Bird Flu: It’s Time to Prepare
Jack died last night. Now what? The first person to die from the long-predicted, dreaded pandemic is someone from your town, a 45-year-old customer named Jack, a local businessman just returned from Singapore. Today is Wednesday; Jack died last night. Jack was in the bank last Thursday and Friday – depositing a check at the teller window, checking in with the loan department on a real estate tax escrow issue and dropping off something to his sister-in-law who works in back-office operations. Today, two tellers, three customer service representatives, the loan operations manager and four employees in deposit operations called in “afraid.” Those who did come to work are thinking about going home. Bank personnel in outlying branches are just getting the sad (and frightening) news. All the news outlets are frantically reporting the outbreak of the deadly flu, with Jack as the focal point. Television transmission trucks, with the big satellite dishes on top, are parked outside the bank, and the reporters (wearing linen breathing masks) are asking for comments from bank officers and staff about Jack, and about the bank’s precautions to guard against spread of disease. CNN has been cycling the clip showing Jack’s sister-in-law bursting into tears as she headed out the front door of the bank.
Is it likely that our “generic-Jack” will be from your town and/or be a customer of your institution? The odds are, of course, unlikely. However, is it likely that “generic-Jack” has a bank account somewhere and has visited that bank within the past week? The odds are, of course, much higher. Jack is likely to be someone’s customer.
How do we plan for this?
This is a very different sort of disaster to plan for, a disaster that even the best-crafted business continuity plans struggle to mitigate. At the heart of the disaster are people, their families, their emotions, their fears and their priorities. And in the chaos that a quick-striking pandemic could bring, the bank likely ceases to be a priority.
Guidance for bankers is beginning to emerge and mature. The guidelines contained in the Federal Financial Institutions Examination Council’s March 2003 handbook, titled “Business Continuity Planning,” initiated a thought process that systems disaster planning and recovery is very different from business process resumption and continuity strategies. The recovery team working on restoring systems or facilities is separate and distinct from the resumption team working at maintaining basic services during a disaster and then prioritizing process resumption following a disaster event. Katrina, Rita and all their hurricane siblings have clearly driven that message home. The FFIEC has recently added to the library of guidance with “Lessons Learned from Hurricane Katrina: Preparing Your Institution for a Catastrophic Event,” available at www.ffiec.gov.
Recognizing that a pandemic introduces a different dynamic to disaster planning, i.e. personnel availability, the FFIEC issued an interagency advisory on March 15. This advisory has set in motion a renewed focus on business continuity planning in general and pandemic planning in particular. The guidance may be summarized as focused on the following four issues: workplace health, process continuity plans, work-at-home alternatives, and industry affiliations and support.
The FFIEC advisory successfully promoted awareness and kick-started strategic planning, but was full of generalities and short on practical advice and recommendations. So far, the best guidance this writer has seen and read is contained in the American Bankers Association’s “ABAToolbox on Emergency Preparedness,” specifically Tool #7, “Preparing for the Avian Flu and Other Potential Pandemics.” The toolbox offers a checklist approach that one can easily envision becoming the template for an institution’s pandemic plan. The toolbox also offers some analytics on the “cycle” of such disease events that offer a starting point for establishing probabilities around an otherwise unpredictable event. On the previous page is a chart extracted from the ABAToolbox.
As a banking consultant working with institutions on their business continuity plans, I have recently ratcheted-up my concern and focus on the people-planning aspect of disaster events. As we all learn to consider a pandemic, the people focus is heightened still. We are finding that there are really no historical examples to rely upon. Guidance points to flu events in the past, such as the major outbreak in 1918-19 and smaller events from 1957 and 1968. However, health events from 40 to 90 years ago may not offer much reliable predictability for today’s planet, where disease has the ability to be transmitted globally and quickly in our “flat” world, and the vagaries of how modern international disease-control capabilities, which were non-existent in the early 20th century, will offset the pandemic’s spread. The predictability problem centers on a faster-moving pandemic encountering a better-prepared world, an as-yet-untested model. Another bias that seems to be systemic is that the pandemic will clearly start elsewhere. History may teach us something in this respect; the Spanish flu of 1917-1918 was first identified in Kansas. Spain’s king, as a famous victim, merely provided the name.
