Recovering from disaster: lessons for the City learned from Hurricane Ivan
Hurricane Ivan caused $13 billion worth of damage in 2004 in Grenada, Jamaica, Grand Cayman and the western tip of Cuba. Bruce Raine, President, International Private Banking Systems, describes how it was a wake up call for banks in the Caribbean
Hurricane Ivan was the strongest hurricane of the 2004 Atlantic hurricane season. The storm formed in early September, and reached Category 5 strength on the Saffir-Simpson Hurricane Scale - the highest possible category. Ivan caused catastrophic damage to Grenada, and heavy damage to Jamaica, Grand Cayman and the western tip of Cuba, moving on to make landfall as a strong Category 3 storm in the US, where it caused an estimated $13 billion worth of damage.
The cost of Hurricane Ivan in human terms was enormous. The disaster was also a wake-up call for the private banks in the Caribbean islands affected. There had previously been a degree of complacency about hurricanes - a belief that they were a known quantity and existing business continuity plans would always suffice. Ivan and its impact put paid to that notion, and there are some important lessons to be learned and applied in other financial centres from the experiences the banks went through at the time, and the measures they have taken since to protect themselves from similar disruption in the future.
Could it happen here?
While London is unlikely to be hit by a hurricane, the range of threats faced by City institutions, from the increased risk of flooding from the Thames to the prospect of widespread and devastating acts of terrorism, means they can ill-afford to ignore the experiences of banks in the Caribbean, or risk the impact of complacency about business continuity on their operations.
The unpreparedness of financial services firms for the impact of disasters on their personnel - their ability to either get to work or get away from the site of danger - has already been identified by the FSA as a challenge in London. In the Caribbean, while some of the banks did manage to get their people off the affected islands prior to Ivan hitting, many did not have plans in place to effect an evacuation. Going forward, that type of action will certainly be the rule not the exception.
The water damage inflicted by Ivan's torrential rain and the "overflow of the sea" - up to 20 foot high waves rolling in from both sides of the island and converging in the middle, compounding the damage because the salt content caused irreversible corrosion - not only made the main island of Cayman inhospitable it also destroyed the electronics of the private banks affected, in many cases flooding out back-up generators as well. Short of rewiring every building to put the electronics at the top rather than in the basement - which still may not be protection enough - there is little that can be done to prevent water damage if such a threat occurs.
How far away is far enough?
And this emphasises one of the most important lessons to be learned from the impact of Ivan in the Caribbean - that a bank's back up site must be far enough away from its main site to ensure it will not be affected by the same disaster that takes the home site out. In the UK, the concentration of banks' operations and disaster recovery sites in a relatively small area has also been identified by the FSA as a weakness, and the experiences of banks hit by Ivan serve to emphasise the importance of overcoming this shortfall. Major banks with operations throughout the country may not have to worry so much about this, but smaller banks and asset managers with less distributed operations certainly do.
It is also vital that a back-up site can be up and running effectively in the shortest possible timeframe - and is equipped to take over the operation of the business for as long as it takes until the main site can be made operational once more. In the case of the Caribbean, banks that shifted their operations to other islands when Ivan struck hit problems such as not having banking licences to operate in different markets, and not being aware of whether the new market's data protection laws were similar to those in their home environment.
Keeping the customer satisfied
Another key challenge from a business continuity standpoint directly affected the banks' ability to sustain their commitment to their clients - the entire telecoms infrastructure collapsed in Cayman, and though some cell phones were working, typically the banks' clients did not have anyone to call to find out about the status of their wealth. It is vital that whatever happens, banks' clients are able to continue to use their established methods of contacting the bank, whether telephone or internet based. Otherwise irreparable damage to the bank-client relationship - vital in the private banking context - could ensue.
The software question
Having an effective strategy for moving to a back-up software and systems infrastructure is crucial. People sometimes fail to appreciate the technical complexity of disaster recovery from a systems perspective, thinking that as long as their data is backed up that can be transferred to the alternative site and all will be well. Today's software, particularly in the Microsoft Windows world, has to be installed on the server, which means the business continuity site must be sychronised with the home office in terms of software: it is not sufficient to install the software in the back-up site and then receive upgrades in the home site without also installing those upgrades in the alternative set-up.
The impact of Ivan, causing as it did the widespread destruction of paper records, also emphasised the importance for banks to make electronic the documentation they take from clients to support ever-more demanding know your customer and anti-money laundering regulations.
A cost of doing business
While London based banks can learn useful lessons from the experiences of banks in the Caribbean they, like their Caribbean counterparts, face a difficult challenge when it comes to disaster recovery, in that effectively it is necessary to plan for events which are almost unimaginable. There is also of course an economic challenge to face, and the significant cost of a full business continuity plan that you may never have to use - and indeed hopefully will not - is still creating a reluctance to invest in doing the job properly.
Unfortunately, this is a cost of being in business that banks just have to swallow. On the upside, there is a potential source of competitive edge in this, as demonstrated by the experiences of some of the Caribbean based banks: if clients are separated from their wealth because their chosen bank is unable to keep operating in the aftermath of disaster, then they may just seek to move to a provider who can keep operating come hell or high water.
Bruce Raine, President, International Private Banking Systems
