The Top 10 Lessons of Katrina
BY CHRIS COSTANZO
Cash is king in the aftermath of a natural disaster.
Following the tragedy of 2005’s Hurricane Katrina, financial institutions have had time to absorb some critical lessons in disaster planning. One is the importance of providing access to cash for customers. Other top lessons relate to the need to build a self-sufficient, robust command center; get targeted weather information; build redundancy into data processing; and create emergency response teams.
In late August 2005, banks located along the southern Gulf Coast received a cram course in disaster planning when Hurricane Katrina smashed ashore. The storm wreaked enormous damage at the time, shutting down hundreds of retail branches across the affected area. However, those banks will almost certainly be better prepared the next time they face such a natural disaster because they have had time to absorb some essential lessons.
The importance of cash seems obvious in hindsight, but it was one lesson Katrina drove home hard. While the 9/11 tragedy highlighted the financial system’s need to keep wholesale and capital markets up and running, Katrina was notable for its impact on individual retail customers. Of the 230 institutions affected, most were able to execute automated clearing house (ACH) payments by the end of the first week, according to Doug Johnson, senior policy adviser at the American Bankers Association. That enabled businesses to keep up with their payments. And individuals who received paychecks via direct deposit could count on that money being deposited in their bank.
The bigger problem for retail customers was actually getting their hands on those deposits. Branches stayed shut for weeks, even months at a time, frustrating efforts to withdraw money sitting in bank accounts. Automated teller machines (ATMs) were often useless, being either flooded or without power. Credit and debit card payments were similarly impeded, making cash the only form of money that counted in the immediate aftermath of the storm.
“The lesson there is that from a customer confidence standpoint, the retail market is as important, if not more so, than the wholesale,” Johnson says. “If an individual can’t get cash, it really frustrates the ability of people to participate in their own recovery.”
So getting cash to customers who need it is the first requirement for any bank in an area affected by a natural disaster. What are the best ways to achieve that and preserve other vital services? Bankers along the southern Gulf Coast suggest the following:
1 Provide Robust Disaster Command Center
The sheer magnitude of Katrina’s devastation — on employees, branches, fuel and communications — left a lasting impression on executives of the former AmSouth Bancorp (now part of Birmingham, Ala.-based Regions Financial Corp.). At the height of Katrina, 197 of 680 AmSouth branches were closed and 161 of its employees displaced, according to Greg Gagliano, senior vice president of technology operations at Regions.
In the days following the storm, fuel shortages were frequent, cell phone communication nearly impossible, and many branches remained inaccessible either because they were quarantined or underwater, says Gagliano, who was in charge of AmSouth’s crisis team when Katrina hit. It took a week for the bank to just locate all its employees and several weeks for it to gain access to every one of its affected branches.
Once the crisis had passed, the bank decided an upgraded command center was imperative. “We realized we needed to have a place with better accessibility to information to make decisions,” says Steve McClesky, manager of business continuity at Regions.
The bank converted a room in its primary data center in Birmingham into a command center with 20 desktops that featured full connectivity to the Internet. It also installed what it calls a “management display system” consisting of three large screens on the wall that can project multiple images at a time, including television, project tracking and the Internet. The display system is modeled after a similar one at a local emergency management agency.
Previously, AmSouth had housed its disaster command center in a much smaller area with a limited number of PCs. People had to wait to get access to the computers, and information was relayed via markers on whiteboards. The new command center brings much-needed automation to information delivery and also can be used for other operations, McClesky says, citing the ongoing integration of AmSouth and Regions.
2 Make the Data Center Self-Sufficient In a disaster the size of Katrina, millions of people and thousands of organizations are affected. Many of the latter, such as hospitals, have priority over financial institutions when it comes to receiving fuel or power from the public authorities. “We have to work on our own,” says Eric Lozano, senior vice president and chief information officer of Coral Gables, Fla.-based BankUnited. “We’re working on a Plan B for everything.”
As a result, the $12 billion asset BankUnited is now in the process of moving into a Category 5 data center, so called because it has been built to withstand the punishing winds of a Category 5 hurricane. The data center, which the bank purchased from a company with much experience in disaster recovery, is equipped with two storage tanks, each with enough fuel to power the data center for a month, Lozano says. In addition, BankUnited has contracted with a local fuel provider that guarantees fuel delivery. “Previously we distributed fuel ourselves, and it was difficult,” Lozano says.
3 Use Mobile ATMs
Cash is king during disasters because it is the only currency that counts when the power is out. Regions had success during the aftermath of Katrina with a mobile ATM that it moved further into the impacted area as restrictions were lifted. The ATM, conveyed from place to place by truck, had its own generator and was flanked by security guards. Regions has since purchased two more of the mobile ATMs. “When storms come in, people really go to a cash society,” says Landy Dutton, senior vice president of corporate information security at Regions.
4 Build Redundancy into Data Processing
About two years ago, BankUnited began replicating its most important data processing in a back-up data center in Arizona, essentially mirroring the data processed at the main site in Florida. Later, BankUnited also contracted with a third party to create nightly back-ups of its less critical data processing.
The result is a “triad” of data processing encompassing the Florida and Arizona sites and the third-party provider, Lozano says. The set-up means branches now have two ways to connect into the main bank, through Florida or Arizona. “The branches have never been in such a good position,” Lozano says.
