13 minutes
On the 20th anniversary of the tragedy, credit union leaders reflect on business continuity and disaster recovery.
The 20th anniversary of the Sept. 11 attacks serves as a grim but necessary reminder that disaster can come without warning.
CUES member Steve Bugg, president/CEO of $1 billion Great Lakes Credit Union in Bannockburn, Illinois, learned this lesson firsthand.
In the fall of 2001, he had a leadership position with Sprint PCS in New York. On Sep. 11, he made his usual commute from his home in New Jersey to the company’s offices in the Wall Street Journal Building in Times Square, less than five miles from the World Trade Center. He remembers commenting to his wife, as he entered the Lincoln Tunnel, how brightly the sun was shining and reflecting off the Twin Towers.
“It was an unusually picture-perfect day in New York City, with totally blue skies, which does not come often,” he recalls. “Little did I know that in less than a few hours my life, as well as everyone else’s, would change forever.”
During the attack, Bugg and his colleagues gathered in the company’s corner conference room where they could see the smoke drifting above the skyline. Bugg recalls the streets of New York looking like something of out a horror movie, filled with smoke and debris.
“The sights I witnessed in the city that day will ever be ingrained in my memory, especially seeing people walking through the streets covered in ashes and soot, clothes ripped, missing shoes and some bleeding from being hit from falling debris,” Bugg says. “They appeared to be almost zombie-like and, of course, were in shock.”
Bugg subsequently left the telecommunications industry and now has 14 years of experience in credit union leadership, including nearly 3½ years in his current position at Great Lakes Credit Union. His experiences in the immediate aftermath of 9/11 were integral to developing a business continuity plan and disaster relief program for GLCU. The plan proved indispensable over the last 18 months in responding to the COVID-19 pandemic.
“I strongly believe that the lessons I learned from business continuity/disaster recovery due to 9/11 aided Great Lakes Credit Union well with the pandemic,” he says. “GLCU quickly went into BCP/DR (business continuity plan/disaster recovery) mode and worked through worst-case scenario planning that aided us well through the pandemic, which we still are following today.”
At PenFed Credit Union, headquartered in McLean, Virginia, employees have vowed never to forget the events of 9/11. The credit union, which has more than $28 billion and serves 2.4 million members worldwide, has a branch inside the Pentagon, where one of the four deadly plane crashes occurred. PenFed’s Pentagon branch reopened for business the day after the crash and provided continuous service and support to the Pentagon community.
“PenFed’s mission has long included serving America's national defense community and first responders,” says President/CEO James Schenck, CCD, “and every year on Sept. 11, we honor the brave military heroes and first responders who gave their lives so that others would survive.”
For this year’s commemoration, PenFed is partnering with the Military Women’s Memorial to support the 9/11 Remembrance Relay honoring the victims of the 9/11 attacks and the 177 servicewomen who have died in combat zones over the past two decades. The relay will pay tribute to these heroes with a 177-mile walk from the Flight 93 National Memorial in Shanksville, Pennsylvania, to the Military Women's Memorial at the gateway to Arlington National Cemetery.
Schenck reports that the events of 9/11 had a significant impact on the business community and changed the way that PenFed approaches disaster preparedness and business resiliency efforts. “Business leaders used to prepare for disaster recovery by trying to minimize the amount of downtime before recovery,” he says. “That approach changed after Sept. 11, and now firms aim to avoid incidents that halt business—you can’t have downtime.”
A Wake-Up Call
Since 9/11, the nation as a whole and businesses individually have become keenly aware that they are vulnerable to external events that cannot be ignored.
“9/11 was a wake-up call for all financial institutions and many other industries, including airlines and utilities,” says John Venzon, managing director, technology solutions, for CUES strategic partner Cornerstone Advisors, Scottsdale, Arizona. “At the time, Homeland Security and other governmental agencies did a good job of raising awareness, and banks and credit unions responded with improved focus and better plans. The biggest change specifically for credit unions was a transformation from ‘it won’t happen here’ to awareness, as in ‘we could be next, so let’s be prepared.’”
Certainly over the last 20 years, there has been no shortage of events to confirm the wisdom of making disaster preparedness and recovery a top priority. “Natural disasters, the pandemic, mergers, and increased digital adoption drive the need for more extensive contingency preparedness,” Venzon says. “Credit unions and the regulating agencies focus on improved planning, starting with business impact analysis, business continuity planning and full disaster recovery planning as table stakes. They want to see test plans and make sure that business leaders, operations and technology teams are well-versed and prepared. They want executives engaged in regular and periodic reviews and updates—not just for status, but to be fully informed of what happens for multiple scenarios, with playbooks to run during an event.”
