DRJ's Spring 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Winter Journal

Volume 31, Issue 4

Full Contents Now Available!

Over the past several years, through merger, acquisition and new services, U.S. Bancorp has grown into the nation's 11th largest bank holding company. Along the way, however, those charged with business continuity for the bank began to realize the old methods of continuity planning were not going to effectively meet the needs of the new organization.

'Our customers expect us to be there for them no matter what the circumstances and that means our continuity plan needs to focus on ensuring availability of those critical systems and functions that truly allow us to keep serving customers,' said Ken Donovan, business continuity and disaster recovery manager for U.S. Bancorp. 'Our approach had been to build continuity plans for every function, right down to janitorial services, using a homegrown continuity planning tool that wasn't scalable to the requirements of a larger organization.'

With $82 billion in assets, Minneapolis-based U.S. Bancorp operates more than 1,000 banking offices throughout the Midwest and West, and offers full-service brokerage services through U.S. Bancorp Piper Jaffray. The bank is structured around 13 core lines of business, such as retail banking, payment systems and investment banking. The continuity program needed to focus on these core business lines and the centralized information technology (IT) services.

With this streamlined focus on mission-critical functions the bank reduced the number of plans required from 1,500 to approximately 150, and the number of individuals involved from 900 to less than 200. In addition to the centralized continuity team, these individuals include a continuity coordinator and a few continuity planners within each of the bank's business lines.

Finding a Tool to Support the New Approach

Yet, even with this new approach, the bank realized effective and sustainable continuity planning would still be a tremendous challenge. One of the greatest concerns was how to ensure that all those who need to view or manage the plans have access and an effective way to collaborate without losing centralized control of the planning process.

'One line of business may have six or seven critical functions spanning across several states and those responsible for continuity planning may be just as distributed. For example, the business line coordinator may be in Denver, with one planner in Portland and another in St. Paul,' explained Donovan. 'As a result, we had to have all of our plans built de-centrally but centrally located so that anyone around the country could readily access their business line's continuity plans.'

Based on this requirement the bank decided it needed a Web-enabled continuity planning tool and began investigating its options, including Revolution (Revo) from Comdisco, based in Rosemont, Ill.

 'Once we brought Revo in and ran it through some demonstrations, we could see this was an entirely new tool built from the ground up to leverage the Internet. Regardless of which of our 21 states or 13 lines of business our planners were in, the tool would offer them ready access to their plans and simple collaboration between planners, while our central continuity team could still manage and administer the overall plan,' said Donovan.

At the same time the bank was readying the new software for implementation, the company began conducting business impact analyses (BIAs) to reflect its new approach of focusing on mission-critical applications that supported crucial functions within its lines of business.

'Before any business line implemented the new tool, they had to be trained on our new methodology and complete their BIA,' said Donovan. 'We didn't want to just transfer the thousand-plus plans we had into the new tool, but use our new methodology to improve the continuity process.'

From Evaluation to Implementation

In implementing Revo the bank took a staggered approach to ensure that the central team could focus its efforts on helping each business line make a successful transition. The first three business lines chosen to implement plans using the new Web-based planning tool were the securities business of U.S. Bancorp Piper Jaffray and its supporting central IT functions; the bank's networking operations; and the wealth management area.

The transition was a success with both the central team and with the planners and coordinators within the business lines. For the central business continuity team, the tool met two critical criteria: it is easy for planners to use, and it is easy to maintain.

'We've found that even those who are 'mouse-challenged' use the product well because of the way it is designed and flows,' said Donovan. 'Revo is browser-based, so we don't have to provide in-depth lessons on how to use the systems and software.'

From an administrative perspective, this Web-based approach also is appealing. Rather than having to install, trouble-shoot and maintain current versions of client/server applications on each of the planners' computers, all that is needed is a web browser and Internet access.

The reaction to the new tool from those charged with building and managing the plans also has been very positive. 'Its ease of use is amazing compared to where we used to be,' said Donovan. 'In the past, planners were building templates and trying to fill them out all at one time. There was no consistency and it was time consuming. But with Revo, the basic templates are all there and the planners just have to fill in answers based on their BIAs.'

 According to Donovan, these features along with the ability of the planning teams to be able to easily collaborate has not only improved the quality of planning but also reduced the time spent planning by as much as seven-fold.
While Donovan favors team-based planning, the bank's continuity team is also highly sensitive to security issues and takes full advantage of the security features built into the planning tool. 'Revo's security system allows us to grant and deny access privileges based on a variety of criteria,' said Donovan. 'For example, we can set parameters defining who can see which plans or what portions of those plans they can view and edit. So we may determine that a planner in retail banking can only access retail banking plans or we may restrict that person's access even further to a single section of a plan.'

Another feature of the tool is scenario-based planning. While U.S. Bancorp still focuses on worst-case planning scenarios, the tool will allow the company to plan for different types of contingency events and the corresponding level of impact. For example, U.S. Bancorp could incorporate plans for two-hour power outages as well as a plan for a fire that destroys an entire building.

Spreading the Word

With success well underway at U.S. Bancorp, Donovan has become a big proponent of changing the way business continuity planning is done within the financial services industry, taking every opportunity to speak about revamping methodologies and using new tools. In fact, he's even set up a test server of the planning tool that sits outside the bank's own system and has invited several of his colleagues in the financial services industry to dial in and try it out.
'We've put mock data into the system, so they can see how Revo works and how it ties into a business line methodology or another methodology a financial services firm may want to use,' said Donovan.

Among the organizations that have taken Donovan up on the offer to demo the tool is San Francisco-based Wells Fargo. As with U.S. Bancorp, Wells Fargo now intends to roll out Revo in conjunction with a complete overhaul of its business continuity planning methodology.

'As we've continued to grow, it was becoming apparent that we needed a tool that was scalable across our entire enterprise,' said Rex Engstrand, Wells Fargo's vice president for business continuity planning office. 'We also knew the tool was going to have to be truly Web-based so we could manage the plan centrally, but easily provide access to all our locations because, given our size, using a client-server approach where we had to touch each client was becoming very inefficient.'

Donovan sees this as an increasingly common concern in the industry. 'I'm fortunate to know many of my counterparts in other financial services firms and it's interesting that we've all separately, but at the same time, come to pretty much same conclusion,' said Donovan. 'Our organizations are growing geographically and expanding their services. Customer expectations continue to increase. We know we can't continue business as usual. As we grow, we've got to take a new approach to business continuity planning.'

Mary Jung is a freelance writer based in Chicago, Ill.