What is a pandemic and why should US banking regulators be so worried about the effect of one on the financial system? The US banking regulators have defined a pandemic as an “[outbreak] in humans of infectious diseases that have the ability to spread rapidly over large areas, possibly worldwide.” This month’s column will review the latest pandemic planning guidance issued by the US banking regulators and note some of the pandemic-planning issues that may arise in banks operating internationally.

Background

The world has been concerned for some time about the effect that a pandemic would have on the financial system. US banking regulators weighed in recently on this subject on December 12, 2007, when the Federal Financial Institutions Examination Council (FFIEC), which is composed of representatives from the US federal and state banking regulators, issued its Interagency Statement on Pandemic Planning.1 This is the latest guidance from the US banking regulators on this subject. The December 2007 guidance supplements the “Interagency Advisory on Influenza Pandemic Preparedness” issued by banking regulators in 2006.

The guidance focuses on pandemic planning as part of the broader subject of business continuity. However, pandemic planning differs from regular business continuity planning in several ways. For example, a disaster such as a hurricane may cause devastating damage, but it is limited to a specific geographic region and occurs within a short period of time. The concern about pandemic planning is that its reach could be worldwide and of prolonged duration. Experts believe that the most significant challenge during a pandemic will likely be the staff shortages due to absenteeism. Employees may be ill themselves or acting as caretakers to others who may be ill.

In incorporating pandemic planning into its business continuity plan, a bank needs to take into account the complexity of its operations in developing a plan that will be flexible enough to address effectively a wide range of possible consequences that could result from a pandemic. Customers should not be forgotten either. The plan should address how the financial institution will deliver its financial services to its customers and the greater public.

The FFIEC Guidance

The FFIEC Guidance outlines the following steps to keep in mind when incorporating pandemic planning into a bank’s business continuity plan.

A preventive program to reduce the likelihood that an institution’s operations will be significantly affected by a pandemic event. The program should include monitoring of potential outbreaks, educating employees and communicating and coordinating with critical service providers and suppliers.

A documented strategy to developing the bank’s pandemic planning efforts. The strategy should include addressing the various stages of a particular pandemic outbreak, recovery from that outbreak and proper preparation for any subsequent outbreaks.

A comprehensive framework of facilities, systems or procedures that will allow the bank to continue its critical operations in the event that large numbers of its staff are unavailable for prolonged periods. Procedures could include telecommuting, redirecting customers to electronic-only sites from which to conduct banking operations, and conducting operations from alternative sites. The framework should include addressing delivery of products to customers. Responding to government directives and regulators’ demands also must be incorporated into the framework.

A testing program to ensure that the institution’s pandemic planning practices and capabilities are effective and will enable critical operations to continue.

An oversight program to ensure ongoing review and updates to the pandemic plan so that it is up-to-date and relevant to the bank’s current operations, and includes the latest government advice applicable to one or more regions in which the bank operates.

When a bank has operations around the globe, preparing an effective pandemic planning program may be a daunting task. The United States and other countries have developed overall strategies to deal with a pandemic and it is important for an internationally active bank to be aware of pandemic planning efforts by the governments of the countries in which the bank operates and to be ready to adjust its own plan accordingly to avoid any conflicts that might result.

Oversight begins at the top—as part of its business continuity planning responsibilities, the board of directors of the bank should adopt the pandemic plan and be apprised on an ongoing basis as to the level of readiness of the bank in being able to implement the plan if necessary. In addition, the board should be notified if any region in which the bank may operate has a regional pandemic plan that falls below the requisite level of readiness.

While there should be a coordinated bank-wide pandemic plan overseen from the head office, large international banks also may want to consider developing regional plans that can be put into effect quickly should a pandemic break out in one particular region in which the bank operates. As part of a business continuity plan, a bank should consider appointing an overall pandemic coordinator to chair a committee of key contacts in the regions and countries in which the bank operates. In developing a plan, the bank needs to take into account all the relevant parties such as bank management and employees, service providers and suppliers.

In developing its pandemic plan, internationally active banks may want to keep in mind the following issues:

  • Has the bank developed a plan that addresses the unique aspects of each of the regions in which it operates? In addition, an internationally active bank may find that governmental pandemic planning efforts differ from country to country and in developing a pandemic plan, the bank should keep in mind the governmental efforts of the countries in which it operates.
  • Has the bank developed a regular testing schedule of the business continuity plan that includes pandemic planning? Several countries, including the United States and the United Kingdom, have run large-scale pandemic simulation exercises specifically aimed at financial institutions in order to test these institutions’ pandemic business continuity plans. However, an international bank should not wait until the opportunity is offered to join a government-sponsored exercise; it should test its program on a regular basis, for example, run one exercise on a worldwide bank basis and then run others that target various regions—this is one way to uncover weaknesses in a particular region’s pandemic plan that may not be apparent in the bank’s plan as a whole.
  • While the business continuity plans of an internationally active bank currently should include the ability to operate from alternate sites if necessary, such an ability can become even more important if a pandemic occurs in one of the regions in the world in which it operates and there is widespread and sustained absenteeism. An international bank should consider whether it has, if necessary, the ability to switch promptly one region’s operations (for example, in the United States) to another region (for example, London) if there is insufficient staff to operate in the regular region.
  • Has sufficient thought been given to maintaining the provision of products and services to customers? Sensitivity to customers’ needs is critical. In the event of an outbreak, people may want to stock up on cash, so plans should be developed that would allow the bank to keep its cash machines well stocked, perhaps through a back-up arrangement with an armored car carrier.
  • Is the bank aware of government/private sector coordination efforts in the countries in which it operates? Some countries have developed local government/private sector committees for planning and informational purposes. Banks with a large presence in a particular area should be especially aware of these coordinating committees and may want to consider joining such a committee.
  • As noted above, a pandemic may create sustained absenteeism. The bank may want to consider the feasibility of having systems capability for senior information technology people to operate from their homes if necessary.
  • Is telecommuting capability available in all regions in which the bank operates? If not, the bank should consider what can be done to either increase the capability for telecommuting or to develop as equally an effective alternative as possible.
  • Do the regional plans mesh together well with each other and with the head office’s overall plan? While each regional planning head will want to tailor the bank’s pandemic plan to the particular needs of that region, the bank should be sure that there are no conflicts among the regions’ plans that could disrupt implementation of the bank’s plan as a whole. In addition, the regions all need to be able to communicate with each other directly in the event that the communications system at the head office slows down or tops completely as a result of staff absences during a pandemic.
  • What are your service providers doing to address pandemic planning? A bank should coordinate with its service providers around the world to make sure that they have their own plans and that those plans would be able to accommodate the bank’s plans. Service providers should be approached to see if they can provide back-up services cross-region if necessary.

Conclusion

Internationally active banks should stay current with the latest information on disease outbreaks and on what local governments are doing to address the problem. A pandemic may never occur, but far better for an internationally active bank to have pandemic planning incorporated into its business continuity plan rather than be caught short should one happen, and the bank’s systems and its ability to service customers be critically impaired as a result.