Disaster Recovery Planning - Time Well Invested! An earthquake, a war, a hurricane… I survived those three life events by the age of thirteen. Even though each one of those experiences left a mark in my life, they taught me many lessons and created an awareness that not many people possess. I became very appreciative of everything I have and of every person in my life. At the same time, it created a sense of “being ready” at any time for “what could happen” and what I would need to do to bring things back to normal again.

When I hear a train go by, my memories bring me back to the noise of an earthquake back when I was six years old in Nicaragua. A deep sound from beneath the earth, a sound of destruction. Your home, your office, and everything around you becomes distorted and destroyed right in front of your eyes. Your own life could be gone if you’re in the wrong place at the wrong time. I learned that all your possessions and what you worked so hard to attain can be “torn to pieces” in a matter of seconds.

When I hear the noise of a helicopter, it reminds me of the sound of machine guns in the background when I was twelve years old and lived through the war in Nicaragua. I remember going to bed with the rattling noise of the windows with each bomb that was dropped. They were close to my house and some days it felt as if they were fighting right in my own backyard. The terror you feel when you are helpless, only a victim of someone else’s war, is indescribable. You learn to appreciate life in a new way.

When I hear the sirens announcing the possible tornado coming to your city, it reminds me of the hurricane David I lived through in the Dominican Republic when I was thirteen years old. I observed from a fourth floor apartment about three miles away the waves from the ocean that destroyed the island and the noise of the wind getting through the windows in our apartment. I learned that everything you own can literally “blow away” in a matter of seconds too.

But I choose to look at life from the positive perspective and I’m grateful to God that I’m still here so I can help others in many ways. That’s one of the reasons I founded Malzahn Strategic. The three key things we focus on—strategic planning, enterprise risk management (ERM), and talent management—all have to do with disaster recovery planning. From the strategic planning perspective, you have to put strategies in place to protect your business from ANY disaster and to keep the company safe. From the enterprise risk management perspective, you need to have strategies to mitigate ALL risks that can potentially affect your company. And from the talent management perspective, you need a plan to protect your company from losing your KEY talent, protect it from internal fraud, and also to plan ahead for future talent to bring your company to the next level.

Disaster Recovery Planning falls under your IT Security Program most of the time, which in turn is part of your ERM program. Below is a simple way to start with a Disaster Recovery Risk Assessment:

Conduct a risk assessment based on your business location and probability of any type of incident happening:

• Threat/Vulnerability (include fire, flood, earthquakes, riots, tornadoes, etc.)
• Probability of incident (how probable is for this natural disaster to occur in your area)
• Severe Rating (how severe would it be if it were to ever occur – low, medium or high)
• Criticality (how critical would this incident be to your business – low medium or high)
• Confidentiality (this refers to data breach due to a disaster)

Conduct the following risk assessment based on the type of asset and then risk rate each asset:

• Asset Type: Application/Software, Process, System
• Asset Medium: Paper or Electronic
• Vendor Name
• Controls/Procedures in Place
• Description of Risks Associated with Asset
• Risk Mitigation: Description for Mitigation of Risks
• Risk Rating: Low, Medium, High
• Criticality to Bank or organization: levels 1 to 5 with 5 being the most critical
• Residual Risk: Low, Medium, High
• Information Classification: Public, Non-Public, Confidential
• Threats/Vulnerabilities: Level of Damage, Type of Vulnerability
• Threat/Vulnerability Likelihood: Low, Medium, High
• Vital Resources: Description of Vital Resources to the Bank Operations
• Recovery Point Objective (RPO): Description of How the Information or Asset Will be Recovered
• Recovery Time Objective (RTO): Approximate Time of Recovery

Something else to consider is that there are other types of disasters that are not “natural disasters” and they relate to your key talent in your company. I call that “Disaster Recovery for People.” I wrote another article called “Succession Planning – Is It Only for the CEO?” where I urge readers to consider the other key positions in the organization to have a backup for and be ready in case you lose those employees unexpectedly. Part of the DRP is also to include a Pandemic Disaster Plan. Regulators were very focused on that topic several years ago and for obvious reasons, it should still be part of your plan. The same way, having a data breach could be disastrous for your company as we all learned from recent incidents at large corporations that suffered a cyber attack. The biggest disaster is your damaged reputation and the financial damage that derives from that as a consequence.

I want to conclude by encouraging you to appreciate everything you have and the people in your life. I also want to encourage you to create a Disaster Recovery Plan for your institution and update it and test it annually. We don’t want to live in fear but we live in a world where life happens to all of us and we must be prepared at all times.

