Business Continuity
Program Summary for Members
Purpose
In accordance with mandates set by the Federal Financial Institution Examination Council’s (FFIEC) Business Continuity Management booklet in the Information Technology Handbook (November 2019), and the National Credit Union Administration’s Corporate Credit Union Guidance Letters 2004-04 and 2004-05, Alloya Corporate Federal Credit Union (Alloya) would like to make credit union members aware of our Business Continuity Program (BCP).
Our program is designed to help ensure that 1) Alloya continues to do business with little or no disruption; 2) credit union members’ assets remain secure and accessible; and 3) credit unions will be able to reach us during unplanned business interruptions.
Recovery Plan Objectives
Alloya’s BCP addresses all essential elements of the corporate’s business infrastructure to enable timely response to an event that proves disruptive to critical business functions. Representatives of Alloya’s leadership team oversee and direct the corporate’s business continuity preparedness efforts by supporting each of the following objectives:
- Ensure the allocation of sufficient resources with the knowledge to evaluate and maintain a thorough and effective BCP.
- Establish policies for business continuity and business resumption efforts by determining how the corporate will manage and control identified risks.
- Review test results.
- Approve the corporate’s business continuity plan at least annually.
- Ensure the BCP is kept up-to-date and affected employees are aware and trained on individual roles.
To meet the BCP objectives set forth by Alloya’s leadership, the planning process involves collaboration with the senior management team (SMT) and operations managers on the Business Continuity Planning & Response Team (BCPRT). Our Compliance Department works with both the SMT and BCPRT to develop department business continuity plans, and executes continuity program development, implementation, maintenance and testing activity.
Additionally, our Operational Risk Committee (ORC) coordinates disaster management activities from recovery and restoration to resumption of normal operations. Members of the ORC and the BCPRT will establish recovery teams to address the immediate response to an incident and provide management/direction until the matter is resolved. Recovery team members are assigned specific responsibilities within each departmental business continuity plan.
In creating the business continuity plan, we assume the locations identified as “pre-designated recovery sites” are available, that we have sufficient personnel and that external organizations (such as the Federal Reserve, government agencies and market systems) are operational.
However, there can be no assurance service will continue without interruption in certain circumstances, such as a regional blackout, a natural disaster or a terrorist attack. In the unlikely event Alloya determines it cannot resume operations within a reasonable amount of time, then frequent communication on our go-forward actions will be provided.
In the event Alloya is impacted by a pandemic situation, we have identified staff to perform the essential job functions required to continue operations. A detailed plan documents the procedures Alloya will initiate in preparation for, and in response to, a pandemic outbreak. Our pandemic plan complies with FFIEC and NCUA guidance by incorporating a preventative program to reduce the likelihood operations will be significantly impacted by a pandemic event; documenting our strategy for scaling pandemic efforts; outlining a framework for facilities, systems and procedures if staff is unavailable for prolonged periods; and testing our capacity to operate in a pandemic situation.
Program/Plan Testing and Updating
While a business continuity plan cannot eliminate risk or a potential delay that can result from an unplanned business interruption or disruption in service, frequent testing is necessary. Alloya conducts multiple tests with various scenarios and critical partners throughout the year to strengthen our preparedness. We use the test results to validate and update our recovery plans to ensure that we have taken the necessary steps to protect credit union members. The last full scale disaster recovery test was conducted on Saturday, February 24, 2024, and it was successful. All recovery time objectives were met.
Preparation
Alloya is confident members will continue to have access to their accounts, settlement funds and payment systems in the event of a significant business disruption; however, it is possible there may be some temporary disruption or change in the way accounts are accessed. Alloya will notify members of any such changes or disruptions by posting a notice on the corporate's website or through a message on our telephone system.
To best prepare for such contingencies, we suggest credit union members become familiar with how to contact Alloya’s headquarters:
Headquarters – Naperville, Illinois
(800) 782-2431