Data back-up also has helped BankUnited achieve a long-sought goal of reducing the number of people necessary to get the bank up and running following a disaster. Previously during disasters, the bank had to fly out up to 12 people to carry back-up tapes to a secondary data site and get the bank back in business. Now it sends four people, two before the storm and two after. Eventually it hopes data mirroring will enable it to forego having to send anyone. “The less people you have to fly out, the quicker the recovery is,” Lozano says.
5 Create Emergency Response Teams
Rick Kelly, now the corporate business continuity manager at Columbus, Ga.-based Synovus Financial Corp., was a local sheriff working in Georgia when Katrina hit. He traveled to the affected area as part of the nation’s emergency response service and stayed for seven nights, four of which he slept in a blueberry field. He says some of what the $32 billion asset Synovus is doing today to prepare for disasters derives from his Katrina experiences.
For example, Synovus has implemented a community emergency response team (CERT), recently graduating 54 people from the program. The CERT concept was developed in 1985 by the Los Angeles City Fire Department in recognition of the fact that first responders who provide fire and medical services are often not able to meet the tremendous demand for those services following a major disaster. “You can never delegate your safety to someone else,” Kelly says.
CERT trainees learn how to extinguish small fires, perform basic first aid, conduct light search and rescue operations and other relevant activities during a seven-week course. Synovus is providing this training to the bank’s “safety monitors” who are responsible for moving out groups of people during evacuations. “The idea is that, if public safety is delayed, we do what we can,” Kelly says.
6 Have Multi-Layered Communications
Many institutions experienced prolonged delays in communications services because landlines and cell phone towers were disabled during Katrina. To remedy that problem, Synovus last year purchased 10 satellite phones, which it keeps charged and ready in case of emergency. Lozano of BankUnited says his bank also uses satellite phones and keeps them charged, but has not found them to be totally reliable. “If it’s overcast or cloudy you’ll have problems,” he says.
Regions found satellite phones useful during Katrina until the state emergency management came in and took over all the satellite signals, Dutton says. However, Regions was able to use Blackberries to send short text messages via satellite because they require less connectivity, she says.
Regions also uses TracFone, a prepaid wireless phone service that works across multiple cell phone carriers. “There’s not one solution to the communications problem,” McClesky says. “You have to have a variety and remain flexible with each.”
7 Get Targeted Weather Information
Information about the weather is easy to come by when a massive storm like Katrina hits. The National Hurricane Center, the National Weather Service and all kinds of local and national media provide minute-by-minute coverage of a storm’s progress. The problem for individual companies is that the information is geared toward a broad, public audience.
Executives at Regions knew they could improve their planning process if they had a better idea of how the weather would impact individual branches and operating centers. Following Katrina, Regions hired a weather service company in Houston to give it forecasts relevant to its specific locations. The weather service has Regions’ locations programmed into its systems, allowing it to more specifically forecast how they might be affected. As part of its pre-storm planning, Regions also has a meteorologist from the weather service on call.
The strategy proved its worth when tropical storm Ernesto blew through Florida last August. Regions kept all its branches open throughout the storm, McClesky says, because it knew the storm would not be as big as generally forecast. It was one of the few companies in the area able to keep its operations running, he added.
8 Improve Coordination with the Public Sector
Following in the footsteps of ChicagoFIRST, many financial institutions are strengthening their relationships with local, state and federal agencies. ChicagoFIRST was formed in July 2003 by several Chicago-area institutions to increase their resiliency during disasters by formulating plans to work with government agencies.
Improved communication between public and private groups helps financial institutions understand what is expected of them during an emergency, says Gagliano of Regions. For example, banks can figure out in advance the proper identification and credentials they need for personnel wishing to go into a disaster area, he says.
The coordination also helps government agencies understand how important financial institutions are to recovery, Kelly says. “If banks can’t open their doors, it drastically slows down the recovery process,” he says. “Banks bring in the money.”
9 Cooperate with Competitors and Customers
Working through the Louisiana Bankers Association, Regions and a handful of other banks set up tellers at one bank’s large New Orleans branch in the wake of Katrina so customers could cash checks, Dutton says. Sitting at tables in the lobby, Regions tellers used cell phones to access their call center, which verified customer account numbers online. The Regions customers could then bring their checks to the other bank’s teller stations to actually cash them.
Regions also found assistance from a large fuel transport company, one of its commercial customers. The customer brought the fuel in and allowed Regions to use its secure, gated facility to fill up the gas tanks of cars belonging to bank employees involved in critical activities. The procedure required some quick thinking that, in the future, could be planned in advance. “We had to come up with a process to validate employees and develop quotas on how much gas to give,” Dutton says.
10 Update Your Plans Periodically
Major disasters don’t happen that often, so keeping the issue top-of-mind is important. Synovus is always on the look out for ideas that it can pass along to its affiliate banks to keep them engaged in the disaster planning process. Recently it gave all its disaster recovery coordinators crank flashlights, which have long been used by the military and now are available to civilians through major retailers such as Lowe’s and Home Depot.
Once they are cranked for two minutes, the flashlights run for 30, eliminating the need for batteries. “I saw during Hurricane Katrina that people couldn’t find enough batteries,” Kelly says.
BankUnited keeps disaster recovery a fresh topic by conducting quarterly tests of recovery procedures, even though it is only required to do so once a year. Every quarter it tests two to three systems, often ones that are less critical, Lozano says. Annual testing is an old way of thinking, he says. “The reality is that six months later, it’s not top-of-mind. Quarterly testing helped us make it more of an awareness thing for the bank.”
Chris Costanzo is a freelance writer based in Maplewood, N.J.