We recently scheduled a review in the Jersey Shore the day Hurricane Sandy slammed into the East Coast. Being savvy travelers, we anticipated potential flight delays and the inconveniences that correspond to those delays. We had another gig scheduled in the Midwest that week and decided to postpone the Jersey Shore trip. We rescheduled the meeting and traveled to the Jersey Shore two weeks later and the pictures of the disaster on TV and the Internet only tell a small fraction of the devastation. Witnessing a natural disaster first hand and the trailing impact is life changing. Sand was send two miles up the shore, National Guard with rifles blocked the island due to looting and every hotel and available room was full of tradespeople from all over the east coast working to restore power grids, water lines and overall shoreline infrastructure.
Last year we conducted a review in Tuscaloosa, Alabama two weeks after a series of tornados ripped through the city. On our way to visit the client, we had the opportunity to drive through a swath of damage caused by tornado. The devastation was about ½ mile wide and 7 miles long. Truly mind numbing.
Our discussion today pertains to the need for all mortgage bankers to develop and test a Disaster Recovery Plan, also known as a Business Continuity Plan.
The last question of our Mortgage Banker Risk Assessment (MBRA) Review asks the question: Do you have a written Disaster Recovery Plan? And do you perform annual testing on the plan?
Generally the answer is "Yes, we have a plan! We perform daily back ups to the cloud and conduct a tape back up taken and stored offsite each week." The C. Watts buzzer sounds and we respond with, “Doing data backup is great, but it is not a Disaster Recovery Plan. What if you woke up tomorrow morning and your office, equipment, etc. did not exist anymore and you needed to fund $35M over the next two weeks. How would conduct business without your office and equipment?”
In short, a Disaster Recovery Plan covers many aspects a business must anticipate and plan for if a major disaster event disables business operations. Examples don’t necessarily mean your office is wiped out, but would mean power outages for some length of time, your office is uninhabitable, employees can’t get to the office, etc. The business shuts down, but customers still need to be serviced. It is a “play” on management and employees to understand what needs to be done if a disaster disrupts the business. The playbook should be in writing and tested at a minimum annually.
Our firm has not developed a written “out of the box” Disaster Recovery Plan because every company has unique variables that needs to be addressed if a nature disaster occurs. We do provide an outline of items that need to be addressed for developing such a plan. The following are those items:
C. Watts Disaster 14 Point Disaster Recover Plan
1. Who has overall responsibility during a disaster? Who are the back-ups?
2. Disaster recovery is more than just technology. The plan must address the following business issues:
a. Loan originations.
b. Loan closings.
c. Secondary market commitments and deliveries.
d. Payroll and human resources.
e. The financial strength of the company to withstand temporary and/or protracted interruption of cash flows.
f. Insurance coverage for disaster recovery.
3. Describe strategies for disaster recovery plan regular testing, at least annually.
4. Identify all points of possible failure.
5. Identify all outsourced relationships and dependencies.
6. Identify the recovery site, with possible back-ups. Who will gather there? What supplies are needed?
a. What communication devices will be brought or be available?
b. Is there a need for back-up power if utilities are not available?
c. What documents will be or must be brought there?
d. What software and data should be stored or brought there?
7. Address security at the back-up location, possible law enforcement issues.
8. Name a public relations or media spokesman. Name the back-up.
9. Is insurance in place for business interruption? Terrorism? Natural disaster? Identify what is included and what is excluded.
10. Identify a contact tree for all employees.
11. Lay out the exact actions to be taken in the immediate 24 hours after a disaster occurs.
12. Identify decision-making authority with back-up persons.
13. Identify ways in which the plan is disseminated to all employees.
14. Print key data on wallet sized, laminated card and distribute to all employees.
C. M. "Corky" Watts, CMB
Cameron Watts, CMB