FFIEC Business Continuity Plan Requirements: BCM Checklist and Evidence Guide

TL;DR

• The FFIEC’s Business Continuity Management (BCM) booklet — revised November 2019 — shifted from “planning” to “management,” signaling that examiners expect a living, tested, board-governed program, not a binder on a shelf.
• The booklet is organized around a lifecycle: governance → BIA → risk assessment → strategies and plans → testing and exercises → maintenance and improvement.
• Third-party resilience is woven throughout — not bolted on as an appendix. If your critical vendor’s BCP is untested, that’s your finding.

---

Your BCP exists. It’s a 47-page document someone wrote three years ago. It lives in SharePoint. Nobody’s opened it since the last exam.

Sound familiar? It should — because this is the single most common finding examiners write up under the FFIEC’s Business Continuity Management framework. Not that you don’t have a plan. That you don’t manage one.

In November 2019, the FFIEC replaced its “Business Continuity Planning” booklet with the Business Continuity Management booklet — part of the IT Examination Handbook that applies to every institution supervised by the OCC, FDIC, Federal Reserve, NCUA, and state banking regulators. The name change wasn’t cosmetic. It reflected a fundamental shift in examiner expectations: from “do you have a plan?” to “do you have a program that actually works?”

Here’s what the booklet actually requires, what examiners look for during an IT exam, and how to avoid the findings that land in your next report of examination.

What Changed: From Planning to Management

The current booklet runs 86 pages in PDF, and a shorter, more principles-based document didn’t mean a reduction in expectations. The 2019 version made three significant structural changes:

Change	What It Means
Renamed from “BCP” to “BCM”	Business continuity is an ongoing management discipline, not a one-time planning exercise
Third-party content integrated throughout	Vendor resilience isn’t an afterthought appendix — it’s embedded in governance, testing, and risk assessment sections
Operational resilience emphasis added	New focus on resilience measures, maximum tolerable downtime (MTD), and the ability to deliver critical services under stress

The old booklet’s Appendix J, “Strengthening the Resilience of Outsourced Technology Services,” went away with it — OCC Bulletin 2019-57 rescinded the 2015 bulletin that introduced it — and third-party resilience now runs through the body of the booklet. That’s not reorganization for aesthetics. It means examiners evaluate these topics as core BCM components, not supplementary considerations.

The FDIC’s FIL-71-2019 summarized the shift: the booklet “focuses on assessing an entity’s resilience through an enterprise risk management (ERM) perspective that considers technology, business operations, communication strategies, training, testing, maintenance, and improvement.” It also noted that “The changes do not impose new requirements on examined entities.” The emphasis is on resilience — staying up, not just recovering.

The BCM Lifecycle: What the Booklet Covers

The FFIEC BCM booklet is organized around a lifecycle approach. Examiners evaluate each phase, and weaknesses in any one area can trigger findings. Here’s the full lifecycle:

1. BCM Governance

What the booklet expects: Board and senior management oversight of the BCM program. Board oversight includes “Allocating resources to BCM,” “adopting policies and plans to manage events,” and “Reviewing business continuity operating results and performance through management reporting, testing, and auditing.”

What examiners look for:

• A board-approved BCM policy with defined scope, roles, and responsibilities
• Regular board reporting on BCM program status, testing results, and identified gaps
• Designated BCM coordinator or team with clear authority
• BCM integrated into the institution’s enterprise risk management framework

Common finding: The board approved the BCP three years ago and hasn’t seen a testing report since. The BCM coordinator is also the BSA officer, IT manager, and facilities coordinator — with no dedicated time for continuity management.

Who owns this: At most community banks, BCM governance sits with the COO or a designated BCM Committee. At mid-size institutions, you’ll typically see a dedicated Business Continuity Manager or a resilience function within operational risk. Regardless of size, the booklet says “Board minutes should reflect business continuity discussion (including credible challenges) and approvals.” It doesn’t set a cadence — activities are “reviewed periodically or as changes dictate” — but at least annual board reporting is what examiners commonly expect, and they will check the minutes.

2. Business Impact Analysis (BIA)

What the booklet expects: Identification of critical business functions, dependencies (systems, vendors, people, data), and recovery objectives (RTO and RPO) for each.