Building Your ERM Puzzle: Strategically Integrating it into Your Bank's Strategic Plan It’s all about risk! We, bankers, know how to identify and assess risk, mitigate and eliminate risks when possible, and monitor and report on those risks. So why are we afraid of ERM? Enterprise Risk Management (ERM) is here to stay so we might as well learn what it’s all about. It’s not that complicated!

If you think about your bank’s strategic plan as a simple yet complete puzzle, some of the key components would be the Vision, Mission, S.W.O.T. analysis, Capital Plan, Talent Management, and the Enterprise Risk Management (ERM). Today we will focus on ERM.

Risk management is at the heart of banking and every bank has to have processes, policies, and procedures in place in order to assess and manage the risks on their balance sheet. Think of ERM as a big puzzle within the bigger strategic plan puzzle. Just as with any puzzle, in order for you to put it all together, you’ll need a picture of the entire puzzle to know what it should look like when it’s all done. You will also need to know what the fundamental pieces of the puzzle look like and how the other pieces that connect to each piece relate to each other. In this article, we will use the analogy of puzzles to explain how important ERM is for your bank, no matter how small in asset size you are, how ERM is intricately related to every area of your bank, and how you can integrate your ERM program into your bank’s unique strategic plan. The ERM is a crucial piece of your strategic plan puzzle.

At the basic level, ERM has three phases (big puzzle pieces):

Identifying and assessing risk: During this phase you identify all the risks that can potentially affect your bank by using risk assessments. In this phase you should also identify unique risks that your bank has such as a relationship concentration or a specific industry concentration.

Mitigating and eliminating risk: During this phase you determine what your bank will do to mitigate some of the risks and how you can eliminate other risks. There are some risks that you will never be able to eliminate. For example, wire transfers are inherently high risk and after you put controls in place such as policies and procedures, you will end up with a moderate to low residual risk. But the risk will never go away completely.

Monitoring and reporting risk: Once you have established your policies, processes, and procedures to mitigate and eliminate the risks you identified through the risk assessments on the first phase, then you need to monitor those risks and report the results to your Board of Directors. Monitoring is key because that’s how you establish accountability across the organization to ensure all your policies and procedures are being followed and that they actually work. The reporting is crucial because that is where the leadership team provides the results of the monitoring efforts to the Board and now the Board is liable for knowing and understanding what the bank is doing in regards to ERM. Some reporting tools are heat maps where you plot using colors where you feel each risk is at in regards to how the bank is mitigating that specific risk at that time.

The next step is to integrate your ERM program into your strategic plan by coming up with strategies to mitigate each one of the risks identified in the various categories of risk. Below are the most common risks: (each of these risks is a puzzle piece in itself connected to each other)

Capital, Liquidity, HR, IT, Profitability/Earnings, Legal, Operational/Transactional, Reputational, Compliance/Regulatory, Interest Rate Risk (IRR), Credit

Below are the key components of an Enterprise Risk Management Program: (small puzzle pieces)

• Capital Plan (should be completely integrated into your Strategic Plan. What are your strategies to retain, protect, and grow your capital?)
• Board Risk Appetite and Tolerance Statement (vitally important) –The Appetite Statement is your qualitative idea, what risks do you want to pursue? The Tolerance Statement is your quantitative statement, what are you willing to lose?
• IT Security Program, which includes:
  • Disaster Recovery Plan
  • Business Continuity Plan
  • Cybersecurity Program
  • Vendor Management
• Compliance Program
• Internal Audit Program
• Liquidity Contingency Funding Plan

Below are some simple steps to help you get started on your ERM program:

• Form an ERM Committee (include your Board Directors and every area of your bank)
• Write an ERM Committee Charter
• Train your Board of Directors so they know their liability
• Train your staff so they know their role in ERM and how every area is integrated with others
• Define Board and leadership team responsibilities in regards to ERM
• Start by doing an ERM risk assessment to cover all areas of the bank
• Know the bank regulations – know your industry
• Establish policies to comply with regulations
• Establish procedures and processes to comply with your policies
• Establish an organizational and operational infrastructure to support current size and scalable for future growth
• Establish Key Performance Indicators and Key Risk Indicators and reporting
• Never stop the cycle! Once you have a program in place. Repeat!

Small asset size is not an excuse to not have an ERM program. The key is to know all your risks across the organization and to do something about them. The complexity of building your ERM puzzle depends on the size and uniqueness of a bank but, in the end, regulators will work with you and will be more understanding if they know you have done your best in putting in place a professional, well-thought out ERM program. Most banks have some pieces of the puzzle done but usually they don’t have them put together into one big puzzle or don’t know how to put it together. Others don’t have the picture of the entire puzzle. Seek out professionals that can help you put your ERM puzzle together!