Testing out your business continuity plan (BCP) is incredibly important, especially in terms of making sure your technology can withstand a crisis event. AFP’s latest Treasury in Practice Guide explores the importance of testing your plan on a regular basis.

ACTIVE TESTING

David Deranek, CTP, director of enterprise treasury operations for Health Care Service Corporation (HCSC), the fifth largest health insurer in the United States, explained his team does unannounced business continuity planning every month to ensure readiness and accountability.

“I recall the first time we did a BCP readiness test,” Deranek said. “We coordinated our team and all of our technologies and communications. We ensured all of our staff’s laptops were connected via VPN in order to assure connection to the company systems and nothing was left to risk that we could not perform our jobs. We did that very successfully, and we all patted ourselves on the back. Upon debrief, we realized we planned for this rehearsed crisis. And actual BCP events by definition are not planned interruptions to our regular daily routines. This did not assist us to prepare for a real BCP event at all. There has to be a certain element of surprise to ensure everyday readiness and accountability.’”

At that point, treasury made a change to its BCP readiness protocol. Deranek’s team decided that it would practice BCP every month, sometimes twice a month, and it would be unannounced. “I would coordinate with leadership to make an announcement for example on a Sunday night,” he said. “Sometimes it would be announced early on a Monday morning before people would leave for work, just so that we had that element of surprise. It helped to ensure that people were keeping their access credentials up-to-date so they could always log into the TMS, banking and finance portals.”

One thing that has really helped HCSC over the years with its BCP is having a treasury management system (TMS). “The TMS leverages and simplifies the process from the standpoint of having that ability to work anywhere, with cloud technology and that interconnectivity to all of our banks and our ERP system,” Deranek said. “We also created a distributed platform to make sure that we could send out wire and ACH payments regardless of where we were working.”

HCSC even runs a scenario around the event of the TMS becoming unavailable. In reality, its system rarely if ever has gone down, and if so, for less than half an hour. But treasury attempts to test all of these variables. “We actually have a BCP exercise where we practice, ‘If those first line systems are down, then what do we do next?’ It would take longer to perform our tasks. But we could actually put together a cash position and do everything that we would normally do with the TMS, only now we would connect through the many bank portals,” Deranek said.

While treasury technology has generally moved to the cloud, some organizations still use installed systems. Given that crises can happen at any time, Deranek advises treasury departments to move to a cloud-based system so that they have that remote support whenever they need it and don’t have to rely on other internal resources for additional support in a crisis.

PUTTING THE PLAN INTO ACTION

Of course, the only way you’ll be 100% sure that your business continuity plan works is when it’s actually put it into action. Although sporadic testing can reveal holes that you need to patch, you can’t anticipate every scenario and there will undoubtedly be new issues that arise when you are facing a real crisis.

Although the treasury department of the Government of Washington, D.C. had a very detailed plan written out, there were some surprises when it came to actually executing them, noted Bruno Fernandes, deputy CFO and treasurer. Sometimes what looks good on paper doesn’t work as well in the real world, especially when you have a quickly evolving pandemic.

“What we've discovered over the last few weeks is there were some things that were written out pretty well and had been tested, but we didn't know how they were going to work until we actually did them,” he said. “That's the process we're going through right now—figuring out what makes sense. We're unfortunately working on the fly in some areas, because things are moving so quickly. I would say we had a pretty good starting point, though not perfect.”

For example, the payments process requires multiple approvals in several different systems. Some of these systems can only be accessed through a VPN, and there were some concerns that the VPN could only handle so many users at a time. This slows down the process and can cause payment delays. That’s a problem for any company—but it’s major issue when you’re a government trying to get PPE to hospitals and other critical services.

“A lot of this has got to happen very quickly,” Fernandes said. “Unfortunately, because of the fact that we didn't fully plan for everybody being out at the same time with very limited or no access to our facilities, that's been creating a little bit of an issue. We've been revamping that as we go along, especially stuff that is urgent. The good news is that our department has adapted extremely well to this new environment.”

Download Agile Business Continuity: Keeping Operations Running in Unprecedented Times, underwritten by Kyriba.