do if a tornado renders useless the credit union's sole office. That was the scenario the $203 million credit union chose as its test case when it recently reviewed the document it created with PLANet, a Web-based business continuity planning program from Strohl Systems. "We just sat down and went through our plan, using as a scenario the idea that a tornado had made our building unusable and we had to go to our backup site," says Cindy Bush, the credit union's administrative assistant in charge of keeping the plan current. "We found there were a few changes we needed to make, such as new vendor contact information, things like that, and we made them. It's really quite easy." The Web-based database is relational, so if a new person takes over a role at the credit union, the change made in one location is reflected throughout the plan, which also can be burned onto CD and, as in the case with Deere & Company CU, distributed in paper form in case Internet access is not available. "It's one thick document," Bush advises. Deere & Company CU is one of about 420 financial institutions, 230 of them credit unions, using PLANet. A new upgrade, just released, includes 10 new recovery scripts, three new recovery roles, 33 new reports, enhanced document management capabilities, a streamlined importing process and security-access settings to manage multiple users, says Craig Smith, manager of the PLANet Division at Strohl Systems in King of Prussia, Pa. The point-and-click, fill-in-the-blanks program includes numerous scenarios – bomb threats, plumbing and computer network failures, hazardous waste spills and so on – as well as lists of things that credit unions might not think of unless the moment arrives, such as who has pickup trucks or specialized skills that could come in handy in an emergency. Such emergencies have arisen, Smith points out. "Many of our customers have used PLANet to help them successfully recover from disasters ranging from network outages to wildfires," the PLANet Division manager says. "Credit unions have told us that in addition to building a comprehensive plan that helped save money, they really appreciated the small things. "For example, making sure the flashlights have batteries before they are needed. That may seem like a simple thing, but during a disruption, it can mean the difference in the time it takes to recover, and the cost of downtime to a credit union can be tens of thousands of dollars per hour." The program also is designed to help with the not-so-simple things, such as ensuring compliance and showing due diligence. "We use it to prove to our board that we're doing what we need to do to comply with the rules and be ready in case something happens," Bush says. Regulators need to be satisfied, too. The NCUA, for instance, classifies threats into three categories: human, natural and technical. The FFIEC, meanwhile, advises that financial institutions look at business impact analysis, risk assessment, risk management and risk monitoring factors. "PLANet's risk assessment module enables credit unions to evaluate a number of risks for each of these categories, which in turn enables the plan builder to take them into consideration," Smith says. The key to its effectiveness, Smith says, is making the plan process-driven rather than scenario-driven, since it's impossible to predict everything that could possibly happen in any given situation. That approach includes answering a series of questions to help provide a "complete analysis of their organizational and financial impacts and vulnerabilities should a disaster occur," Smith says. "The information collected is then fed into the business continuity plan to ensure that it meets the needs of that particular credit union." After that, the plan is built using templates and wizards and then is ready for testing and review and, if necessary, updating, the latter being among Bush's duties at Deere & Company. While Bush is responsible for the program's updating, she says it's not really a daily task. "I only look at it when we have updates or we need to review it," she says. "And the updates are easy to make because everything is so relational. It's like using Access or some other simple database program." -

[email protected]