Business Continuity:BCP for a selected financial institution

Introduction

An organization operating in the digital age might face potential threats due to natural or human-made disasters. BCP or Business Continuity Planning helps in resolving or preventing the threats and protecting the digital as well as the physical assets of the firm. Therefore, a BCP involves assessment of risks, implementation of safety procedures, and review or monitoring of the process. Here, A BCP shall be prepared for Wells Fargo & Company, a US-based financial service provider. Thereafter, the fundamental activities managed by the plan shall be outlined. A plan for an alternate site for relocation shall be considered, and an approximate budget will be illustrated outlining the costs and activities.

BCP for a financial institution

Wells Fargo has been one of the leading providers of financial services in the US for the last 160 years. It is headquartered in California, US, and considered the fourth leading bank in the country (Wellsfargo.com, 2020). It committed to serving small businesses and offers mortgages, investing, commercial services, and credit cards to clients. Consequently, online operations are common. However, the financial institution is in an unsafe position because cyberattacks using malicious software can be a common incident. Customers rely on a financial institution, and human-driven threats or technical failures such as database loss or failure in online banking facilities can have a severe impact on customers. Thereafter, there is a need to prepare a BCP to handle this crisis.

Figure 1: The basic steps in BCP

(Source: eci.com, 2020)

In case of sudden cyber-attack, it is essential for the institution to stay prepared with a communication plan and IT response team. Communication can be hampered in case of sudden attack, and the institution must ensure alternative areas for storing client-centric data (Sahebjamnia, Torabi & Mansouri, 2018). The nature of a financial organization is sensitive, and therefore, there is a need to monitor all forms of communication. The customers must be aware of ways to assess loans, payments, or transfers during such events.

Fundamental activities managed in BCP

The institution’s effectiveness should never be compromised because its operations must ensure security, ingenuity, and trust. Hence, the fundamental activities that should be prepared and managed include the following-

• Preparation of an electronic office– There is a need to test the recovery strategies regularly so that in case of emergency, the experts can resume normal services as soon as possible (Cervone, 2017).
• Developing redundant systems– In case of a sudden cyber-attack, the first thing that will be affected is the online accessibility of the bank. Hence, operational sites will be designed in separate geographic locations to recover accessibility to the online site.
• Regular testing – Systems must be tested at least four times in a year to ensure its reliability as well as effectiveness. Testing will also involve testing the newly prepared applications for the bank and making necessary changes in the case of the existing applications (Folkers, 2017).
• Identification of the type of interruption- In the financial institution, four basic types of interruptions might occur. These are system-related, operations facilities, transportation, and telecommunications. In case of system interruption, the available resources will be allocated to remediation, and customers will be less affected. In the case of operations facilities, secondary centers will be created. Outages might occur suddenly, and the institution should deal with it by using redundant network created by multiple telecommunication firms (McMurray, Cross & Caponecchia, 2019). Lastly, interruptions in the ground or air transportation can be dealt with by utilizing an alternative method of delivery.

During a crisis situation, the institution must ensure that alternative forms of communication are present so that representatives of the firm can communicate with customers. The communication plan is also a part of the BCP.

Figure 2: Types of threats that can be managed by implementing BCP

(Source: nextiva.com, 2020)

An alternate plan for new site location

Relocation of the business units of the bank can be a time-consuming process. Hence, a plan of action must be developed as early as possible. The plan must be competent enough to operate within the global business environment (Choudhary, 2019). Migration to a new site implies that the employees at the new site must be prepared for new business units.

The alternate plan for setting a new site for Wells Fargo has been outlined below-

• The alternate site for the bank will be self-managed
• The site can be renamed as Disaster Recovery Site
• The site must provide a dedicated infrastructure and recovery and should consider the hot-standby basis because, in a hot site, live customer data is present along with a functional data center.
• The live sites and the recovery sites should be separated physically, and geographic distance should be the sole criteria. Distance should be prioritized to prevent the damage of both the sites.
• At the alternate site, employees must be trained to get prepared for new business units
• The bank should consider resuming its operations after re-establishing the physical security and technological facilities
• Operations at the previous site must be in sync with operations at the alternative site
• Lastly, a contact list, travel arrangements fact sheet, and criticality based sitting matrix must be prepared for the alternate site.

Approximate budget for the new site

Conclusion

In the banking industry, risks and threats associated with the sudden failure of systems can be a challenge for firms. Customers trust and rely on a financial institution and expect safe and secure services. However, rising cyber threats or physical disaster cannot be completely prevented. Hence, an effective BCP for the institution has been prepared to prevent the occurrences of the threat. It can be concluded that a practical BCP should incorporate the identification, planning, assessment, and monitoring stages. The need for an alternate geographic location has been identified, and a plan has been created as well.

References