Just last week, Information Security Media Group released the results of its inaugural State of Information Security survey, which in part found that, of all prospective disasters, U.S. financial institutions are least prepared for a pandemic emergency.
And then just days later, the Federal Financial Institutions Examination Council (FFIEC) issued an interagency statement on pandemic planning for financial institutions.
In light of all the attention being paid to pandemic preparation, we caught up with George Hender, chair of the Financial Services Sector Coordinating Council (FSSCC), which last fall teamed up with the US Department of the Treasury and the Financial Banking Information Infrastructure Committee (FBIIC) to complete the largest-ever pandemic exercise for the U.S. financial services industry. Following are excerpts of our conversation with Hender, who was attending a recent symposium on pandemic planning in Washington, D.C., where the results and model of the FSSCC/FBIIC/Treasury exercise was on display for other interested governments to review.
Q: First, what was the focus of this pandemic symposium, and what was presented?
Hender: At the symposium we released information to a dozen nations around the globe, The symposium attendees include government and industry representatives from Europe and Asia. Singapore plans to do their own pandemic exercise later this year. The information they're getting at the symposium will prove invaluable to them in structuring the exercise, but also why it's important to do an exercise like we did here in the United States. (See related story on Pandemic National Exercise)
Q: What are some of the future considerations for the industry and institutions coming out of this exercise?
Hender: One of the big questions coming out of this exercise was what do we do next? We have a group called the pandemic forum, which FSSCC formed, and had members from FSSCC and also from the public sector including critical interdependency areas, such as health care, telecommunications transportation systems,
A number of things came out of the national exercise that we feel need further attention. We've taken several of these points back to the Pandemic Forum to say these are some of the things that seemed to work well, and these are the areas that need more work to improve. The forum will be charged with that responsibility in finding solutions and will move forward to find them. The areas that need more work include the whole area of interdependencies, particularly in the area of telecommuting. How will this work? It still needs further investigation and more work.
Another is the whole area of regulatory relief -- part of our pandemic forum includes those regulatory agencies that regulate our businesses. I feel we have to go back to them and say, 'Okay we've gone through the exercise and we've seen where in past incidences regulatory relief would probably have been sought, and we'd like to get your reaction to on whether you would have granted regulatory relief or you would not grant it, based on the facts that were presented in the scenario.'
It's very hard to get an answer on this question of regulatory relief. The typical answer you get from the agencies is, 'We'll deal with that situation when it happens. It's very hard for us to make a decision before it happens.' But you could say that about anything.
One of the issues facing the industry is moving business. Almost all (99%) of the major firms who participated in the exercise indicated they were making plans to move their business units to other parts of the country, and even different parts of the world. In that case, they will need regulatory approval to do it, and in certain cases regulatory relief.
It's an appropriate question for the regulators to respond to -- if a bank has to move its business either to another area of the state or region, or even to another country, the agencies should be able to respond to it in advance, and say, 'Feel comfortable in planning for this, we are going to offer relief on this.' Without this advanced notice of regulatory relief, it's going to be very difficult for firms such as Goldman Sachs, as an example, for them to build into their plans a move of their business units to other places in the world, or even into another region of the country.
I really think we need a sense of what kind of regulatory relief can be expected from the agencies. This doesn't just go for the top 100 banks, but the smaller institutions that will have to close branches, or reduce services and fall back to ATM services if a pandemic hits their area. The national exercise was great for those sized institutions. Many of those who participated had business interruption plans, but a pandemic incident wasn't part of their plan. Those that didn't have a pandemic in their plan now realize the need to build it in.
Q: Any lessons learned from the response to Katrina or other events that can be used in planning for a pandemic?
Hender: I'd like to think we are getting better, especially in the area of communications. I was involved in the Katrina response and communication in the early days on the private side and the response from the private side was very good.
At the outset we identified a number of critical needs. Problem I saw was having the right structure to pass on all that information we gathered. This proved to be difficult, not on the financial services side, but more in on the energy and telecom side. I think we've come a long way in figuring out how we get information up the chain as well as down.
Information seems to flow much better now. The thing I worry about is that this presidential administration is nearing an end, and many of the senior level people we've been dealing with will be leaving when a new administration comes in, either at Treasury, or other DHS areas. So we'll have to go through again establishing contacts and rapport with the new senior level people, and how are they going to deal with these types of disasters? I think that Katrina was a disaster in terms of how certain agencies in the government dealt with it. I'm sure that the next administration is going to make sure when the next disaster comes along that they will be better prepared to respond to it.
A lot of the response is communication. Gathering the facts, passing them on, finding out from the regulators what they're doing, what they're not doing in regulatory relief. For the person who takes over my role, it's going to be a real task to make sure to build the right relationships and to make sure that the next government that comes in, that they give priority to these kinds of things. Because it's not a question of if this pandemic is going to happen, but a question of when.
