Banks and Hurricanes: A Look Back at the Storms of 2004–2005

PDF version of this article

As the 2006 hurricane season approaches, bankers are reviewing plans for maintaining operations in the event of a severe storm. A look back at some bankers' experiences during the storms of the 2004–2005 seasons may provide context for this planning process. While the 2005 hurricane season was exceptionally severe, it illustrated the challenges banks may face in doing business in the aftermath of a hurricane or, potentially, other disasters.

This article is not a regulatory guide to business continuity planning. Rather, it is an informal compilation of experiences, and thoughts about the challenges and planning options illustrated by those experiences. Looking at how some institutions met the challenges arising from the 2004 and 2005 storms may be of interest to other bankers as they prepare for the future.

Storms Challenge Business Continuity Plans

Preparing for a hurricane is challenging enough, but to remain fully prepared, storm after storm, for the resulting flooding and associated tornadoes takes a great deal of effort and determination. Many communities had not yet fully recovered from the destruction of the 2004 season's hurricanes¹ when 2005 brought Dennis in July, Katrina in August, and Rita in September. The resulting devastation left large portions of five states without power, communications, supplies, or reliable transportation systems. The compounding effects of losing both critical infrastructure and supporting industry segments resulted in a prolonged recovery period — much longer than many business continuity plans (BCPs) addressed.

The scale of the devastation, unexpected complications, and prolonged recovery periods from these storms have caused many banks to reconsider critical recovery priorities. Some of the most significant problems banks encountered were unavailable personnel, inadequate cash supplies, and loss of communications, power, and multiple banking facilities.

Personnel

One of the first things many banks realized is that even with a comprehensive BCP, a working back-up facility, and current copies of data files, people were needed for effective recovery operations. As the hurricanes approached, many bank employees evacuated. Management's first task following the hurricanes was to ascertain the safety and whereabouts of their employees.

After Hurricane Charley, bank officers at one large Florida community banking organization acted as a clearinghouse, taking inventory and coordinating the availability of lodging and supplies among the staff. Management established a program to locate every employee, ascertain their immediate needs, and make provisions to meet those needs. They matched employees without housing to those whose residences were still habitable. The bank obtained necessary items and set up a storehouse where employees could have whatever goods they needed. Management coordinated a daily potluck food program and even arranged for child care. Thanks to these efforts, bank employees could focus on the recovery of bank operations instead of personal needs. The bank's main office opened within days, damaged but functional, and powered by a generator.

For larger operations, such as service providers with multiple locations, employees from areas affected by the hurricanes were shifted to corporate sites outside the disaster area. Whenever possible, work was shifted with employees. In one instance, the data center president, besides providing work space to the bank, took in the bank president's family until other arrangements could be made.

Staffing shortages also affected supporting services such as transportation, communication, and security. Infrastructure support staffs were especially stretched to their limits by the storms of 2005. Police and security firms were dealing with life-threatening emergencies. Securing damaged facilities immediately after the disaster became the banks' responsibility. In several instances, bank officers stayed near or in bank buildings until more permanent arrangements to secure the buildings could be made.

Meeting the challenge. The experiences of 2004 and 2005 emphasize the importance of appropriate methods to identify and meet the needs of employees and their families so employees can focus on recovery operations. Without the availability of key recovery and operations personnel, timely recovery of critical operations will not be possible. Craig De Young, president of Charlotte State Bank, Port Charlotte, Florida, believes, "The initial primary focus must be on the health and safety of your staff to ensure they are all accounted for and have a roof over their head as well as access to food and water. Once you have their personal needs addressed, the likelihood of having a workforce to operate your institution vastly improves."

The 2005 experience especially illustrates the desirability of having backup (redundant) personnel for key operational positions and responsibilities and having plans to use personnel from unaffected areas, if possible. Mr. De Young offers this advice: "...detailed maps are in all employee files so employees can be located after a disaster. Those maps should not solely rely on names for roads (since signs are rarely remaining) but instead the number of roads or blocks from major intersections or landmarks so locations can be found in extreme conditions." The importance of being prepared to work with regulatory and emergency management personnel to locate missing employees and get recovery personnel into affected areas cannot be overemphasized.

Cash

Power and communications failures prevented electronic forms of payment, such as debit and credit card use. Without electronic access to funds, credit cards, debit cards, and even checks became useless. Cash quickly became the only viable means of payment, but cash was often in short supply. Getting additional supplies of cash into storm-damaged areas where transportation was limited and security services stretched thin posed difficulties. Consumers and employees remaining in affected areas desperately needed additional cash to make critical purchases.

