Connect With NXTsoft Virtually As We Share Our Knowledge To Assist Financial Institutions!

NXTsoft's webinar series titled Pausing the Pandemic Panic: Ideas and Solutions for Financial Institutions in these Uncertain Times is designed for bank and credit unions to address topics that are affecting financial institutions in these uncertain times. 

Couldn't Join Us For The Live Webinar Recording? No Problem! Check Out The Webinar Recording and Transcript Below.

'An Overview of Pandemic Continuity Planning for Financial Institutions,' with Robert Horton, Chief Risk Officer at NXTsoft.

Today we discuss pandemics, pandemic preparedness, pandemic planned development. The quote on the first slide is from Theodore Roosevelt and it's appropriate at this time. You have to put all this stuff in a historical perspective to understand it. I'm going to start with a brief discussion on regulatory history of pandemic contingency planning. Joint guidance was issued in 2006 and 2008 concerning close calls with the SARS and MERS coronavirus. In addition, business continuity handbooks of 2003, '8 and '15 all contain more and more references to pandemic culminating with an entire index appendix in 2015 on pandemic planning and testing requirements.

In 2019 the appendix was reviewed, was removed and pandemic planning de-emphasized. After the onset of the newest pandemic joint guidance in the form of FIL 14-2020 was issued reasserting and redoing all previous guidance. The new BCM handbook, although there is no separate appendix on pandemics, the concepts remain the same with an emphasis on business impact analysis and risk assessment. The latest guidance was issued after the pandemic had begun and it was a call to reexamine your pandemic planning practices.

The most frequently asked question is always, "Do I have to have a written pandemic plan?" Of course the answer is "yes," along with documentation that is still part of many examination request lists such as the pandemic policy, pandemic test methodology test results, pandemic training and the plan itself. Frequently the emphasis will be on the BIA and risk assessment documentation, the testing documentation and the training and not the plan itself. This is the end of the regulatory history section of this presentation.

Next we'll move on to more historical pandemic information. This slide shows the conceptualized stages of a pandemic planning model. This is like any incidence response or other contingency planning models as far as the stages are concerned. This section starts with general and historical pandemic information overview where we will cover the risks associated with pandemic phase and pandemic preparedness process, some definitions and some other historical information.

In the general history of pandemics, pandemic viruses have always been around and will continue to post threats in the future. Pandemic risks generally run a continuum across several areas. This is an illustration of a risk continuum and it runs from low to high with risks associated with personnel, geography, mobility, infrastructure and business continuity. Currently we're at the high end of the continuum with impacts and in all these shown areas.

Prepared for the new FDIC and OCC Cybersecurity Regulations?This is the definition of a pandemic: it's a novel new virus strain, it's transmittable from person to person and it has wide geographical spread. Characteristics, these are the key points as far as characteristics of a pandemic they're all self explanatory. You can read through those at your leisure because you will receive a copy of this presentation after the presentation. Some social characteristics of the pandemic to consider when building your plan are listed on this slide. You have to think through these very carefully when you're putting your plan together. These are generally true statements but on occasion immunity is built up in older people from previous outbreaks of the same type of virus and the younger groups are more affected but in general these are people that are affected most. Here is the definition of a Corona 19 virus, it's a new virus, a new respiratory virus and the Corona virus or COVID-19 is the generally used name. It's actually named SARS-CoV-2.

Further points about this virus emphasized are on this slide and some additional information about how these types of viruses originate. Corona viruses are not new, they're constantly mutating. This current strain has eight mutations since December. The virus in Washington is a totally different virus strain than the one in New York City. One came to New York via Europe the one in Washington came to Washington via China and it's about three generations removed from the one in New York.

These are typical symptoms of any respiratory virus including the current Corona virus. Pandemics generally show a cluster of outbreaks around particular cities or countries, usually those are a logical reason. The reasons Northern Italy was hit so hard and they have so many deaths is China is buying up Italy. They own 70% of the factories in the historical textile and leather industry in Europe. They had direct flights from Wuhan the pandemic epicenter daily. One quarter of the residents in Italy are over 65 and 12% are over 75 and these people were at high risk from the virus. There were 300,000 Chinese workers in Northern Italy mostly from the Wuhan area of China and there's a lot of tourist activity in that region and tourists are virus spreading enablers. And the density of population in Prato Provence is very high and it's much higher than 678 in the larger provincial cities, in some areas up to 10,000 people per square mile.