What examiners look for:

• BIA covers all critical business lines and supporting functions
• Each critical function has defined RTO, RPO, and maximum tolerable downtime (MTD)
• Dependencies mapped: technology systems, key personnel, third-party providers, data feeds, facilities
• BIA current — reviewed on a regular cycle (annual is common practice) and after significant changes
• Financial and operational impact quantified for different disruption durations

Common finding: The BIA lists “core banking system” and “email” as critical systems but doesn’t map upstream and downstream dependencies. The RTO is listed as “4 hours” for everything — no differentiation by criticality tier, no explanation of how that number was derived, and no validation that the DR environment can actually achieve 4 hours.

The MTD concept is important here. The 2019 booklet defines maximum tolerable downtime as “the total amount of time the system owner or authorizing official is willing to accept for a business process disruption and includes all impact considerations.” It’s the ceiling your RTO has to sit under, and it’s close kin to the “tolerances for disruption” that U.S. regulators have floated in operational resilience discussions (more on that below). (For non-U.S. context: the UK’s version of this idea is the Bank of England’s “impact tolerance.”)

For a detailed walkthrough on building a BIA, see our guide: How to Conduct a Business Impact Analysis.

3. Risk Assessment

What the booklet expects: Identification and assessment of threats that could disrupt critical business functions. Section III.B says management “should evaluate the likelihood and impact of potential disruptions and events,” including the geographic area where the entity operates and risks to its third-party service providers.

What examiners look for:

• Comprehensive threat identification: natural disasters, cyberattacks, pandemics, utility failures, third-party failures, key-person dependencies
• Risk assessment methodology that evaluates likelihood and impact
• Consideration of speed of onset (a practitioner addition, not booklet language) — a ransomware attack hits differently than a hurricane because there’s no lead time
• Geographic concentration risk (are your primary and backup sites in the same flood zone?)
• Risk assessment updated to reflect the current threat landscape

Common finding: The risk assessment was written in 2018 and still lists “Y2K” as a threat category but doesn’t mention ransomware, supply chain attacks, or cloud provider outages. The likelihood ratings haven’t been recalibrated since COVID-19 demonstrated that “unlikely” scenarios actually happen.

4. Business Continuity Strategies and Plans

What the booklet expects: Documented strategies for maintaining and recovering critical business functions, including a Business Continuity Plan (BCP), Disaster Recovery Plan (DRP), and Crisis Management Plan.

What examiners look for:

• Recovery strategies aligned with BIA-defined RTO/RPO targets
• BCP that includes communication protocols, alternate processing procedures, and resource requirements
• DRP with system-level recovery procedures, backup strategies, and failover architecture
• Crisis communication plan covering all stakeholder groups: customers, regulators, employees, partners
• Plans that are version-controlled, accessible during a disruption, and not stored exclusively on the systems they’re supposed to recover

Common finding: The BCP is 90 pages of copy-pasted policy language with no operational procedures. When asked “what does the wire transfer team actually do on day one of a disruption?” nobody can answer without reading the whole document. The DRP references server names that were decommissioned two years ago.

For more on the BCP vs. DRP distinction, see: Business Continuity vs. Disaster Recovery: What’s the Difference.

5. Training, Exercises, and Testing

What the booklet expects: A training program for all stakeholders (Section VI) and exercises and tests that validate recovery capabilities and identify gaps (Section VII). Section VII.G lists four methods, and says the mix “should be determined by the entity’s size and complexity and the nature of its business.”

Method (VII.G)	Effort	Realism	Best For
Tabletop exercise (sometimes called a walk-through)	Low-Medium	Medium	Identifying gaps in procedures and decision-making
Limited-scale exercise	Medium-High	High	Recovering targeted processes and systems
Full-scale exercise	High	Very High	Validating end-to-end recovery at the alternate site
Tests	Varies	High	Quantifiably verifying RTOs, RPOs, backups, and system resilience

What examiners look for:

• Documented testing program whose policy sets “minimum frequency, scope, and reporting requirements” (annual coverage of critical functions is the common baseline)
• Tests that exercise actual recovery procedures — not just “we discussed the plan in a meeting”
• Testing results documented with identified gaps and remediation action plans
• Evidence that gaps found in testing were actually fixed before the next test cycle
• Third-party service providers included in testing where they support critical functions
• Board or senior management receives testing results and gap analysis

Common finding: The institution ran a tabletop exercise 18 months ago. The exercise identified 12 gaps. Three have been remediated. Nobody tracked the other nine. The next exercise is “planned for Q3” — but Q3 was two quarters ago.

