What do Charley, Frances, Ivan and Jeanne have in common with Arlene, Bret, Cindy and Dennis? Hopefully, nothing. The first are the hurricanes that raged through the country's southeast region last year; and the second are names the National Weather Service has given to storms yet to be. Hurricane season, typically June 1-November 30, is less than a month away. But while they are the predominant disruptive (and at times most devastating) force in the southeast, the rest of the nation faces other, equally disastrous threats at this time of year, and the principles for advance planning remain the same. For more than a decade, credit unions have come to appreciate the importance of ensuring that business recovery plans are in place. However being able to recover from an event simply isn't enough. None of us can afford to be punched out by a storm or displaced by a flood when a member needs cash, has to send money across the country or must make a deposit before the end of the day. We need to move toward ensuring continuous service every business day, and that takes planning to a whole new level: Business Continuity Planning. The difference is focusing on prevention rather than reaction. * Business Continuity Planning – a systematic process to ensure an organization can remain operational regardless of disruptive threats – is a progression from the business recovery programs put in place by many institutions in the past. Five key elements are vital to its success: Business Impact Analysis, Risk Analysis, Plan Development, Plan Testing, and Gap Analysis and Correction. * Business Impact Analysis – This phase of planning assigns a dollar value to all business functions. The business continuity team must identify those processes most critical to keeping the credit union up and running. Essentially, the impact analysis answers the question, "What processes must we be able to execute without interruption or, at the very least, within hours?" It is critical to ensure that the effect of an impact is acceptable. In the case of last year's multiple hurricanes, Southeast had to make choices spanning from watching and waiting as the storms developed to sending key staff to a remote location. (Fortunately, while Frances, Ivan and Jeanne came close, they hit neither our Tallahassee headquarters or our IT/IPS center in Jacksonville.) The point is, the level of acceptable risk should drive what your credit union chooses to do. * Risk Analysis – Risk Analysis involves assessing and assigning weights to each threat, including the effects of being without certain functions for a period of time. Every activity of the organization is evaluated to determine how much risk exposure can be taken, measured in hours, days or weeks. * Plan Development – The next step is to build the actual business continuity plan, which outlines key activities to help ensure that, regardless of the threat, the credit union won't be without a specific function for longer than deemed acceptable. This advance planning is critical because it ensures that threats are recognized and mitigated before disaster strikes. A vital part of Plan Development is creating checklists of functions that must be carried out routinely. It is imperative to put your most experienced, expert staff members on this task, and then to have your checklists be "turnkey" so the most junior staffers can handle specific duties when an event occurs. * Plan Testing – This is where the question becomes, "Does it all work?" Plans are only as good as their implementation, and the single-most significant measure of a successful plan is making certain end users (your members) see no disruption in service during an exercise. Southeast has set a goal of testing each function identified in the plan a minimum of twice a year. * Gap Analysis and Correction – The Gap Analysis is the evaluative part of the plan. This is where an organization looks at areas of weakness. Through regularly scheduled plan exercises, you can take a hard look at how your business is conducted and discover where gaps exist. Ask, "What processes do we know we have covered, and which do we need to improve upon?" The answer undoubtedly will reveal places to improve, taking the credit union back through the steps and allowing for its perfection along the way. Think of these as "reusable" checklists, which, as they are revised, will ensure that next time something happens, the organization is ready. If you could sum up business continuity planning in two words, they would be "never finished." Rather, it's a cycle of discovery, risk assessment, development, testing and evaluation that never truly ends. Once the cycle is over, it's time to start it over again, making sure the new or modified processes are evaluated, included in Risk Analysis, added to the written plan, tested and, well, you get the idea. Probably the most important aspect of creating a successful Business Continuity Plan is ensuring that everyone in the organization is on board. At Southeast, business continuity is everyone's job. In addition to hundreds of hours of testing and cross-training so staff at all levels are capable of carrying out the plan, Southeast has a business continuity director, whose sole responsibility is to coordinate all of the activities and make sure all threats are covered. This position prepares monthly reports to the Business Continuity Team and the Board of Directors. In 2004, advance planning and testing paid off for Southeast Corporate and its members. As we learned of the threat of one hurricane after another, we stocked extra cash in vaults throughout Florida, made low-interest loans to members in need, and allowed members use of our facilities. Who knows what Mother Nature has in store for 2005? We're taking no chances. We're making sure we will be ready. With foresight, planning, and ongoing testing, your credit union can be, too.