InfoSight Spotlight: Business Continuity Planning: Board Responsibilities

A credit union’s board and senior management are responsible for overseeing the business continuity planning process, which includes:

1. Establishing policy by determining how the credit union will manage and control identified risks;
2. Allocating knowledgeable personnel and sufficient financial resources to implement the BCP;
3. Ensuring that the Business Contingency Plan (BCP) is independently reviewed and approved at least annually;
4. Ensuring employees are trained and aware of their roles in the implementation of the BCP;
5. Ensuring the BCP is regularly tested on an enterprise-wide basis;
6. Reviewing the BCP testing program and test results on a regular basis; and
7. Ensuring the BCP is continually updated to reflect the current operating environment.

It is the responsibility of the credit union’s board and management to ensure that risks are identified, assessed, prioritized, managed, and controlled as an integral part of the business continuity planning process. The board and management should establish policies that define how the credit union will manage and control the identified risks. Once policy is established, it is also important for the board and management to understand the consequences of these identified risks and support continuity planning on a continuous basis.

As part of their support, the board and management should assign knowledgeable personnel and allocate sufficient financial resources to properly implement an enterprise-wide BCP. A large or complex credit union may need a business continuity planning department with a team of departmental liaisons throughout the organization. A smaller or less complex credit union may only need an individual business continuity planning coordinator. Credit Unions may also choose to have a business continuity planning group or committee that meets regularly with the BCP coordinator to discuss various issues, such as policy changes, employee training, and test plans. Regardless of how personnel resources are allocated, management should establish roles, responsibilities, and succession plans for various operational disruptions, as they may affect business processes in different ways. The board and management should also allocate sufficient financial resources to cover the expenses associated with alternate processing arrangements, business recovery, and comprehensive insurance coverage.

For additional information, click here for the topic.

Read the full InfoSight newsletter here.