As far as I know we've never done an actual run-through of our disaster recovery program to make sure it would work in the event of a disaster. So, I have no idea how to proceed in doing a "mock" disaster. What have other banks done to test their disaster recovery policy?

At my last position, we ran our exercises over a two day period. Two conference calls each day, one in the morning about 9am and the other in the afternoon about 3pm.

We ALWAYS invited the public sector (fire, police, FBI, etc.) to participate in the exercise. After the scenario and interjects were drafted, we would ask our public sector participants to offer suggestions/corrections. Then, during the conference calls, right after roll call, we would ask the public sector participants to comment on what would be happening if this were a real event. They would also be present throughout the day, if possible, to answer questions.

During the fourth conference call (call #2 on day #2) we would transition into lessons learned, again starting with our public sector participants.

This is a big topic, and I would be happy to discuss with you in detail. Please PM me with your contact information if you wish.

We actually had an office work offline all day just as if they had no system; handwrote all transactions, called to back office for balance, etc. Posted sign alerting clients so that any delays could be explained. CLients even thought it was a neat idea. We also test our FedWire process by calling in and retrieving wires; do this for both international and domestic. This year we'll test ACH files by having a 3rd party accept and proces sour files. Some of the other departments do a round table whereby they walk/talk thru what they would do.

We do an annual walk-thru using a disaster scenario. This year it is pandemic flu; prior years it was loss of a branch, water pipes burst on second floor of main office and it leaked to lobby with water damage to lobby new accts/teller equipment.

We send an email to department heads and other applicable participants with the scenario and they have a week to type up how their department will respond. It may be that a particular department is not affected, or one department may pretty much have to start from scratch with manual processing until they are up and running again. We then meet for a discussion, and update our plan accordingly when weak areas are found or something we didn't address. You never know until you do testing.

Our departments do manual processing once each year, and update their departmental procedures as necessary.

We also document how we responded to minor problems, such as a power outage, equipment downtime, etc. Documenting these short-term problems really helps because you then think in disaster recovery mode instead of just operational. And examiners like seeing that we are always thinking DR and testing/updating where necessary.