By Sam | October 8, 2015

How Can I Exercise My Credit Union Incident Management Plan (IMP)?

Exercising your Credit Union Incident Management Plan (IMP) is a necessary evil. Yes I said evil. No one likes to think about or discuss the bad things that could happen but we can’t act like an ostrich and hide our head in the sand. I usually get asked two questions about exercising Incident Management plans. They are:

How can the IMP be exercised? 

• Start small
  • Communications exercise – Departments contact staff with test message
  • Off-line procedures are up to date and accurate
  •  
• Types of exercises
  • Training and review of the plans for each team member. This will help initially identify each team and persons’ role and responsibilities.
  • The most common way to test your IMP is by holding a tabletop exercise. The tabletop should consist of all team and department plan owners. A facilitator leads a discussion of a scenario and each team and plan owner participates by sharing their tasks in order to validate the plan and identify any gaps.
  • Functional exercises are used for testing people, procedures, and resources. Each team or department verifies procedures and proper resources are available.
  • Full-scale exercise can be conducted in conjunction with the annual Disaster Recovery test. Start with a scenario as in a tabletop exercise then act out the actual tasks being taken. Advise everyone this is an exercise and is not a real incident. If you plan on communicating with a Notification System, send out the message and test not only the system but message creation process

When should the IMP be exercised? (2 Options)

• Before an event – Schedule time for exercising the IMP throughout the year. You are probably already exercising parts of your plan.
  • New Hire training have managers review plans with new employee
  • Set quarterly department and team testing (procedures)
  • Fire Drills (Evacuation Procedures)
  • Inclement weather announcements
  • Use the exercises described above from training and plan reviews to an eventual full-scale exercis
• During an event (NOT Recommended) It’s most likely too late to have a solid plan. (Good Luck!)

Exercising your Credit Union Incident Management Plan will solidify people’s understanding of what is expected of them during an event. It will also ensure most gaps are filled in and all the resources needed have been identified.