Meeting the challenge. The storms reveal the importance of proper planning for customer and employee cash needs, as well as consideration of distribution methods, storage locations, and security of the cash. Banks with comprehensive customer awareness programs to help prepare their customers for a disaster had a smoother transition to the recovery phase of their BCPs. Providing information on regulatory and other government resources and Web sites also helped customers identify other avenues for critical services.

Communications

Voice communications. During and after many of the storms, traditional voice phone circuits were down. In addition, state and federal emergency response authorities commandeered cell phone circuits to manage relief efforts. The Government Emergency Telecommunications Service (GETS) Card Program² provided some limited voice communications for institutions that had made arrangements in advance. While text messaging via the cell phone networks was still possible, the only reliable means of voice communication for many people working on recovering operations was two-way radio or satellite phone.

Calling trees proved useless as the impact of the hurricanes spread employees far and wide. Some banks posted emergency Web sites to disseminate information to employees, as well as to inform customers of temporary locations and service plans. Other banks used pre-established toll-free phone numbers for employees to report in and obtain information.

Data processing. The widespread communications outages resulting from the storms imposed considerable challenges, especially for banks that relied on real-time communications with data processing service providers. For those banks and branch offices, connectivity with the data processing facility was critical to conduct routine banking business. Institutions without manual backup systems or external electronic systems located out of the area were unable to conduct business.

One data processing service provider in Florida experienced widespread loss of communication to a significant number of its client banks during Hurricane Charley. The service provider switched the banks' network connections to alternate communication paths using Permanent Virtual Circuit (PVC) technology, which rerouted the circuits. As a result, the affected banks were reconnected to the data center by the following business day. After the 2005 hurricanes, many banks and their backup facilities were so severely damaged that business operations had to be moved to facilities outside the affected area. Establishing network communications with these facilities posed new challenges that the use of PVCs could not address. Eventually, the banks working with the service provider established a secure virtual private network, allowing communications using a standard Internet connection.

Transaction items and management reports. In both 2004 and 2005, electronic transmission of batch items and report distribution were impossible for a number of banks for an extended period. During localized disasters, the physical movement of these items is inconvenient but possible. With the impact of the storms resulting in traffic jams, gas shortages, and security issues, delays of a day or more were not unusual. Getting transaction items to processing sites and providing reports to management became problematic. Institutions that had planned for remote image capture were better able to keep information flowing.

Meeting the challenge. Effective BCPs consider that normal land lines and cellular networks may be down for extended periods. The 2004–2005 hurricane seasons demonstrated the importance of being prepared with alternative communication methods. Two-way radios, satellite phones, wireless personal digital assistants (PDAs), text messaging, and the GETS Card Program were all used to varying degrees.

Emergency Web pages, which had been developed in advance and stored off-site, also proved successful and could be easily updated and posted on the bank's Web site. Darby Byrd, president of Orange Savings Bank, Orange, Texas, noted, "We posted our emergency contact phone numbers on our on-line banking site as a communication tool. Almost immediately phone calls started pouring in."

Incorporating communications of government agencies also served as useful supplements to many banks' BCPs. Federal and state regulatory bodies are often highly visible, and can communicate information over major media outlets, including television and radio. Regulators can use those outlets to inform the public of information available through their Web sites and emergency call centers.³

Keeping data and transactions moving and management reporting flowing after the storms proved critical to banks' recovery. Banks with BCPs that included arrangements for alternative communication paths were better able to keep backroom operations going and to give management the information necessary for recovery. Banks that had capability for remote image capture also had more information available during recovery.

Power

Availability of power was one of the areas of emphasis during business continuity planning for Y2K. Many institutions included in their BCPs arrangements for alternative power sources (multiple vendors), acquired generators, and made plans for fuel deliveries. However, few, if any, plans anticipated the widespread failure of a power grid, such as occurred in 2005. With portions of the power grid inoperable, down-line power plants, transmission lines, and power distribution centers were all affected.

Even banks with generators had problems with flooding and fuel shortages. Many generators and switching stations were in basements, which were subject to flooding. Banks with working generators soon found their fuel reserves running low. For many, deliveries of fuel became an ordeal, with delays measured in hours or even days. In some cases, deliveries of fuel and other essential services were diverted for humanitarian and emergency efforts.

