<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

6 BCP Lessons Learned When Ncontracts Shut Down Its HQ for the Day

author Jon Bowker
3 min read
Feb 4, 2020

What would happen if headquarters went down? Could your staff and institution carry on business as usual or would it be a major disruption?

Ensuring smooth operations, even when your main office is inoperable or unreachable, is a cornerstone of business continuity management. Clients, customers, members, and regulators expect you to reliably and consistently deliver products and services as promised.

Related: What is Business Continuity Management?

But it’s not enough just to have a plan. Those plans need to be tested.

It’s not just something we preach as a company that provides a platform for creating, testing, and maintaining business continuity plans (BCP). It’s ingrained into our practice. That’s why late last year we shut down our Brentwood, Tenn., headquarters for 12 hours for our annual disaster recovery and business resiliency test.

We sent our 75 Brentwood employees home to work remotely, disconnected our office from the Internet, and paid close attention to see if everything would go as expected.

The test was a big success with no surprises. Not a single customer complained about a hiccup in service, and employees were able to work from home. There was minimal impact to operations. Everything went as expected.

Related: Is Your Vendor Prepared for a Disaster?

I attribute to the success of the test to planning ahead. In addition to a comprehensive BCP, we also invested the time into preparing staff and processes for the test. Here are a few of the takeaways we gleaned from the exercise.

Make sure everyone knows their role. Staff was given notice of the test one week in advance and two reminder emails in the leadup. We made it clear that it was a workday, and everyone should be prepared to go about their regular business duties at home. You can’t overcommunicate it.

C-level and senior vice presidents were also made aware of their roles, including a call tree and notification tree. While it wasn’t strictly necessary since everyone knew the test was coming, it allowed us to test that element of the plan.

If something isn’t going to work, know in advance. The biggest challenge to employees working from home was a legacy file server housed in our office. While nearly all of our data is stored in the cloud, a few employees still like to use our old network drive. While there is nothing critical to operations there, it still holds files some Brentwood employees use regularly.

We knew ahead of time this drive would be inaccessible during the test. That’s why we’re working towards retiring it later this year. Employees need to be able to access those files.

Conduct a tabletop exercise before the BCP test. We regularly discuss BCP, bringing stakeholders together so we can understand and evaluate the potential impact if a business unit—or the whole headquarters office—is down. That’s how we knew the file server would be inaccessible.

This ongoing communication lets us understand how different departments leverage technology for their business processes, making it easier to assess the inherent and residual risk of shutting down the office. Instead of telling people to stay in their lane, we welcome the sharing of ideas.

But we still sat down with stakeholders for a 30-minute tabletop exercise before we executed the test. Going through the steps ahead of time gave us a chance to make sure we had everything in place to minimize any negative impact the test might have. Had we uncovered any issues, we’d have time to prioritize remediating them.

Don’t forget to consider vendors. Right before the test we went through and re-evaluated all our vendors to quantify their risk and verify that they were appropriately ranked. Vendor management plays a key role in BCP when overall business resiliency depends on the resiliency and reliability of our vendors. Proactive vendor management is a must.

Use the extra downtime for maintenance. If the office is shutdown on a workday for a test, make the most of the opportunity for major maintenance without making staff work at night or on a weekend. While the main office was shut down, we used the opportunity for a full network refresh, replacing a lot of the network to increase redundancy.

If we lost our HQ, we could still get the job done. If we ever lost our office, work could still go on remotely thanks to our plan. Yes, some employees wouldn’t be able to access a few files (a problem soon to be remedied), a few folks used to working with multiple monitors would be frustrated by having just one screen, and a few individuals would struggle with working remotely. But ultimately, we could still get the job done.

With our annual disaster recovery and business resiliency test behind us, we remain confident that we’ll be prepared to serve our clients if we ever have to shut down our physical office—whether it’s due to weather, a fire, or any other event. It’s another risk that’s been proactively managed.

 

Learn more about how business continuity management software can help you.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Board & Management (Part 3)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Board & Management (Part 3)

Apr 3, 2020 2 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)

Apr 10, 2020 4 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Compliance and Risk (Part 4)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Compliance and Risk (Part 4)

Apr 6, 2020 3 min read