Securities Regulation Daily Wrap Up, RISK MANAGEMENT—SIFMA spotlights business continuity study, (Jan 23, 2014)

By Mark S. Nelson, J.D.

The Securities Industry and Financial Markets Association (SIFMA) has announced the summary results of a business continuity planning (BCP) exercise designed to test how well the public and private sectors may handle an flu pandemic. The exercise is part of a two-year effort backed by the Federal Executive Boards in New York City and northern New Jersey, Federal Emergency Management Agency Region II, The Department of Health and Human Services, SIFMA, and The Clearing House, said a SIFMA press release.

“Business Continuity Planning (BCP) is essential for ensuring a resilient financial sector that can effectively respond to any disaster or significant emergency situation,” said Randy Snook, executive vice president, Business Policies and Practices, at SIFMA. “A pandemic scenario, such as a widespread influenza outbreak, is one of the most serious threats to the financial industry as it would impact the industry's most important resource - the employees that keep the financial system running smoothly,” added Snook.

The Pandemic Accord Tabletop Exercise (Pandemic TTX) report covers results from the exercise that took place November 18 to November 21, 2013. In 2014, the Pandemic TTX will conduct a full-scale exercise, create an after-action report, and propose corrective actions. The recommendations for BCP enhancements will be done in cooperation with New York University.

Pandemic flu risks. The Pandemic TTX report said that flu can have serious human and financial impacts. The report noted that the 1918 “Spanish Flu” killed 50 to 100 million persons globally. Of these fatalities, 500,000 happened in the U.S., with 30,000 in New York City, a major financial hub. Other pandemics occurred in 1957 and 1968 (Asian and Hong Kong flus) and more recently in 2009 (H1N1 flu).

According to the U.S. Centers for Disease Control and Prevention (CDC), all persons six months of age or older should get a flu shot. The CDC says that vaccination is especially important for those who are at higher risk for complications from the flu or who care for those at greater risk. Persons with allergies or other medical conditions should talk to a doctor before getting a flu shot.

The CDC also says that flu shots should be given in October because flu season can begin early and it takes two weeks for shots to boost immunity. Flu season often peaks in January, but vaccination can be done throughout the flu season.

Preparedness and first response. The Pandemic TTX said that while many companies have improved their preparedness and response plans, much still needs to be done. On the positive side, incremental advance planning activities showed efforts to implement flu shot programs, track absenteeism rates, and communicate emergency information to employees.

The exercise also showed weaknesses in companies’ BCP plans. Firms must do more to identify the fewest number of employees needed to do key jobs and must unify divergent human resources policies for sick time. Moreover, all firms must do more to hire substitute vendors before emergencies arise. But, this is especially difficult for financial services firms because they often compete for the same alternative vendors.

Decisions and Continuity. According to the Pandemic TTX report, financial services firms should consult with their regulatory staffs to gauge the legal impact of an emergency. Firms also can keep lists of jobs their employees have done before in order to better allocate healthy employees to other jobs during a crisis. Likewise, firms should consider alternative housing for emergency staff (e.g., nearby hotels).

Decision-making also must improve. The report noted that many firms prefer giving employees a lot of decision-making input during routine operations. The report said, however, that a small group of senior managers from multiple divisions should make emergency decisions. Top-down decisions may work best in light of challenges that arose during Hurricane Sandy when some firms that allowed greater input by lower-level staff risked decisional paralysis.

The degree of difficulty rose when the exercise asked participants to manage two crises at once. The exercise posited a cyber attack on a firm while the firm dealt with the maximum impact of a flu pandemic. The report said participants’ concerns about handling multiple crises highlighted the need for “flexible and adaptable” BCPs. Some participants noted their efforts to stymie hackers via better defenses instead of relying on back-up systems and by testing system strength in mock cyber attacks.

Other key issues need more work, too. For one, the Health Insurance Portability and Accountability Act limits a firm’s ability to track the reasons for employee absenteeism because it is unlawful to ask employees why they took sick leave. Firms should consider the logistics of employees’ telecommuting during crises because the practice has not been tested on the scale and for the time periods that may occur during an actual crisis. Firms also should consult with union representatives as part of their advance crisis planning.

Business recovery. The Pandemic TTX report said that during a crisis, firms must overcome their shot-term focus on immediate needs and start developing plans to reconstitute their businesses. These plans should consider how best to reallocate staff to the neediest locations. Firms may take cues from public authorities and the actions of their business peers. The after-action review process also is critical to the ongoing improvement of firms’ crisis responses.

One area of special concern, said the report, is the need to help employees return to work after a crisis. Here, the primary worry is that firms have not done enough to deal with employees’ “perceptions” about going back to work. The report said that firms should be “proactive” about return-to-work issues, even while still dealing with the initial response and recovery.

Companies: Securities Industry and Financial Markets Association; The Clearing House

IndustryNews: CorporateGovernance RiskManagement