Hurricane Ida, which struck the Gulf Coast on Aug. 29, is the most recent disaster affecting a significant portion of the country. Louisiana was particularly hard-hit, and many credit unions are currently going through the fallout. Among them is $400 million Louisiana Federal Credit Union, located in LaPlace, Louisiana, part of the New Orleans metropolitan area.
Mia Perez, chief administrative officer for the 36,000-member credit union, reports that a third of the credit union’s 108 FTE employees have lost homes or experienced severe/unlivable damage in the wake of the hurricane. In response, Louisiana FCU has organized an emergency supply drive for its employees and their families, collecting such items as bottled water, batteries, flashlights, toiletries, nonperishable food items, paper products, diapers, blankets and cleaning items. For those who would like to donate funds, the credit union has set up an account with PayPal at relief@louisianafcu.org.
Louisiana FCU addressed the aftermath of the hurricane directly by deploying a comprehensive plan, which Perez describes as “a combined business continuity and disaster plan, which also includes our crisis communications plan, information and security plan, and our security program.” However, she points out, “While some of these plans include very tactical and operational steps, the overall disaster recovery plan cannot. Every disaster has its own vengeance, and we must be prepared to react accordingly.”
In addition, the credit union has an established emergency response team. “In the case of hurricanes, we’re able to prep the team as soon as we know of forecasted disturbances,” Perez reports. However, she notes that even the most robust plan can only serve as a framework since every emergency calls for assessing priorities and subsequently acting on those.
“There is no standard order of events,” Perez observes. “There is no recipe or orderly checklist in the middle of a disaster. Everything is important but not everything is critical. Life preservation first—then assess, prioritize, act, then repeat.”
At the Forefront of Disaster Relief
Standing at the forefront to help those in the credit union industry impacted by disaster is the National Credit Union Foundation, the charitable arm of the U.S. credit union movement.
“We serve as a catalyst, providing the training and education, resources, and financial support to improve people’s lives through credit unions,” reports Danielle Brown, the Foundation’s director of engagement.
The Foundation’s charitable efforts included raising $680,000 in the aftermath of 9/11, with funds distributed to the American Red Cross and United Way’s September 11th Fund. In 2005, the Foundation took its fundraising efforts to a new level with the formation of CUAid, which distributes funds to credit union employees and volunteers who need assistance in recovering from a disaster.
“CUAid was born in the aftermath of Hurricane Katrina, when the credit union system came together and raised over $3.5 million,” Brown reports. “Through CUAid, every single cent is distributed to those on the ground in need of support.”
All totaled, $9 million has been distributed in CUAid disaster relief funds to the credit union movement over the past 16 years. In 2020 alone, CUAID provided $437,000 in grants in response to natural disasters in the U.S., with assistance going to 530 credit union employees and volunteers. Grants range in size from a few hundred dollars, sufficient for buying groceries or renting a generator, to a more substantial amount that will support individuals through a prolonged recovery period and an extensive insurance process.
“CUAid is the credit union movement in action,” Brown says. “Grants are made to local institutions—typically state credit union leagues or state foundations—that have on-the-ground understanding of the need. They submit a request, CUAid fulfills that through a grant, and the local organization then manages disbursals.”
Currently the Foundation is focusing on providing relief to those impacted by Hurricane Ida, which devastated Louisiana and left many of the state’s credit union employees and volunteers in need of help. The Louisiana Credit Union League reports that more than half of its affiliated credit unions have been impacted, resulting in hundreds of grant requests.
“The Foundation has committed a minimum $100,000 CUAid grant, which LCUL will leverage to meet those local needs,” Brown reports. “Simultaneously, we’re actively working with leagues and foundations in other Ida-impacted states to identify need, as well as partnering with the California and Nevada leagues in response to this year’s devastating wildfires.”
Credit unions affected by Hurricane Ida are encouraged to download the CUAid app—available from the Apple and Google Play stores. For those who would like to help credit unions support their employees and communities through a disaster, click to donate to CUAid.
Lessons Learned From 9/11
For those who experienced 9/11, the lessons learned have informed their approach to disaster preparedness and business continuity. In his position at PenFed, Schenck stresses the importance of having a holistic business continuity strategy.
“You must be able to continue to run at the same pace your credit union members rely on for their financial support,” he says. “To that end, you need more than just an immediate contingency plan; you need short-term, medium-term, and long-term plans that cover every aspect of a disaster. You can’t rely on your existing expectations. You must be proactive in preparing for the things you can’t yet anticipate. And that means building for resiliency by putting the strategies in place now that will equip you in any event.”
