New Pandemic Guidance Issued by FFIEC

The Interagency Statement on Pandemic Planning should be used by financial institutions in identifying the continuity planning that should be in place to minimize the potential adverse effects of a pandemic. This guidance expands upon the contents of the Interagency Advisory on Influenza Pandemic Preparedness issued in March 2006.

See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources

“This guidance follows the lead of the federal government and is aimed at being as consistent as possible with the national response,” says Mark L. O’Dell, Deputy Comptroller for Operational Risk at the Office of the Comptroller of the Currency.

The OCC is the lead FFIEC agency regarding this Pandemic guidance. The range of plans and preparations for each financial institution takes into account the scope of activities, size and complexity of the institution.

O’Dell says pandemic preparedness should be incorporated and integrated into existing BCP processes. “Second, we do not expect to see a similar plan in every institution. Size differential between some of the institutions go from multi-trillion dollar asset global entities down to the institutions with $10 million in assets,” he says.

Pandemic planning presents unique challenges to financial institutions. Unlike most natural or technical disasters and malicious acts, the impact of a pandemic is much more difficult to determine because of the anticipated difference in scale and duration. As a result of these differences, no individual or organization is safe from the potential adverse effects of a pandemic event. Experts believe the most significant challenge may be the severe staffing shortages that will likely result from a pandemic outbreak.

“In many of the smaller institutions, they already have a considerable amount of cross-training in place, and will have to provide even more to provide the coverage for key business functions,” says O’Dell.

Accordingly, an institution’s business continuity plan should include:

• Preventive program to reduce the likelihood an institution’s operation will be significantly affected by a pandemic event;
• Documented strategy that provides for scaling pandemic efforts commensurate with the particular stages of a pandemic outbreak;
• Comprehensive framework of facilities, systems, or procedures to continue critical operations if large numbers of staff members are unavailable for prolonged periods;
• Testing to ensure the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue; and
• Oversight to ensure ongoing review and updates to the pandemic plan.

The pandemic guidance also has a list of the extensive federal government and industry association links for pandemic planning efforts. Both have issued extensive and comprehensive guidance to assist institutions of all types in developing plans for pandemic events.

O’Dell stresses the need for coordination with outside parties. He recommends that institutions begin thinking through which outside parties would be involved during a pandemic, and begin establishing the networks and contacts needed. “Contacts will be even more valuable when needed during a pandemic. You don’t have to walk through scenarios, but getting the basic list of contacts and holding a conversation with them is a good start.”

Having a conversation with your examiner is a good idea too, he says. “Examiners are already talking with institutions about their BCP, so it’s a natural add on.”