BCP Risk & Control
One recovery plan. Every branch. Ready when it matters.
Most continuity plans are written process by process, until every branch has fifteen documents nobody opens in a real disruption. We plan branch operations as a whole: the phases of a disruption, six approved operating modes, alternate processing with real controls, and a routing matrix every manager can run.
Aligned to FFIEC BCM, NIST, and ISO 22301 expectations. Delivered by a US-based cyberteam.
The Problem
A plan for every process is a plan no one can run.
Walk into most institutions and branch continuity lives in a stack: one document for teller operations, another for the drive-up, another for the vault, the ATM, new accounts, wires, and on down the list. Fifteen documents per branch, multiplied across the network. When a storm knocks out power at 6 a.m., no branch manager is reading fifteen documents.
The unit of recovery isn’t a process. It’s the branch. What a manager actually needs to know is whether the branch can open, in which mode, with which services, and where to send customers if it can’t. That takes one plan for the whole network, a two-page at-a-glance, and a set of controls that make reduced-service and manual operation safe.
The Plan
Six building blocks. One plan the whole network runs on.
Built from real engagements with multi-branch community institutions, each element answers a question a branch manager actually asks during a disruption.
Modes
Six operating modes
From normal operations through reduced service, drive-up only, appointment only, manual processing, and temporary closure. Mode selection is approved and documented per event, so “partially open” is a controlled state, not an improvisation.
Services
Critical services & recovery objectives
Every branch service carries a criticality, a recovery objective, and an approved continuity approach, so restoration follows a defined order when systems or staffing are constrained.
Alt processing
Alternate processing controls
Manual operation is pre-engineered: approved transaction types, offline limits, identity verification, dual control, sequential logging, and reconciliation when systems return.
Routing
Branch routing matrix
Every branch is tiered with a primary and secondary alternate, so customer redirection is a lookup, not a judgment call made under stress.
Standards
Minimum-to-open standards
Clear thresholds for staffing, security, facility safety, cash and dual control, technology, and communications. A branch opens when the standards are met or compensating controls are approved.
At a Glance
Two-page companion
Page one: what to do. Page two: who to call. The entire plan compressed to what a branch manager needs taped inside the cash room, verified quarterly.
Most institutions start with one flat recovery window for everything. Tiering focuses spend and testing where the hours actually matter.
Inside the Deliverable
What a branch manager sees. Sanitized from a real engagement.
Two excerpts from a recovery plan we built for a multi-branch community bank, with identifying details removed.
One Program
Branches are one chapter. The program covers the enterprise.
Business continuity spans technology, facilities, and bank operations, and the deliverables coordinate instead of contradicting each other. Every plan ships with a two-page at-a-glance its owner can actually run.
Operations
Branch & enterprise recovery plan
The network plan detailed on this page: operating modes, routing matrix, minimum-to-open standards, and alternate processing controls for the whole branch footprint.
Departments
Department continuity plans
Each critical department gets a right-sized plan: a team leader and alternate, a designated recovery team, an alternate facility, and functions grouped by recovery window from 24 hours to 30 days.
Technology
IT disaster recovery
Tiered recovery with clear activation criteria, a first-60-minutes timeline, defined scenarios including cyber isolation, and coordination with incident response so restoration never outruns forensics.
Playbook
Manual procedures playbook
Your existing business process documents, consolidated into one playbook for operating without core systems. Where your procedures have gaps, we flag them for a decision rather than inventing language your staff has never seen.
How It Works
From document sprawl to one plan, tested.
Program Build
Sequential
Step 01
Risk assessment
Weeks 1-2
Technology risks and business continuity risks, from connectivity loss and cyber events to fire, flood, and physical security threats, assessed against your footprint.
Step 02
Business impact analysis
Weeks 2-5
Technology, facilities, and operations are analyzed and tiered. Every system and function earns its MTD, RTO, and RPO by criticality instead of inheriting one flat window.
Step 03
Recovery plans
Weeks 5-10
The branch network plan, department plans, IT disaster recovery, and manual procedures playbook are built as one coordinated set, each with its at-a-glance companion.
Step 04
Test & maintain
Annual cycle
Exercises run on the cadence below, findings become corrective actions, and plans update after every branch, vendor, or system change.
Testing cadence
Quarterly
Branch management reviews plan documents and verifies contacts and at-a-glance accuracy.
Semiannual
Emergency notification and phone-tree test across the branch network.
Annual
Tabletop exercise covering a Tier 1 branch, plus a functional manual-processing test: log completion, approval, posting, and reconciliation.
Annual
Multi-branch severe weather exercise covering staffing, communications, cash, and alternate routing.
After incident
After-action review with corrective actions, owners, and due dates tracked to closure.
Outcomes
What done looks like.
Runnable
A plan people can run
One network plan and a two-page at-a-glance replace the binder stack. Any branch manager can select a mode, route customers, and operate safely without calling headquarters first.
Controlled
Safe in degraded mode
Reduced service and manual processing carry pre-approved limits, dual control, logging, and reconciliation, so operating through a disruption never becomes a compliance finding after it.
Tested
Proven before it’s needed
Tabletops, functional manual-processing tests, and multi-branch exercises run on a documented cadence, with findings tracked to closure and reported to the board.