This section gives historical perspective to past pandemics. Pandemic threats are nothing new but proper planning has been ignored for years. These are estimations from the CDC in 1999 and they are holding very true for this particular outbreak, somewhere between 89,000 to 207,000 deaths, 300 to 700,000 hospitalizations. This particular virus may do a little more damaged than the estimate in 1999. History always repeats itself and we seldom learn from it. These next several slides are meant to give you historical perspective on pandemics.

 Download NXTsoft's Pandemic Planning Readiness Self-Assessment ChecklistThe statistics for the 1918 pandemic are on the screen. These are from the national archives and they are illustrations of how it was during the 1918 pandemic. On the left it's policemen assembling in Philadelphia at shift change, the postal carrier in New York wearing a mask to deliver mail, street car conductors in San Francisco not allowing a man on the street car because he didn't have a mask, and a secretary in a business using a mask while she's typing. And we're experiencing all these types of constraints currently.

I put together some numbers for you on a chart, it shows the power of a pandemic. The 1918 pandemic killed more people than the civil war did and all the other wars combine. Historically social distancing is the vital control to reduce the transmission of respiratory viruses, it is not new. This is a tale of two cities, the pandemic in 1918 in Philadelphia and in St. Louis. It's illustrating what social distancing does and how the divergent the strategies were. Of note, it would be the health commissioner in St. Louis closed the churches and he was ridiculed extensively by the Catholic Church but they finally relented.

These are statistics for both Philadelphia and St. Louis and you will see the much greater death rate in Philadelphia who conducted a bond parade where 200,000 people attended during the height. And the commissioner and St. Louis limited meetings to 20 people, closed public gathering, et cetera, most of the same things that are happening now. This just shows, it comes from the National Archives also and just shows the Philadelphia war bond parade during the height of the pandemic. And another historical slide shows the statistics of the next major pandemic in 1957. This slide shows how it was spread and you'll notice it spread from central Asia, China to South Eastern Asia, to Australia, to Korea and to India, and from India it spread to Africa, and from Africa it spread to South America, and from Europe are spread in the United States. And there are two ways of this particular pandemic, this just illustrates the worldwide spread of the first wave.

Then we had the next pandemic was the Hong Kong flu in 1968 that was a new variation of the swine flu and it came in two ways and the total deaths in the United States during this pandemic in 1968 was 100,000. I was in high school at the time and I had it. It was pretty bad stuff, it closed my high school and everybody just set in place for about a week.

Then another pandemic we had is in 2009 and that resulted in a lot of the regulatory emphasis on pandemics after it happened and this pandemic was the swine flu and it was a re emergence of the H1N1 virus that was slightly different than the one in 1918 but it was new to most immune systems. In the pandemic of 2009 these are the statistics on the deaths. We had some close calls in the early 2,000's one was SARS which was a mutation of the Corona virus just as this one is and it was in 2003.

The other close calls was another Corona virus named MERS and it was also contained before there was as much of a wide worldwide spread. One thing to note on this one was a high death rate. Three to four out of 10 was the death rate and in some places in the Middle East it was over 50% of the people that got infected died. From a historical perspective history tells us expect things on this slide. This came from a 1999 CDC presentation, it's nothing new but it's what we're experiencing currently. This slide depicts risk factors that are driving the increased spread and the effects of pandemic type viruses, particularly this one.New call-to-actionThis section is meant to emphasize the rapid and efficient spread capabilities of a true pandemic. Everyone should understand the World Health Organizations's pandemic phases that's illustrated here. This is a situation updated in December with this current virus. Really no statistics just that it's being monitored. In this situation at day number two in February there's still very few confirmed cases in early February. As I pass through the situation updates over time you will see that they increase dramatically over time and watch the changes from early March where we have 105,000 cases to March 13th, March 20th, March 26. And look at the real difference between March 26th and Aprils 1st.