Even if we're fortunate enough not to have a pandemic, (all the experts are saying that we're not going to be fortunate). A lot of the previous disasters we have had were short lived, 9-11, the California wildfires, even Katrina didn't last for months upon months.
You can paint a scenario where a portion of the country will be knocked out for weeks, even over several months. It doesn't have to be a pandemic event, it could be something else. We have some experience in events like this. That's why this exercise was valuable, so people could see the impact on their business and models as to what would happen if 1/3 or more of their people didn't show up for work, not just for a few days, but for weeks at a time.
Q: Are the regulators prepared for a pandemic?
Hender: The regulators did participate in the exercise. Their level of availability and staffing during a pandemic will depend, I think, on the agency. The Federal Reserve Board already has identified and set four or five back-up sites around the country in case a pandemic hits. I think they are as prepared as anyone, and they take it very seriously. The Treasury Department, the SEC, and other regulatory agencies are prepared. They've certainly forced entities that work with them, such as my company, the Options Clearing Corporation, to do a number of things and spend a lot of money to make sure that no matter what happens we are there to clear the trades. If the markets are open, then the clearing organizations have to be open and ready to go.
Q: How are the other critical infrastructure industries prepared for a pandemic?
Hender: When we get beyond the financial services industry into other industries, we don't have as much confidence in their preparedness. Especially where they are operating on very thin profit margins and are in highly competitive markets. The companies are finding it difficult for them to justify building a plan, creating back-up sites, and having a robust plan, when they don't have the financial resources to do it and their competition isn't doing any planning either. Those that I refer to are the critical infrastructure industries including power and telecommunications. For example, after Katrina the cost of oil and gas shot up because there were not fall-back or recovery plans or alternate sites for operations at the refineries that were impacted. I'm not sure people know how few refineries we have in this country and how few have been upgraded or built in the last 20 years.
Q: Looking forward, any advice or good news for the average institution on pandemic planning?
Hender: One thing I saw as hopeful from a medical/drug standpoint is that we may be better prepared to fight a pandemic. According to the CDC, we may be better able to cope from a drug standpoint by using Tamiflu. There has been a wide range of opinions on the use of it and lack of benefit of using it. There is no vaccine yet for the avian flu, although there are reports that Norway has developed some type of generic vaccine. It's clear that Tamiflu, if you use it to prevent avian flu, that there seems to be some real benefits in doing it, according to the CDC. The government doesn't have an official policy on the use of Tamiflu or stocking of it by either companies or individuals. But the CDC official who spoke at the symposium told us, "All I can tell you is, we [the CDC] have stocked it for our employees and families."
The problem about a year ago, there was not a lot of Tamiflu available to the general public. The drug companies have done a good job to provide an ample supply of Tamiflu, so individuals now will be able to buy it and have it. The shelf life has been set at 5 to 7 years, but they're thinking it will last even longer, and are in process of testing the efficacy of Tamiflu past those timeframes. So, if in fact they're right, that Tamiflu has a positive effect both before and after a pandemic would strike, it would lessen the impact on the companies, individuals and countries involved. Let's hope this news turns out to be real, we'll watch for more information coming from the CDC on this.
Q: Should institutions stockpile Tamiflu for employees and family members?
Hender: This was actually one of the questions we asked during the national exercise, and as I remember, not many answered that they were stockpiling Tamiflu. The number who reported they were stockpiling it was low, and those who were distributing it were low. But based on what we've heard from the symposium, when we reconvene the pandemic forum, this will be reexamined and something that will be brought to everyone's attention-- that Tamiflu is now more readily available, and also that it appears to have significant positive benefits both before and after the avian flu hits, Institutions should reexamine their policy as to if they will stock it for your employees. The CDC is studying it right now, and will make a recommendation on how companies should approach this. The US Government has already stockpiled a supply of Tamiflu for certain groups identified as critical to government operations and response during a pandemic.
Q: What should the average institutions' pandemic preparation look like?
Hender: This is something that everyone should take seriously, when the CDC throws up a map and shows what areas are being hit, if you look at how it will spread and how it is it affecting different parts of the globe, whether you are an individual or an institution, you have to take it seriously. You've got to plan that this is going to happen. As an example, one person from the Bank of Canada asked at the symposium, 'How did we get the number of banks and credit unions participating in the exercise. Did it really get to the top decision makers at these institutions?' When you look at who makes these types of decisions, they are made at a senior level. These decisions made to participate and the results of the exercise point to the importance of the U.S. financial services industry to the entire global financial markets. The recent world market stumble that happened during 9-11 and the ensuing days after will give you a picture of what will happen to the world markets and how they would react when the avian flu is announced. It's not going to be good thing. The national exercise reinforces the need that our markets and financial agencies will come out and say 'We're ready, we've tested our markets, and our institutions and we are confident that the global markets are going to continue to operate smoothly and will be able to sustain operations during a pandemic.'