Hurricane Season BCP Testing: What FFIEC Examiners Expect Financial Institutions to Document Before October

Updated October 22, 2026: the 2026 peak has passed and the season closes November 30. The examiner expectations below haven’t changed; the calendar section now covers the post-season review and the 2027 pre-season cycle.

The Atlantic hurricane season runs June 1 to November 30. NOAA’s National Hurricane Center puts most of the activity between mid-August and mid-October, with the statistical peak on September 10. For 2026, that peak is behind us. That doesn’t close the question an examiner will eventually ask: when did you last test your response to a regional disruption, what did you find, and what did you do about it?

Most programs won’t survive that question with a straight answer.

TL;DR

• Most Atlantic hurricane activity falls between mid-August and mid-October. Institutions in coastal or flood-prone regions should finish geographic scenario testing before then, not in November. With the 2026 peak past, use the post-season window for the after-action review and to plan the 2027 test
• The FFIEC BCM Booklet requires testing that reflects the institution’s actual risk profile — geographic concentration is a documented expectation, not an optional module
• Examiners distinguish between exercises (tabletops) and tests (execution-based) — calling a tabletop a “test” creates a finding
• Documentation gaps — no remediation tracking, no prior-year gap closure, third-party vendors not included in scenarios — are the most common BCP examination findings
• Get the 2027 test plan approved well before you run it, so you’re not approving it the same week

What the FFIEC BCM Booklet Actually Requires

The FFIEC Business Continuity Management Booklet is the primary examination reference for bank and credit union BCP programs. It was issued in November 2019 and remains the framework examiners use when assessing program maturity. The only wording changes since then came in February 2026, when the FFIEC removed reputational-risk references from the IT Handbook; the three BCM sentences that changed are on our FFIEC BCM booklet reference page.

The Booklet structures BCP around a lifecycle: business impact analysis, risk assessment, strategy development, testing, and maintenance. Each phase creates documentation requirements. The testing section is where geographic risk scenarios specifically matter.

The FFIEC expects testing to be:

• Risk-based: scenarios should reflect the institution’s actual geographic risk profile, not a generic list of disaster scenarios that could apply to any institution in any location
• Comprehensive over time: no single test covers everything, but the multi-year testing cycle should exercise the full range of the institution’s critical functions and risk exposures
• Validated against recovery objectives: tests should verify whether recovery time objectives (RTOs) and recovery point objectives (RPOs) are actually achievable, not just assumed
• Documented with results and remediation: results should be reported to management and the board, with identified gaps tracked to closure

What this means for a community bank in Louisiana, a credit union with branches throughout coastal Georgia, or a fintech with operations concentrations in Florida: your testing cycle must include scenarios where those geographic exposures are the disruption vector. An examiner reviewing your program will check whether your BIA identifies geographic concentration risk, and whether your testing addresses it.

Generic tabletop scenarios built around “data center outage” or “ransomware attack” don’t satisfy this. They’re good tests. They’re not your hurricane scenario.

The Exercise vs. Test Distinction Most Programs Get Wrong

This is the single most common documentation error in BCP programs — and one of the easiest ways to generate an examination finding you didn’t earn.

The FFIEC BCM Booklet distinguishes between exercises and tests. An exercise is any activity involving people and processes that validates part of the BCP, from a tabletop discussion to a functional simulation. A test is a specific type of exercise: it verifies system resilience in an operational environment using quantifiable metrics. They are not interchangeable, and examiners know the difference.

An exercise is a tabletop, a walkthrough, a facilitated scenario discussion. Participants sit in a room or a Zoom call and work through what they would do if a Category 3 hurricane made landfall and closed five branches, knocked out power to the operations center, and forced staff evacuation for 72 hours. The discussion surfaces gaps, tests institutional knowledge, and builds team readiness. It’s valuable and examiners expect to see it.

A test is execution-based. Systems are actually failed over to backup infrastructure. Staff actually access the alternate site. Communication trees are actually called. RTOs are actually timed. The alternate site actually processes transactions. The test generates data—did recovery meet the RTO? What broke in execution that didn’t break in the tabletop?

A program that has run two tabletops this year and calls them “tests” on the board report will have that terminology corrected in an exam. The finding is usually categorized as a documentation or program adequacy issue, not a material weakness — but it reflects on program maturity, and examiners tend to dig deeper when they find inconsistency between what a program claims to have done and what it actually did.

If you’re reporting to your board, use the right terms. “Q1 tabletop exercise — geographic threat scenario, hurricane” and “Q3 alternate site test — IT systems failover” are not the same thing. Document them as what they are.

What Examiner-Facing Documentation Must Show

Running the scenario is half the job. The documentation is where programs fall apart.

The FFIEC BCM examination procedures specify what examiners will request. When your primary regulator — OCC, FDIC, Federal Reserve, or NCUA — schedules an examination, they will typically request:

Test plans approved before the activity occurred. Not drafted after. Not reconstructed. A test plan that’s dated a week before the activity with documented objectives, scope, participants, and expected outcomes. This is evidence the testing was designed, not improvised.

Attendance records or participation documentation. For tabletop exercises, this means the participants were actually from the right business lines. A hurricane scenario for an institution with concentrated coastal operations should include branch management, facilities, IT, operations, and communications — not just compliance.

Test results against stated objectives. The results document should show what was tested, what happened, and whether the result met the objective. If the RTO for the operations center was 4 hours and actual failover took 6 hours — that’s a finding in the test results, not an embarrassment to hide.