Rapid spread, this ends the section on the history of pandemics and starts the sections on pandemic planning. We'll start with a prevent stage of contingency preparedness and work through the others. Basic elements of any contingency plan for pandemics in the prevent phase are illustrated on this slide. You should also identify essential elements of the pandemic continuity capabilities found in these bullet points on the slide. These are some of the supporting components of any pandemic plan. During this pre planning phase, prevent planning phase you should determine your plan assumptions, critical process and function, and your critical human resource requirements.

Next you'll have to make decisions on who's going to be the plan coordinator, what's your testing methodology going to be, what triggers the activation of plan documentation you feel you need, particularly procedures, cross trained gaps and potential budgeting requirements such things as hand sanitizers, et cetera, et cetera. In the protect phase, we'll start with this slide which lists some basic contents of any contingency plan concerning that stage. You've got to define and test your remote telework capability, you've to know how you're going to test your plan, you've got to know how you plan to do your training and your risk management processes associated with pandemics and your human resources capital considerations.

The protect phase emphasis here is on training, remote work capability and potential absenteeism. Developing and verifying remote work capability is a key component of the pandemic contingency plan. Testing and training are another two key components of this plan. Defining your basic assumptions is the key are of the plan development these are listed, potentially listed assumptions of any pandemic plan. Documented risk management practices are another key component of building any pandemic contingency plan. On your human resources this slide centers on personnel and personnel requirements, roles and responsibilities, et cetera, et cetera. Always consider where you are on the occupational risks pyramid for your employees. Some occupations are a higher risk than others. In banking generally you're at the medium and lower exposure, you have some high frequency contact with the people like tellers and then you have some back office personnel who have very little contact with the general public.

This section discusses the response phase. In the response phase facilities, records management, documentation, access, communications, activation and other operational considerations are key. Again, pre defined strategies, communications, access to records and interdependencies are emphasized. This slide illustrates facility considerations that you might need to examine and this slide also continues with facility considerations.

Vital records and documents management, this may not be an area that everyone has to examine some people have electronic document systems that are accessed from all the branches other people do not they have centralized document management and may only be accessible from deposit alone operations so depending on your status you need to consider these. Communications are key in any pandemic plan and they're especially key to this particular type of contingency and these are some examples of things you have to consider. You always have to consider the key interdependencies of any contingency plan and especially pandemics. This section is about the recovery where you resume all operations. Typical scenarios of the recovery phrase portion of this plan are illustrated above. These are some of the additional operational considerations that you'll have to review. And these are even more additional tasks considerations in the recovery phase.

Prepared for the new FDIC and OCC Cybersecurity Regulations?

The next section is the lessons learned and followup. Lessons learned and follow up are important in any type of response plan. Incident response for instance is important. Anytime you exercise a contingency plan at the end of the contingency you have to see what went well, what didn't go well and move into the next phase which is the adjust the plan for use in the next pandemic or the next wave of the existing pandemic. In this section or in this phase you need to revise your policies and procedures and you get a lot of that information from your meetings during your lessons learned meetings.

What are your next steps? Well, you have to assemble your plan and as part of that you have to develop mission critical processes and functions lists, succession plans, essential personnel lists to fulfill those mission critical processes, supporting policies a plan that would be things like an overall pandemic policy, a testing policy, et cetera. You've got to develop a plan, you've got to develop test plans and methodologies, you've got to test the plan, develop training programs for employees and develop assessment and audit plans. You end up with this type of documentation and some others. These are all available from NXT Soft's VSSO product line and are part of their the pandemic planning toolkit.

This is a quote from a noted expert on plagues and diseases and pandemic, infectious diseases and pandemic viruses and sober reality today because even in 1994 when she won the Pulitizer prize a book on the coming plauge the general consensus was that it was going to take, it takes a while to develop a vaccine. And from that same book here's my ending though you can read that and if you want to read the book there's a copy of the first cover page of the book.

I have also added some additional regulatory references for those that want to do additional research and of course the controlling document at this time would be the BCM planning, examination handbook November 2019 and the FIL 14-2020 interagency statement on pandemic planning. Also in close there's some additional references on pandemics, you can find some good information on developing a plan in all these locations. That is the end of this webinar and you can send any questions you have to those addresses listed on this slide.