PRINT THIS
FFIEC has issued guidance on pandemic planning, entitled Interagency Statement on Pandemic Planning (“Guidance”). This issuance is meant to heighten the response of financial institutions to the coronavirus pandemic. The Guidance identifies actions
that financial institutions should take to minimize the potential adverse
effects of a pandemic. Specifically, the institution’s business continuity plan
(BCP) should address pandemics and provide for a preventive program, a
documented strategy scaled to the stages of a pandemic outbreak, a
comprehensive framework to ensure the continuance of critical operations, a
testing program and an oversight program to ensure that the plan is reviewed
and updated.
We have been notifying you on how to protect your companies, customers, employees,
families, and communities HERE. Please review those articles and act
accordingly.
We believe that Disaster Recovery and Business Continuity should
be combined, but, as the Guidance states “pandemic planning activities should
involve senior business management from all functional, business and product
areas, including administrative, human resources, legal, IT support functions,
and key product lines.”
The pandemic segment of the BCP must be "sufficiently flexible to
address a wide range of possible effects that could result from a pandemic," and
also be reflective of the institution’s size, complexity, and business
activities.
Our position is that there are two types of BCPs: standard and enhanced.
The standard version lacks
due diligence and independent risk assessment but does provide a basic outline
to follow to ensure business continuity.
The enhanced version is preferred by regulators because it contains due diligence and independent risk assessment. The enhanced version is obviously
preferable to the standard version, because it provides specific due diligence, auditing done by subject matter experts, and leads to an independent risk assessment. The risk assessment reveals strengths and weaknesses further provides actionable recommendations. The standard version is less expensive
to draft than the latter, but can be used as a baseline to ensure that your
company is taking some affirmative actions to contain the spread of the coronavirus.
The Guidance is unequivocal in its directives:
The adverse economic effects of a pandemic could be
significant, both nationally and internationally. Due to their crucial
financial and economic role, financial
institutions should have plans in place that describe how they will manage
through a pandemic event. Sound planning should minimize the disruptions to
the local and national economy and should help the institution maintain the
trust and confidence of its customers. [Emphasis in original.]
According to the Guidance, “pandemic
planning presents unique challenges to financial institution management. Unlike
natural disasters, technical disasters, malicious acts, or terrorist events,
the impact of a pandemic is much more difficult to determine because of the
anticipated difference in scale and duration.”
The following constitute the actions that
management should be undertaking, per the Guidance:
1. A preventive program to reduce the
likelihood that an institution’s operations will be significantly affected by a
pandemic event, including the monitoring of potential outbreaks, educating
employees, communicating and coordinating with critical service providers and
suppliers, in addition to providing appropriate hygiene training and tools to
employees.
2. A documented strategy that provides
for scaling the institution’s pandemic efforts so they are consistent with the
effects of a particular stage of a pandemic outbreak, such as first cases of
humans contracting the disease overseas, first cases within the United States,
and first cases within the organization itself. The strategy will also need to
outline plans that state how to recover from a pandemic wave and proper
preparations for any following wave(s).
3. A comprehensive framework of
facilities, systems, or procedures that provide the organization the
capability to continue its critical operations in the event that large numbers of the institution’s staff are unavailable for prolonged periods. Such
procedures could include social distancing to minimize staff contact,
telecommuting, redirecting customers from branch to electronic banking
services, or conducting operations from alternative sites. The framework should
consider the impact of customer reactions and the potential demand for, and
increased reliance on, online banking, telephone banking, ATMs, and call
support services. In addition, consideration should be given to possible
actions by public health and other government authorities that may affect
critical business functions of a financial institution.
4. A testing program to ensure that
the institution’s pandemic planning practices and capabilities are effective
and will allow critical operations to continue.
5. An oversight program to ensure ongoing
review and updates to the pandemic plan so that policies, standards, and
procedures include up-to-date, relevant information provided by governmental
sources or by the institution’s monitoring program.
The Guidance provides helpful and important
links to information resources, as follows:
1. The National
Strategy for Pandemic Influenza (National Strategy) and the Implementation
Plan for the National Strategy for Pandemic Influenza (National Implementation Plan) issued by the
federal government provide a complete guide to pandemic planning.