Meeting the challenge. While the 2004 experience led many banks to invest in alternative power sources, such as generators, 2005 highlighted the importance of the location and fueling of such power sources, including alternative fuels (e.g., propane and natural gas) for generators. Limited power and uncertainty about fuel deliveries were paramount in decisions about which equipment and facilities were powered following the storms, and even whether, and to what extent, operations needed to be scaled back during the recovery period.

Facilities

The breadth of the devastation affected every aspect of business operations, including rendering many brick-and-mortar facilities unusable, at least temporarily. Some institutions came up with unique solutions. For example, after Hurricane Katrina destroyed their facilities, several institutions in Baton Rouge and Kenner, Louisiana, cooperated to open a shared facility so they could serve their customers and instill confidence that they were coming back. In Lafayette, Louisiana, one institution allowed a competitor to use a teller station at its branch office to conduct business. One Florida-based service provider allowed a client bank and a competing service provider to set up temporary operations at its data center facilities after Hurricane Charley.

Immediately after Hurricanes Katrina and Rita, federal and state banking regulators worked with the Department of Homeland Security and law enforcement to arrange for bank officers to get into restricted areas so recovery plans could be refined and temporary facilities opened. In some rural areas, state officials helped bankers to enter the areas and assess their damage. Additionally, unprecedented cooperation between state and local agencies helped to expedite building permits and inspections for temporary facilities.

The existence, location, and capacity of an adequate disaster recovery facility are critical to any BCP. Fortunately for most of the affected banks, capacity limitations at the recovery facility never became a serious problem, as cooperation allowed for the movement of work to locations that had adequate staff and equipment. However, the locations of these facilities were important. Some banks' recovery facilities were too nearby and were destroyed by the same storm. Others were too far away, which hindered recovery because of delays in recovery staffs' transportation to the facilities.

Meeting the challenge. The broad geographic areas affected by the storms demonstrate the importance of the location of banks' recovery sites. Banks that recovered operations quickest had recovery sites outside the expected disaster area and had planned that recovery team members would be sent to the site before the storms. "Buddy bank" arrangements also proved successful. In these arrangements, partnering banks are far enough away from each other that a single disaster is unlikely to affect both, but not so far that such an arrangement is useless. Each bank benefits from having a prearranged facility to serve customers and establish basic operations during the recovery process.

Effective BCPs Are Formal, Flexible, and Open-Ended

The 2004–2005 hurricane seasons highlight the importance of enterprise-wide, comprehensive BCPs to the survival of an institutions and its ability to serve customer needs. Most banks in the Gulf Coast region had reasonable BCPs. Still, better testing of the continuity plans and recovery procedures could have identified problems ahead of time. The Business Continuity Planning IT Examination Handbook.⁴ issued by the Federal Financial Institutions Examination Council (FFIEC) on May 22, 2003, contains extensive guidance on business continuity planning for banks. The FDIC maintains hurricane-specific guidance on its Web site.⁵

The FFIEC guidance stresses that the development of a successful BCP requires a commitment of sufficient resources and delegation of authority by senior management and the board. The guidance states that a plan should be thoroughly and rigorously tested under realistic disaster scenarios, include sufficient employee training measures, and be updated on an ongoing basis to ensure that it remains relevant. Steve Feller, vice president and head of Enterprise Services Center Disaster Recovery Operations at Harland Financial Solutions, provides this advice: "It is important that a bank and its service provider work together throughout the life cycle of business continuity planning. Every step of the planning process is an opportunity for both to learn together. That is why testing is so important — it creates opportunities to find out what doesn't work. When I have a test that doesn't work as planned, I tell my team that is a successful test, meaning that I want to find that out now rather than during a real event. I stress learning how to respond quicker and recover faster from every opportunity."

No one plan is perfect for all situations. Effective BCPs are flexible and allow for modifications during execution. The more information they include, the better prepared management will be to address the unexpected.

James O. Brignac, CISA
Information Technology Examination Specialist,
Dallas

Kevin J. Lenzmeier, CISA NSCP
Information Technology Examiner,
Tampa

The authors acknowledge the assistance provided by the following individuals in the preparation of this article:

Mark A. Elliott
Financial Analyst,
Dallas

Peter A. Martino
Supervisory Examiner,
Tampa

Deona L. Payne
Field Supervisor,
Tampa