While the scale and duration of the Novel Coronavirus (COVID-19) pandemic is not yet fully understood, financial institutions, lawmakers, government and regulatory officials are working urgently to implement measures that will arrest the disruption to employees and customers, financial markets and systems, the economy, and business operations. So far, several agencies have issued updated guidance on pandemic planning to identify actions that financial institutions can take to mitigate the impact of the coronavirus on the delivery of critical financial services.
On March 6, the Federal Financial Institutions Examination Council (FFIEC) issued an Interagency Statement on Pandemic Planning. it calls on financial institutions to develop a business continuity plan (BCP) that addresses pandemics at various stages of an outbreak and incorporates a framework to ensure the continuity of critical operations, as well as testing and oversight of the plan. The federal depository regulators (The Federal Reserve Board, the Consumer Financial Protection Bureau, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency) and the Conference of State Bank Supervisors issued a joint press release on March 9 urging financial institutions to support customers facing financial hardships as a result of the virus, and pledging to work with those experiencing operational challenges to provide more convenient services in affected communities. The joint press release follows a March 3 letter from the Democrat members of the Senate Banking Committee encouraging financial trade organizations to work with member institutions to support consumers and employees facing health and financial challenges as a result of the outbreak.
Pandemic Preparedness Guidance
Unpredictability of scale and duration. Traditional disasters and disruptions such as malicious activity, technical disruptions and man-made disasters usually affect specific geographic areas, facilities or systems, and tend to be short in duration or limited in scope. On the other hand, pandemic planning is much more difficult to implement in a precise manner because it can potentially threaten every continent, occur in multiple waves, and adversely impact countless numbers of individuals and organizations. According to the FFIEC Interagency statement, these differences and challenges highlight the need for financial institutions to plan for a pandemic event when developing their BCPs. Given the unpredictability, a pandemic plan should be flexible enough to address a wide range of possible effects, and reflect the institution’s size, complexity and business activities.
Planning for high rates of absenteeism. The resilience of financial institutions depends on dedicated personnel maintaining important business processes and services. When personnel are absent for prolonged periods due to a pandemic, the staffing shortages can create significant operational disruptions and reduced productivity. The FFIEC suggests that firms implement procedures around social distancing to minimize typical face-to-face contact, it also encourages telecommuting, redirecting customers from branch to electronic banking services, and, in certain cases, sending employees to alternative sites to reduce disruptions to services. In the case of the coronavirus pandemic, some firms are finding that predetermined BCP contingencies that are often effective during other traditional disasters, such as relying on alternate teams in different geographic locations to support personnel affected in disaster-stricken locations, may have been significantly degraded given the virus has spread to at least 144 countries.
Examining external factors. A key part of pandemic planning is to examine external factors such as the impact of critical interdependencies and third parties. As this outbreak spreads, firms should consider the availability of those external services and prioritize the effects of their possible disruption. They should be mindful that in some cases, potential travel restrictions imposed by health and emergency management officials may limit access to those services. As such, it is important that institutions understand and evaluate the plans of critical service providers and explore the impact of degraded resources, products and services from not only those critical entities but also those identified as a secondary or tertiary vendors.
Coordination with third parties. Coordinating information-sharing efforts through business and community working groups is an important aspect of pandemic planning. Additional efforts can include engaging in cooperative arrangements with other financial institutions and trade associations, coordinating with local public health and emergency management teams, and communicating with customers and the media.
Identification of triggering events. During a pandemic outbreak, management should keep close tabs on alerts from various organizations, including national emergency and health care organizations that have developed surveillance systems on the progression of the viral outbreak. This will enable management to respond quickly to implement elements of the pandemic response plan.
What Firms Can Do Now
During a pandemic is not the most ideal time to develop a pandemic preparedness plan. This is particularly the case for companies that are currently wrestling with severe staffing and compliance challenges. Still, financial institutions that already have BCM/pandemic plans should evaluate those plans now, while closely monitoring official reports and news sources on the outbreak so they can quickly respond and implement those measures effectively.
Additionally, there are practical aspects of the pandemic planning guidance that firms can implement now. Here are a few, compiled by Protiviti’s operational and business continuity management experts:
- Implement employee protection strategies, such as encouraging “social distancing” techniques to minimize typical face-to-face contacts.
- Increase frequency of maintenance and house-keeping services to ensure all workspace surfaces are disinfected as often as possible.
- Communicate often with clients and employees, sharing the latest public health information as they become available with full transparency.
- Deploy as many different forms of media as possible to communicate with stakeholders, including the intranet, emergency mass notification systems, newsletters, emails and text messaging.
- Initiate communication and coordination with third-party critical service providers immediately to understand all aspects of their pandemic planning.
- Assess remote access capabilities such as capacity, bandwidth and authentication, and make prompt adjustments if needed to ensure seamless telecommuting.
- Due to the high volume of remote workers, IT should expand bandwidth and network capacity as much as possible and encourage employees to operate in staggered shifts, if possible, to reduce connectivity issues and network overload.
- Continue to inform markets and investors of any material risks to business and operations resulting from the coronavirus. For public companies, contact regulators promptly if disruptions to operations would impact compliance and reporting obligations. The Securities and Exchange Commission, for instance, is providing conditional regulatory relief to companies impacted by the coronavirus if they convey through a current report why the relief is needed.
Protiviti’s operational resilience and business continuity management experts continue to monitor the coronavirus outbreak and will provide additional insights on this major event as it unfolds. Subscribe to this blog to receive updates in your inbox, or bookmark our page.
