Our company's program was rather antiquated up until a few years ago. While there was a BCM program in place, it was largely a repository of Word documents. The bulk of our efforts ensured that basic data elements were updated annually. While we maintained compliance, we made due with out-of-date methods that were largely ineffective.Jay Geppert, Operational Risk Manager
Team-Based Planning in a Regulated Environment
PlainsCapital Bank—a subsidiary of Hilltop Holdings—is the sixth-largest bank in Texas. They maintain a statewide presence with approximately 1,500 employees and nearly 70 commercial and retail locations. Their diverse range of service includes commercial banking, treasury management, private banking, wealth management, and consumer banking.
The Business Continuity Planning (BCP) team of Operational Risk Manager Jay Geppert and Operational Risk Analyst Jessica Camacho are responsible for the bank's Business Continuity, Vendor Management, and Operational Risk programs. Together, they coordinate annual tests of critical departments and applications and work with business unit managers to update plans for their Business Continuity Committee, Information Systems Steering Committee, and other senior management officials.
Emphasizing the Need for Effective Planning
Financial institutions operate in a highly-regulated environment that makes compliance critical and emphasizes Business Continuity and disaster planning components. These include core component use, application concentration, interdependencies, inflows, outflows, and the ability to effectively manage risk. Such an approach is far from ideal from a holistic planning perspective—making it difficult to understand, manage, and control risk.
The company invested in ResilienceONE from Strategic BCP, a powerful software tool that helped elevate planning to a strategic level within the organization. Planning has shifted to a functional approach in-line with overall corporate objectives. The system helps ensure consistency of the operational risk management framework, allows for effective implementation across business units, meets operational and regulatory requirements, and prepares the organization for future growth—all while adapting to the changing demands of a dynamic corporation.
Making Strides with Real-World Accomplishments
The team states that a rapid change is taking place—noting that they once merely "got through" audits and examinations. Unable to determine which applications were in use by most business units, they were unaware of critical interdependencies. Other accomplishments include the introduction of effective, thorough IT recovery plans and runbooks—all grouped by recovery type and criticality. They also state that PlainsCapital is now far more ready to open the books to auditors and external regulatory examiners now than they were in the past.
The team has demonstrated organization-wide concerns on desktop connectivity in a disruption. With successful leadership buy-in, there is now more visibility and participation with upper management and improved appreciation of the roles of BCP and DR. Establishment of the Business Continuity Management Committee has successfully shaped an appropriate forum for management to provide input and take ownership of the direction of their Business Continuity programs. As a result, BCM enjoys increased overall relevance. Planners report a better working relationship with business unit managers who have an increased understanding of the need for effective planning.