6. Third-Party Resilience

This is where the 2019 revision made the biggest structural change. In the old booklet, third-party considerations lived in Appendix J (“Strengthening the Resilience of Outsourced Technology Services”). Now they run through the body, including a dedicated resilience section (IV.A.5) and a third-party testing section (VII.I).

What examiners look for:

• Critical third-party providers identified and mapped to the BIA
• Third-party BCPs reviewed during due diligence and ongoing monitoring
• Contractual requirements for RTO commitments, testing evidence, incident notification timeframes
• Evidence that the institution has participated in or reviewed third-party BCP tests
• Concentration risk assessed — what happens if one provider supports multiple critical functions?
• Substitutability analysis — how quickly can you switch to an alternate provider?

Common finding: The institution relies on a single core processor for deposit operations, lending, and GL — but has never reviewed the vendor’s BCP test results. The contract requires “commercially reasonable” recovery efforts but doesn’t define specific RTO or notification commitments. When asked about the vendor’s backup strategy, the relationship manager says “they told us they have one.”

This matters more than ever. In a March 12, 2024 speech, then-Acting Comptroller Michael Hsu said the OCC was “exploring baseline operational resilience requirements for large banks with critical operations, including third-party service providers.” Whatever happens to that idea, the lesson holds: your vendor’s resilience is your resilience.

What Examiners Look For: The Examination Procedures

The BCM booklet includes Appendix A: Examination Procedures — a detailed checklist examiners use during IT examinations. The key examination objectives include:

1. Governance adequacy — Does the board oversee BCM? Is there a designated BCM function?
2. BIA completeness — Are critical functions identified with recovery objectives and dependencies?
3. Risk assessment currency — Is the risk assessment current and comprehensive?
4. Plan adequacy — Do plans contain actionable procedures aligned to recovery objectives?
5. Testing effectiveness — Has testing validated recovery capabilities? Were gaps remediated?
6. Third-party oversight — Are critical vendor BCPs reviewed, tested, and contractually enforceable?
7. Version control — Are BCM documents maintained with appropriate version control and change tracking?

Examiners verify that “management documents, tracks, and resolves any changes when updating the BCP and the exercise and testing program(s)” and that “management maintains appropriate version control of key BCM documents.”

The Operational Resilience Shift: Where This Is Heading

The 2019 BCM booklet was a bridge between traditional business continuity planning and the emerging operational resilience framework. Here’s why that matters for how you build your program today.

In October 2020, the Fed, OCC, and FDIC jointly issued SR 20-24: “Sound Practices to Strengthen Operational Resilience” — an interagency paper targeting large, complex firms. While technically guidance (not a rule), it signals the direction for all supervised institutions. The paper integrates concepts from operational risk management, business continuity management, third-party risk management, cybersecurity, and recovery planning into a unified resilience framework.

In his March 12, 2024 remarks at the Institute of International Bankers, then-Acting Comptroller Hsu said the OCC was exploring baseline operational resilience requirements for large banks, which “could include”:

1. Clear definitions for identifying critical activities and core business lines
2. Defined tolerances for disruption
3. Required testing and validation of resilience capabilities
4. Third-party risk management expectations
5. Clear communication expectations among stakeholders and counterparties
6. Expectations for critical service providers, with emphasis on governance and risk management

Hsu left the OCC in February 2025, when Rodney Hood became Acting Comptroller, so this was one leader’s agenda rather than settled OCC policy. Treat the list as a useful map of where resilience thinking was headed, not a pending rule.

If this sounds like an evolution of the FFIEC BCM booklet — it is. Institutions that build strong BCM programs today are building the foundation for whatever operational resilience expectations come next.

