Business Continuity

Incorporating Pandemic Risk into the Business Impact Analysis (BIA)

The potential effects of a pandemic should be a part of a financial institution's overall BCP business impact analysis (BIA). The BIA should:

• Assess  and  prioritize  essential  business  functions  and  processes  that  may  be affected by a pandemic;
• Identify the potential impact of a pandemic on the institution's essential business functions and processes, and supporting resources;
• Identify the potential impact of a pandemic on customers: those that could be most affected and those that could have the greatest impact on the (local) economy;
• Identify the legal and regulatory requirements for the institution's business functions and processes;
• Estimate the maximum downtime associated with the institution's business functions and processes that may occur during a pandemic;
• Assess cross training conducted for key business positions and processes; and
• Evaluate the plans of critical service providers for operating during a pandemic.
• Financial institutions should evaluate the plans and monitor the servicers to ensure critical services are available. Financial institutions may wish to have backup arrangements to mitigate any risk. Special attention should be directed at the institution's ability to access leased premises and whether sufficient internet access capacity is available if telecommuting is a key risk mitigation strategy.

Incorporating the impact of pandemic risk into the institution's Business Continuity Plans involves additional complexity since typical disaster or emergency response mechanisms and methods may not be feasible. For example, moving employees to an alternate facility that is typically used during a natural disaster or other emergencies, may not be an appropriate or feasible way to continue operations in a pandemic. There may be a shortage of available staff to relocate and it is possible that the alternate site might be affected by the pandemic. DHS provides a list of twelve planning assumptions that institutions should consider when developing the impact analysis.

The pandemic issues considered in the Business Impact Analysis also should involve forecasting employee absenteeism and consider family care issues that may affect business operations. DHS believes rates of absenteeism will depend on the severity of the pandemic. In a severe pandemic, absenteeism attributable to illness, the need to care for ill family members and fear of infection may reach 40 percent during the peak weeks of a community outbreak, with lower rates of absenteeism during the weeks before and after the peak. Certain public health measures (e.g. closing schools, quarantining household contacts of infected individuals, or altering or ceasing public transportation schedules) are likely to increase the rate of absenteeism.

A key part of an institution's BIA that addresses pandemics is to examine external factors. For example, assessing the impact of critical interdependencies will involve making planning assumptions regarding the availability of external services and prioritizing the effect of possible disruptions. In addition, potential travel restrictions imposed by health and emergency management officials may limit access to those services, even if they are still operating.

Beware of Pandemic and Infectious Disease Planning Mistakes

Contributing reference:

Michael T. Osterholm, PhD, MPH

No discussion of Pandemic and Infectious disease planning is complete without warnings of how a planning program can go wrong.  Dr. Michael Osterholm from the center for Infectious Disease and Research Policy asks that we are reminded of the following mistakes that will affect planning for Pandemic and Infectious disease.

• Mistake: Build the plan then forget about it is one of the worst of these mistakes. 

Reviewing the plan, doing walkthroughs and functional exercises build improvement.  The pandemic plan like the Business Continuity plan and other contingency plans are living documents. Threats change, environment changes and priorities change.  These require looking over your plan and making sure it still can protect the environment.  Ask yourself if there are there new and better approaches to the way you are planning to allocate staffing.  Has the company bought a notification system that can be utilized during the Inter-Pandemic and later Phases?  Having at the minimum a walk-through of the plan each year will highlight needed changes.

• Mistake: Planning for Pandemic will not help. 

Planning always helps.  Planning alone will not help everyone.  Using a methodology of preparing, exercising, responding, recovering, and continuous improvement will make the difference.

• Mistake: Avoiding communications so as not to stimulate fear.

Providing the right message will which includes the safeguards that are in place will instill confidence.

• Mistake: Perfectionism

Trying to make the perfect plan is not possible.  There will be unknowns.  Using the resources available for Pandemic Planning, such as Flu.gov, the CDC, and the WHO to monitor and upgrade the plan along with the recommendations in this whitepaper will help to create an actionable plan.

• Mistake: Considering your plan finished

Like number one remembering that a Pandemic Plan is a living document that improves over time with exercises and experience will prevent this mistake.

• Mistake: Leaving out critical staff

Critical staff and cross-training are especially important during a pandemic as this is a time when resources may be more limited than any other time.

• Mistake: Using an all-hazards approach

Using and all hazards approach for a Business Continuity Plan will not work because assumptions for this approach involves several unknowns about the type of incident that may happen.  However, a lot is known when planning for a pandemic.  Reduced staffing levels over a long-term are the most obvious.  

• Mistake: Depending on news media to sound an alarm early enough

Waiting for the news media to warn us of a Pandemic outbreak will undoubtedly be a mistake.  Pandemic monitoring is the most effective approach to staying engaged in the stages of the Pandemic.

Crisis Management Lessons Learned
Contributing Reference: Alan Hilburg, president, and CEO of Hilburg