1

Disasters are nothing new for cooperatives. You’ve faced ice storms, floods, tornadoes, hurricanes

and other unforeseen events—and mastered how to get the lights back on quickly and efficiently

after such catastrophes.

A recent survey, however, spotlights the alarming fact that many coops are not prepared to restore

business processes or recover records in the event of disaster.

If you lost your building and its contents today, how long would it be before you could resume

normal business functions like customer service, vendor payments and customer invoicing? Would

you have off-site records of past transactions? Would your staff have a place to relocate and begin

the process of business resumption?

Developing a business recovery plan is neither quick nor easy, but it is necessary. Not having a plan

could jeopardize your coop’s future. Such preparation has even come to be recognized as another

fiduciary responsibility of the coop’s leadership.

2

World events of September 11, 2001, showed the world how crucial business resumption planning

can be to an organization.

But, not every threat relates to potential terrorist activity and we shouldn’t think only in those terms.

Long before that tragic day, CFC spent years developing and fine-tuning a disaster recovery plan that

would allow us to continue serving our members in the event of catastrophe.

But you don’t have to be a $20 billion finance organization like CFC to need or be able to afford a

disaster recovery plan. Every cooperative system needs to seriously consider this.

3

Here’s a list of potential disaster situations that any one of your systems could experience.

If the situation was severe enough, it could disrupt your basic business processes.

Recovery of your internal business functions could be much more difficult, if you lack any kind of

business resumption plan.

4

During 2002, CFC surveyed its members regarding business recovery planning. It was a pretty

comprehensive on-line survey. More than 60% of the respondents said that they have no business

recovery plan in place.

None of those surveyed had a budget for business recovery programs.

Almost 100 percent keep records in a combination of paper and electronic formats; more than half of

these store all paper records at the co-op headquarters—at risk of total loss in the event of disaster.

5

CFC shares the lessons we learned in “When Disaster Strikes: A CFC Primer on Business

Continuity Planning.” (RVP should hand out copies of the blue, disaster recovery planning primer).

This guide is an overview of considerations and awareness of the disaster recovery process from an

internal business perspective- not from an outside operations perspective.

Also, refer to Chapter 7 of the Financial Best Practices guide: Business Recovery Planning:

Preparing for “What If”.

6

Not just re-energizing the lines and turning the lights back on.

It is a plan that must include provisions for recovery of data and resumption of critical business

functions within a defined time frame.

The plan addresses how to bring the entire organization back on line after a disaster strikes.

One word sums it up: “Preparation”.

7

Disasters can come in many forms and when least expected.

Here are some recent examples of actual disasters are our member cooperatives.

8

The proposed RUS regulation will require an Emergency Restoration Plan with every new loan

application.

CFC’s “When Disaster Strikes” booklet has been used by many cooperatives as a template for

getting started. As a matter of fact, the 5 phases of Business Recovery Planning used in this

presentation came from this booklet. This resource can be a big help to your staff, in order to

address the new RUS regulation requirement.

9

No single plan or guide can lay out a road map for every co-op to follow in the wake of disaster.

Each co-op must design its own plan. Of course, your plan should be tailored to your risks and staff

availability and resources. But, even small systems should protect themselves by applying the

principles outlined in the FBP guide, even if on a simplified basis.

“When Disaster Strikes” outlines the common elements and considerations of all plans.

It also shares “Lessons Learned” from CFC’s own planning experiences. Remember, you don’t have

to be a large company to warrant a business recovery plan.

10

The planning effort will require a serious commitment of time, staff and financial resources, so full

buy-in is important.

Getting that support is sometimes the most challenging part of the process. Some decision-makers

may balk at the time and expense of preparing for an event that may never occur.

2 critical appointments need to occur: 1) a Disaster Recovery Project Manager and 2) a Disaster

Recovery Task Team.

Disaster Recovery Task Team: should consist of representatives from all of the co-op’s business

and operations units. Each team member ensures that his/her departments’ requirements are covered

in the recovery plan.

11

Once the Project Manager is appointed, and the Task Team is in place, it’s time to discuss what

threats the cooperative may face, what systems or resources might be lost in a disaster, the team’s

goal for restoration of business functions, and the plan of action the cooperative should take for

recovery.

2 important objectives of the Recovery Plan are:

- the Recovery Point Objective: The maximum allowable date loss for a critical business

function. How many days, hours or minutes of transaction records and other data can the

co-op afford to lose?

- the Recovery Time Objective: The maximum allowable time a critical business function

can be unavailable. How long can the cooperative go without that function?

12

13

Determining Recovery Objectives: how quickly critical operations must be resumed and how much

data loss can be absorbed.

Each business unit should have its own plan for recovering its operations.

You should identify outside consultants or vendors who can help you in developing critical back-up

systems or off-site locations for storage of data or for continuing operations during a crisis.

14

Now that you’ve identified your objectives and goals, your Task Team should:

1) Analyze critical business functions. An insurance assessment and budgeting also will be part

of this analysis.

2) For management, Phase 3 involves structuring a plan that brings each business unit to

resumption of operations, along a timeline, and also discusses possibly resuming operations at a

secondary location, if necessary.

15

16

Test the technical infrastructure.

Test each business unit’s plan.

Combine technical and business unit plans to test the entire recovery effort through the restoration of

critical functions.

17

This is how the process works going forward.

Regularly scheduled testing of the plan’s components will be essential to ensure its viability over

time.

You will also need to monitor and adjust your plans as business functions and support structures

change.

18

This process will do more than prepare your coop to recover from a disaster and resume

business operations. Additional advantages:

Better understanding of the coop’s daily functions.

Documented business processes.

Enhanced security of information systems.

Clearer picture of the coop’s dependencies on each business unit.

Awareness of the need for cross-training on critical business functions.

19

In summary, a business recovery plan can be seen in 3 steps:

1) The first item for the Task Team is to perform a threat analysis. What types of disaster could

occur and, if they do, what would be the likely impact? Usually these will be things like

physical assets such as buildings, equipment, vehicles and materials.

2) Next, the team should identify the co-op’s critical business functions, the minimal resources

needed for each of them to function following a disaster, and then rank them in order of

importance. Assessing these can help you to set recovery points and time objectives for each

business unit.

3) Develop Plans for Recovery. Now the Task Team is ready to develop plans to restore critical

business functions.

The board of directors must first recognize that they drive these decisions from a high, strategic

level.

The board directs management to initiate the process that will result in a business recovery plan.

We have provided a board policy template (Exhibit 7B in FBP) to help you get started.

20

21