A gap log with owners and target dates. Every gap identified during testing needs a documented owner, a target remediation date, and status. Examiners look at this log and cross-reference it with the prior year’s gaps. If the same gap appears in 2025 results and 2026 results with no evidence of action, that’s a pattern finding. The remediation tracking piece is what separates a mature program from a paper program.

Evidence of management and board reporting. The results need to have gone somewhere — typically management review and annual board reporting. An untouched after-action report in a SharePoint folder doesn’t satisfy this. A board presentation slide deck showing the testing results and approved remediation plan does.

The BIA Gap: Geographic Concentration in Your Critical Functions

Before you run the scenario, make sure your business impact analysis actually supports it.

A common BCP gap in hurricane season preparation is a BIA that references geographic risk in general terms without specifically mapping critical business functions to geographic concentration. “Our branches are in the Gulf Coast region” is not the same as a BIA that identifies which branches handle what percentage of transaction volume, which back-office functions are co-located with which operational facilities, and what the recovery strategy is if those facilities are inaccessible for 5, 10, or 30 days.

The interagency Lessons Learned from Hurricane Katrina booklet, released by the FFIEC agencies and the Conference of State Bank Supervisors in June 2006 and still cited in the BCM Booklet, emphasized that financial institutions needed to evaluate the geographic scope of disasters differently from single-site disruptions. A hurricane doesn’t take down one facility. It takes down a region. Staff can’t commute to the alternate site if roads are flooded. Third-party vendors in the same region face the same disruption. Power restoration timelines are measured in weeks, not hours.

For the power and telecom resilience analysis your BIA needs to account for, hurricane scenarios introduce a specific complication: extended grid outages that stretch well beyond typical generator fuel reserves, cellular network saturation, and loss of internet infrastructure in the affected region.

Your BIA hurricane scenario should specify:

• Which critical functions have geographic concentration in the at-risk area
• Which third-party vendors are in the same geographic zone
• Whether your alternate site or recovery infrastructure is outside the probable impact area
• What the extended timeline looks like — not just 24 or 48 hours, but what a 7-day, 14-day, and 30-day disruption does to each function

If your BIA doesn’t answer those questions, your hurricane scenario test will uncover gaps you should have caught at the BIA stage.

What Your Testing Cycle Should Look Like: Post-Season 2026 and Pre-Season 2027

Now through November 30 (post-season 2026): If you ran a geographic scenario this summer, or lived through a real event, finish the after-action report and get the remediation log in front of management. If you didn’t run one, document that honestly and put a dated plan on the record. An examiner will take “we missed it in 2026 and here is the approved 2027 plan” far better than silence.

Winter into spring 2027: Refresh the BIA’s geographic concentration mapping and confirm third-party vendor locations. Then develop the test plan. Identify the scenario, the scope, and the participants. Get the test plan approved by management. If you’re doing a tabletop, schedule the facilitator and block 3–4 hours for participants. If you’re doing an execution-based test — alternate site activation, IT failover — coordinate with IT, operations, and facilities early. Execution tests have logistics that can’t be arranged in a week.

By July 2027: Run the scenario. A tabletop hurricane scenario for a community bank should walk through the 72-hour activation timeline: storm landfall, damage assessment, branch closure decisions, alternate site activation, staff communication, regulatory notifications, and customer communication. Push participants to the decision points that are actually hard: when do you declare a disaster? Who has that authority? What if the CEO is unreachable? What if the alternate site isn’t available because it’s in the same storm path?

Within a few weeks of the scenario: Document results. Write the after-action report while the scenario is fresh. Capture every gap identified, every assumption that didn’t hold, every process that worked better than expected. Don’t clean it up — the gaps are the value.

Before mid-August 2027: Open the remediation log. Assign owners and dates. Close the quick fixes before the period when most storms form. For items that require longer-term remediation — new vendor contracts, alternate site upgrades, infrastructure changes — put them on the record with realistic timelines and document that they’ve been escalated to the appropriate level.

The FFIEC BCM Booklet update analysis covers the program lifecycle structure in detail — the testing cycle sits within broader periodic program maintenance (annual in most programs) that also drives mid-year BIA reviews and board reporting.

So What?

The 2026 peak is behind us, and the season closes November 30. Financial institutions that complete geographic threat scenario testing before mid-August have a real window to identify and remediate gaps before the risk is highest. Institutions that run the scenario in November because “we got to it” have satisfied an annual calendar requirement with little operational value. If that was you this year, the fix is a 2027 plan approved this winter.

FFIEC examiners understand this. When they ask about your testing program, they will ask when in the year you ran it, what it covered, what you found, and what you did about it. A test run in July with documented remediation shows a program designed to manage risk. A test run in December with no remediation shows a program designed to check a box.

The documentation also matters. Use the right terms — exercise vs. test. Get management sign-off on the test plan before the activity. Write the after-action report with actual gaps, not a summary that everything went fine. Track remediation with owners and dates, and close the loop before next year’s examination.

For teams planning next season’s BCP test, the BCP/DR Kit’s Tabletop Exercise Kit includes a regional hurricane scenario (power and telecommunications out for days, staff evacuating, offices closed) with a facilitator guide, a scoring rubric and an after-action report template. Findings go into the workbook’s Action Items tab with owners and target dates.

Sources:

• FFIEC Business Continuity Management Booklet — IT Examination Handbook
• FFIEC BCM Booklet, VII. Exercises and Tests — IT Examination Handbook
• What’s New: February 2026 IT Handbook update removing reputational-risk references — FFIEC
• Federal financial regulators announce release of Lessons Learned from Hurricane Katrina (June 15, 2006) — Federal Reserve
• Tropical Cyclone Climatology: season dates and peak — NOAA National Hurricane Center