Turning Up the Heat on Disaster Plans (1989)

Increasing use of automation prompts new guidelines from federal banking agencies Last year was disastrous for banks: * January 1988-A fire in a basement electrical panel knocked out lights and power in an operations center operated by Chase Manhattan Bank, New York, N. Y , disabling some processing operations for up to four days. * May 198 8-A fire on the 12th floor of the 62-story headquarters of First Interstate Bancorp, Los Angeles, Calif destroyed the bank's trading floor and ancillary facilities. * May 1988-A fire at an Illinois Bell Telephone Co. facility in Hinsdale, Ill., destroyed both voice and data communications lines, affecting banks and other businesses in and around Chicago. Those were the major physical disasters of 1988. Plenty of institutions faced other, less publicized troubles: flood damage, fires, acts by employees, and equipment failure. Large or small, disasters that affect banks' automated systems can quickly lead to economic disaster If a bank does not have a plan to deal with a disaster and cannot conduct business normally for days, weeks, or months, the impact of the disaster on its bottom line can be significant. lack of a plan can result in fines of up to $10,000 imposed on corporate officers under the Foreign Corrupt Practices Act that was passed by Congress in 1977. Leslie S. Chalmers, vice-president, Bank of California, San Francisco, points out that, The bank industry's dependency on computerized systems is probably more extreme than other industries. I attended an industry meeting at which a clothing manufacturer said some of his firm's products could be produced for a month or more without its computer system operating. In contrast, banks could not cash a check if we didn't have a computer running, she adds. Chalmers is chairman of ABA's Information Systems Security Committee. New guidelines. Banks' expanding use of, and dependence on, automated systems has not escaped notice by the federal bank regulatory agencies. They are jointly developing new guidelines regarding disaster recovery planning. agencies are the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corp., the Federal Home Loan Bank Board, the Federal Reserve Board, and National Credit Union Administration. Representatives from these agencies serve as members of the Federal Financial Institutions Examination Council (FFIEC), which was established in 1987 to coordinate the supervision of depository institutions. When finalized-probably in August-the guidelines will apply to all financial institutions regulated by the agencies. Initial work on the guidelines began at a September 1988 meeting of 16 senior examiners from the agencies. Council's electronid data processing subcommittee has continued work on the guidelines since that meeting. pending guidelines do not constitute amanual on how to develop a disaster recovery plan, says Jerry Jones, chairman of the EDP subcommittee. Jones is deputy director of EDP and management information systems controls, office of regulatory activities, Federal Home Loan Bank System. The guidelines will advise institutions to identify critical functions and to have the capability to get those functions up and running again when disaster strikes, says Jones Under the guidelines, the agencies will expect a disaster contingency plan to be developed and approved by the bank's board of directors. But the guidelines won't say who in the bank is responsible for the development of a plan. Banks can make those assignments. Several factors spurred the development of the guidelines, says Jones. They include the absence of contingency plans; the failure to test plans that do exist; banks' increasing reliance on automated systems; and actual disasters, such as the First Interstate fire. …