Therefore, as bankers, we should prepare for the worst. We should prepare for large disruptions in personnel availability, and employ a methodology that is both honest and unbiased. Many current business continuity plans are flawed in their thinking about personnel planning, with some aspect of what I would call “superman-syndrome” and/or “loyalty-blindness.” Let me explain. Plans often seem to exempt key personnel from “going missing.” The officers and supervisors seemingly are always available, and if they aren’t available, the back-up person always is. Staff disruptions are generally modeled to follow a pro rata distribution, such that, for example, a predicted 30 percent disruption would be applied across all functional areas (30 percent of the tellers, 30 percent of the customer service representatives, 30 percent of the back-office staff, 30 percent of the IT team, etc). However, what about a three-person IT team? The 30 percent model would plan for one person to be out, which doesn’t create much concern because we cover for vacation, sick-time and training days on a regular basis, don’t we? Realistically, however, all three could be out at the same time, whether ill themselves, or caring for family, which segues to the “loyalty” issue.
In my experience, many continuity plans are biased with respect to personnel loyalty. Expectations are set that all employees will place the bank and service to its customers as priority. However, if a pandemic strikes, isn’t it reasonable to expect that a significant portion of our staff will prioritize care of family, which logically extends to fear of spreading the disease to family members as a result of working with the public all day? In stark terms, is a teller going to risk his or her life in the service of the bank, or put family in jeopardy?
Pandemic planning should, at a minimum, include community “intelligence” and, with a broader view, offer an opportunity for a community bank to be a leader in community planning efforts. Here’s an example. In my community’s pandemic plan, the local hospital intends to divert all flu victims to city schools, where community triage centers will be established, in order not to introduce a new infection to patients already ill and/or recovering from other ailments. This strategy has the impact of closing the schools, which in turn begs the question of employee loyalty. What’s your town planning? If the kids are home, are your workers coming to work?
Getting even more negative about the potential for pandemic brings us to the worst-case scenario in which basic services start to break down because of undermanned utilities, especially electric and communications. Additionally, banks relying on service bureaus for core system applications might find such facilities understaffed as well. Pandemic plans may not suffice to cover such contingencies. Instead, the bank may want to pre-think the conditions under which the soundest measure is bank closure. Additionally, consideration should be given to the legal liability of keeping the bank open and putting employees and customers at risk. I would suggest that a strict definition of such a closure scenario and identification of the risks associated with remaining open should be a part of any plan, and pre-approved by bank management, especially the board of directors.
So … back to Jack.
How can an institution possibly test such a disastrous scenario? Here’s a thought. In keeping with my earlier “preaching” about honesty and bias, set up a table-top discussion about operating without certain personnel. As a random prediction model, remove a block of 30 percent of the names from an employee census. For example, from an alphabetical listing, maybe “remove” all with last names beginning from A through J (if that equates to 30 percent). Then, considering the staff remaining, take a look at the organizational chart, and ascertain where the “holes” are, both with primary responsibilities and back-up support. The “test” then consists of talking through the plans, keeping a focus on the staff available to fulfill the plans.
In closing, let’s all hope and pray that this is a needless exercise, and that our generic-Jack will be back in the bank making his usual weekly deposit. However, our regulators will demand that we play out this scenario, and our stakeholders are relying on the industry to be ready for any and all contingencies. Be ready.
David B. Sidon (www.navis-group.com, 978-774-6201) is a certified public accountant who manages Danvers, Mass.-based The Navis Group, specializing in risk project management for financial institutions, including business continuity, Sarbanes-Oxley compliance and enterprise risk management.