90-Day Exam Prep Roadmap

If you have an IT exam coming up and your BCM program needs work, here’s a realistic timeline:

Days 1–30: Foundation

Deliverable	Owner	Notes
Update or create BIA for all critical functions	BCM Coordinator + Business Line Managers	Include RTO, RPO, MTD, and dependency mapping
Update risk assessment with current threats	BCM Coordinator + IT/InfoSec	Add ransomware, cloud outage, supply chain scenarios
Review and update BCM policy	BCM Committee	Ensure board approval and documented governance structure
Inventory critical third-party providers	BCM Coordinator + Vendor Manager	Map to BIA critical functions

Days 31–60: Plans and Procedures

Deliverable	Owner	Notes
Update BCP with actionable recovery procedures	BCM Coordinator + Department Heads	Each critical function needs step-by-step procedures, not policy language
Update DRP with current system inventory	IT/DR Team	Validate server names, configurations, backup schedules
Update crisis communication plan	BCM Coordinator + Communications	Templates for customers, regulators, employees, partners
Request and review critical vendor BCP test results	Vendor Manager	Document review findings; flag vendors without evidence

Days 61–90: Test and Document

Deliverable	Owner	Notes
Conduct tabletop exercise (minimum)	BCM Coordinator as facilitator	Use a realistic scenario; document findings
Create gap remediation tracker	BCM Coordinator	Track every finding with owner, due date, and status
Prepare board reporting package	BCM Coordinator	Testing results, gap summary, remediation timeline
Compile exam-ready BCM documentation binder	BCM Coordinator	Policy, BIA, risk assessment, plans, testing evidence, vendor reviews

So What?

The FFIEC BCM booklet isn’t just another regulatory document to check off. It’s the framework examiners use to determine whether your institution can actually deliver critical services when something goes wrong — whether that’s a ransomware attack, a vendor outage, or the next event nobody predicted.

The shift from “planning” to “management” isn’t semantic. It means examiners expect evidence of an active, tested, governed program — not a document.

The Citibank consent order in October 2020 — which included a $400 million civil money penalty from the OCC for risk management, data governance, and internal control failures — showed what happens when governance and risk management programs exist on paper but not in practice. And in July 2024, the OCC assessed an additional $75 million penalty against Citibank for violating the original 2020 order. The message is clear: regulators don’t just want to see the plan — they’ll come back to verify you executed it.

Build the program now. Test it. Govern it. The exam is coming either way.

---

Need a head start? The BCP/DR Kit is organized around the booklet: a Business Impact Analysis tab (III.A), a 5x5 Risk Assessment (III.B), Dependency Mapping, Recovery Procedures, a Test & Exercise Log (VII) and a quarterly Board Report tab (IX), plus a 38-page guide with a booklet section map. It’s a starting point, not an exam pass; tailor it to your institution.

---

FAQ

What is the difference between the FFIEC BCP booklet and the BCM booklet?

They’re the same booklet — the FFIEC renamed it in November 2019. The “Business Continuity Planning” booklet (last updated February 2015) was replaced by the “Business Continuity Management” booklet. The name change reflects a shift from one-time planning to ongoing program management, with added emphasis on resilience and third-party oversight integrated throughout (rather than in an appendix). Its glossary draws many definitions from NIST and ISO sources.

How often should a bank update its Business Impact Analysis under FFIEC guidance?

The FFIEC BCM booklet doesn’t specify an exact frequency, but examiners expect the BIA to be current — in practice, reviewed at least annually and whenever there are significant changes to business operations, technology, key personnel, or third-party relationships. If you underwent a core conversion, added a new business line, or changed critical vendors in the past year, your BIA should reflect those changes.

Does the FFIEC BCM booklet apply to credit unions and fintechs?

The FFIEC BCM booklet directly applies to institutions supervised by FFIEC member agencies: the OCC, FDIC, Federal Reserve, NCUA, and state banking regulators. This includes banks, savings associations, credit unions, and their technology service providers. Fintechs that partner with banks may be subject to BCM expectations indirectly — through their bank partner’s third-party risk management program and contractual requirements.