Bugg likewise used the lessons he learned from his proximity to the World Trade Center attacks for future preparedness. Amidst the horror of that day, Bugg recalls that most communications had gone down since transmission towers were located on top of the World Trade Center. That meant the most of TV and cell phone serve. Power went up and down throughout the day.
“The need for redundant systems and backups is paramount for business continuity, and 9/11 highlighted the fact that we did not have enough redundant cell towers to handle the volume of calls,” he reports. “Our disaster recovery plan included bringing in mobile cell towers that were set up in the impacted areas, which served us well. The reliance on partners for assisting in disaster recovery is a must for all businesses. Our teams quickly gathered to review our plans, access the damage and deploy our recovery plans since this disaster impacted our distribution channels and network operations areas.”
The experience of 9/11 brought home for Bugg the importance of worst-case scenario planning. “At the credit union, we are utilizing lessons learned to even build a stronger BCP/DR program for future events and have learned to enhance our documentation, which also was a lesson learned from 9/11,” he says. “Also, remaining calm and cool during disasters is needed from all leaders, a lesson I learned well from my 9/11 experience with our then-regional president at Sprint PCS.”
In conjunction with the 20th anniversary, GLCU has released a member/employee video, in which Bugg shares his recollections of working in New York City on the day of the attacks. Bugg also summarizes the changes in America that were driven by 9/11, such as the added security that has become standard at airports, large gatherings and public buildings.
The post 9/11 era also has been characterized by a continuous string of technological advancements that have brought unprecedented convenience and capabilities to the fingertips, but in the video, Bugg cautions that fraudsters have learned to exploit technology with data breaches, identity theft and phishing attacks. GLCU employs around-the-clock monitoring and analyzing plus the assistance of key partners in attempting to shut down ongoing attacks or fraud.
The Credit Union Difference
Because credit unions were founded on the “people helping people” philosophy, Bugg notes that they are uniquely positioned to come to the aid of communities impacted by a disaster. This can be manifested in several ways—for instance, by volunteering to provide cleanup assistance, by collecting needed items along with cash donations, and even by coming to the assistance of other credit unions with mobile units or with staff and branch network support.
“Many credit unions also will support their communities by offering emergency loans, reduced or no-fee services and mobile ATMs to provide cash,” Bugg says. He points to an example from the current pandemic, during which GLCU, as a HUD-certified counseling provider and one of six credit unions nationally to offer this program, partnered with the Illinois Housing Development Authority to offer mortgage and rental assistance to the most vulnerable individuals in the state, regardless of credit union membership.
“This shows the credit union philosophy of ensuring the financial well-being of every resident,” Bugg says.
Perez likewise points to the selfless way that credit unions reach out to help one another. “The dedication to the communities we serve is woven in the fabric of who we are,” she says. “Responding to these communities in times of disaster is just another way to demonstrate our care and commitment.”
Perez reports that Louisiana FCU staff lives up to the credit union’s “why” statement: “to help people so they can focus on life first.” “We just so happen to sell financial services,” she says. “This is why, yes, we work to stand up branch operations as soon as possible, but we simultaneously turn our attention to our staff and organize emergency supply drives and task forces deployed to our hardest-hit staff homes to help cut out sheetrock and haul debris—whatever it takes so they can get back to focusing on regular life, whenever that time comes.”
A Never-Ending Process
With the 20th anniversary of 9/11 serving as a time of reflection, it’s appropriate to ask whether credit unions are doing enough to prepare for disasters and business interruption events. The answer, according to Venzon, is “it depends.”
“We see many good plans and credit unions with appropriate strategies that are well-defined, well-tested and modified as the business changes. But we also see some clients that do not pass the test,” he says.
Venzon recommends that leaders review their plans regularly to make sure they stay current. “They should start with assessing their environment, consider changes and the appropriateness of the procedures,” he says. “Have they grown dramatically? Have they undergone a digital or other transformation? Are all parts of the organization engaged, aware, and ready in the event of an issue? Do they know what to do to keep mission-critical functions running?”
It is a never-ending process, Venzon concludes. “The environment is changing faster than ever. Many new technology solutions delivered through hosted and cloud computing provide options previously not considered. Don’t hesitate to open the plans, blow off any dust and look at them with fresh eyes.” cues icon
Based in Missouri, Diane Franklin is a longtime contributor to Credit Union Management.
