Pandemic Planning: Lessons Learned from the Spring

Business continuity planning for a pandemic outbreak has been a requirement for financial institutions for a few years now. As one of the pillars of critical infrastructure, the Department of Homeland Security initially provided guidance on pandemic planning that was later expanded upon in the FFIEC Business Continuity Planning Booklet published March 2008.

Most banks have done some level of pandemic planning. In April, when the Swine Flu (H1N1) first reared its ugly head and the World Health Organization (WHO) elevated the Pandemic Alert Level from Phase 3 to Phase 5 within three days, many of these plans were put into motion for the first time. This test drive of pandemic response gave us a glimpse of what we should expect if future waves increase in severity. Below are some of the lessons we can learn from the initial H1N1 outbreak.

Many common "assumptions" were wrong
Most pandemic response plans were based on the assumption that the Avian flu (H1N5) would originate in east Asia and there would be a considerable time lag before it reached the United States. As we know, it was the Swine flu (H1N1) that emerged as the dominant virus, originating in North America. Within a week, the virus had spread to 19 states and 11 countries, significantly contracting the response time.

Additionally, most business continuity plans assumed that when the WHO Alert Level reached Phase 5 (an official pandemic), businesses and transportation would shut down and available employees would continue key business functions from home. However, when the alert level reached Phase 5 in April, businesses did not need to close down. We learned that the WHO levels were a measure of "geographic spread" not "severity."

Lesson: Plans need to be flexible and adaptable with common sense

Business issues as well as business continuity issues arose
Many firms were struggling with human resources issues pertaining to work leave, return-to-work, dependent care and pay policies that could not be satisfied by current employment policies. Questions included:

Human resource considerations are just an example of business issues that need to be dealt with during a pandemic. Banks also should also consider other issues, such as how demand for their services may fluctuate and how operating procedures and policies may need to change in response to the conditions. For example, banks should consider when to close down lobby traffic and direct customers to drive-through or internet banking.

Lesson: Business continuity planning for Pandemic involves more than information technology.

Fear mongering thrives in a crisis
Every news outlet had extensive coverage of the pandemic outbreak. Within just two days, there was widespread fear because of the sensationalized media coverage. Employees were likely distracted about concerns for themselves and their loved ones.

Employers are one of the most trusted sources of information for employees. Companies that responded with factual and proactive communication were able to diffuse much of the employee stress and anxiety. Additionally, the companies that had conducted internal flu prevention and awareness campaigns with employees had a more prepared workforce than those who did not.

Lesson: Emergency communication and employee awareness are critical.

Resources will be limited
Preventive hygiene and sanitation supplies were scarce commodities as businesses and individuals began to stockpile supplies. After the initial outbreak in April, I contacted several medical supply companies in the Twin Cities looking for N-95 respirator masks for our employees before finding one that was rationing the masks and selling them at a premium price. The companies that fared well had stockpiled resources in advance, distributed supplies to all branch locations and coordinated training and education on influenza prevention for employees.

For a majority of businesses, employees are the most critical resource. Unfortunately, these critical employees will likely be the hardest hit by a pandemic outbreak. A couple of our bank clients had key personnel out for an extended period of time. One was due to the illness itself and the other because of travel restrictions that were imposed while he was vacationing in Mexico. Both held critical positions and specialized areas of knowledge that was not known by others within the institution. While their extended absences in this case were not detrimental to their banks, it heightened the awareness of the risks of being dependent on specific individuals and the need to cross-train critical functions.

Lesson: Stockpile emergency supplies and cross-train critical business functions.

If the crisis were worse, many banks would not have been able to continue critical business functions
The pandemic scenario throws a wrench into the traditional disaster recovery / business continuity model. Most business continuity plans are designed to address a loss of a facility, power, computer equipment or telecommunications network. But what would happen if the physical location were untouched, IT services were running as normal, but personnel could not go to work because of illness, travel restrictions or quarantine? Can personnel to do their jobs from home while ensuring adequate levels of security?

What about critical service providers? What are your key vendors' plans for continuing critical operations, such as providing cash and coin, stocking ATM machines, ensuring physical security and providing outsourced IT services?

Lesson: Business continuity capabilities must be assessed and contingency plans must be created for all critical services.

Recommended Actions

  1. Review your business impact analysis (BIA) - Identify the critical business functions that would be affected by a pandemic and how those functions would continue to operate during high levels of absenteeism.
  2. Enable continuity capabilities for critical functions – Cross-train employees for all critical functions and document operating procedures. Enable sufficient work-from-home capabilities and resources for employees performing critical functions.
  3. Create pandemic policies – Businesses should create policies in advance that address family and medical leave, return to work, work from home, refusal to work and compensation.
  4. Develop an emergency communication plan – Find dependable sources of information and individuals to monitor an outbreak situation. Identify a "spokesperson" for the bank to create the message for internal and external communication. Update employee contact lists and call trees that include multiple contact methods. Consider developing communication templates for employee, customer and website messages in advance that may be altered and quickly distributed, if needed.
  5. Stock up on supplies – Obtain and provide hand sanitizers, sanitary wipes, facial tissues and anti-bacterial soaps for employees. Consider obtaining N95 respirator masks to distribute if and when appropriate.
  6. Educate personnel on appropriate hygiene training, social distancing and on the advance pandemic preparations taken by the bank.
  7. Test to ensure that the bank’s pandemic practices and capabilities are effective and will allow for the continuation of critical functions. An excellent tool to assist in your preparation is a “tabletop exercise” using the pandemic scenario to flesh out the issues that your bank will need to address in this situation. We recommend using the same scenario that was presented in April with the initial pandemic outbreak, but simulate increased severity.

Ask yourself what the impact would be if there were 40% absenteeism for up to 8 weeks and the possibility of up to 100% for some organizations, as Gartner Group estimates.

The initial H1N1 this spring may turn out to be a blessing or a curse for organizations, depending on their response to that spring warning shot. It may be a blessing if companies improve preparedness by taking action on the lessons learned. It may be a curse for those who shrug off the importance of pandemic preparedness because this first run was "no big deal."

Additional resources:

By: Jeff Olejnik, President
Assurity River Group, Inc.
4500 Park Glen Road, Ste. 120
Minneapolis, MN 55416
952-230-6488
jolejnik@assurityriver.com
www.assurityriver.com