New Pandemic Guidance Issued by FFIEC

Staffing is Top Challenge to Consider When Planning for Disaster The second interagency guidance on pandemic planning and response has just been issued by the Federal Financial Institutions Examination Council (FFIEC).

The Interagency Statement on Pandemic Planning should be used by financial institutions in identifying the continuity planning that should be in place to minimize the potential adverse effects of a pandemic. This guidance expands upon the contents of the Interagency Advisory on Influenza Pandemic Preparedness issued in March 2006.

See Also: Preparing an Omnichannel Anti-Fraud Strategy

“This guidance follows the lead of the federal government and is aimed at being as consistent as possible with the national response,” says Mark L. O’Dell, Deputy Comptroller for Operational Risk at the Office of the Comptroller of the Currency.

The OCC is the lead FFIEC agency regarding this Pandemic guidance. The range of plans and preparations for each financial institution takes into account the scope of activities, size and complexity of the institution.

O’Dell says pandemic preparedness should be incorporated and integrated into existing BCP processes. “Second, we do not expect to see a similar plan in every institution. Size differential between some of the institutions go from multi-trillion dollar asset global entities down to the institutions with $10 million in assets,” he says.

Pandemic planning presents unique challenges to financial institutions. Unlike most natural or technical disasters and malicious acts, the impact of a pandemic is much more difficult to determine because of the anticipated difference in scale and duration. As a result of these differences, no individual or organization is safe from the potential adverse effects of a pandemic event. Experts believe the most significant challenge may be the severe staffing shortages that will likely result from a pandemic outbreak.

“In many of the smaller institutions, they already have a considerable amount of cross-training in place, and will have to provide even more to provide the coverage for key business functions,” says O’Dell.

Elements of a Pandemic Plan
The FFIEC agencies believe the potentially significant effects a pandemic could have on an institution justify establishing plans to address how each institution will manage a pandemic event.

Accordingly, an institution’s business continuity plan should include:

  • Preventive program to reduce the likelihood an institution’s operation will be significantly affected by a pandemic event;
  • Documented strategy that provides for scaling pandemic efforts commensurate with the particular stages of a pandemic outbreak;
  • Comprehensive framework of facilities, systems, or procedures to continue critical operations if large numbers of staff members are unavailable for prolonged periods;
  • Testing to ensure the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue; and
  • Oversight to ensure ongoing review and updates to the pandemic plan.

The pandemic guidance also has a list of the extensive federal government and industry association links for pandemic planning efforts. Both have issued extensive and comprehensive guidance to assist institutions of all types in developing plans for pandemic events.

Will There Be Regulatory Relief?
There have been a lot of questions about regulatory relief if a pandemic hits, O’Dell notes. He points to some of the emergency issues that have happened in the last seven years, such as 9-11, Hurricanes Katrina and Rita, and even the recent California wildfires. “Looking at how the agencies responded during those events, you can get a sense of the positions the agencies will take, to allow institutions some regulatory relief during a pandemic,” he says.

O’Dell stresses the need for coordination with outside parties. He recommends that institutions begin thinking through which outside parties would be involved during a pandemic, and begin establishing the networks and contacts needed. “Contacts will be even more valuable when needed during a pandemic. You don’t have to walk through scenarios, but getting the basic list of contacts and holding a conversation with them is a good start.”

Having a conversation with your examiner is a good idea too, he says. “Examiners are already talking with institutions about their BCP, so it’s a natural add on.”


About the Author

Linda McGlasson

Linda McGlasson

Managing Editor

Linda McGlasson is a seasoned writer and editor with 20 years of experience in writing for corporations, business publications and newspapers. She has worked in the Financial Services industry for more than 12 years. Most recently Linda headed information security awareness and training and the Computer Incident Response Team for Securities Industry Automation Corporation (SIAC), a subsidiary of the NYSE Group (NYX). As part of her role she developed infosec policy, developed new awareness testing and led the company's incident response team. In the last two years she's been involved with the Financial Services Information Sharing Analysis Center (FS-ISAC), editing its quarterly member newsletter and identifying speakers for member meetings.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing cuinfosecurity.com, you agree to our use of cookies.