Explore This Section

SRC Insights: Second Quarter 2008

Pandemic Preparation: Is Your Institution Ready?

According to the Center for Public Health Preparedness, 2007 was the most active flu season in many years.1 As they do each year, influenza virologists will convene this summer to determine the formula for next year's flu vaccine, although the U.S. Centers for Disease Control and Prevention notes that the existing flu vaccine is only effective in fighting one of the three strains of influenza that are currently circulating in the United States.2 There have been concerns in recent years regarding the possibility of a pandemic, since several pandemics have occurred throughout history, and experts predict that we will experience at least one pandemic outbreak in this century.3 While there is currently no certain threat of such a pandemic, it is important to institute a pandemic plan and prepare your institution for potential disruptions.

A pandemic is defined as a global disease outbreak, and an influenza pandemic occurs when a new influenza "A" virus emerges-for which there is little or no immunity in the human population-and begins to cause serious illness and to spread easily from person to person.4 Back in November 2005, the U.S. government issued its National Strategy for Pandemic Influenza to address the potential of a pandemic influenza outbreak.5 And in February 2008, the Federal Financial Institutions Examination Council (FFIEC) issued its Interagency Statement on Pandemic Planning, which identifies the actions that should be taken by financial institutions to lessen the adverse outcome of a pandemic.6 The statement expands upon the Interagency Advisory on Influenza Pandemic Preparedness issued in March 2006, wherein FFIEC agencies, in a joint effort, reminded financial institutions of the importance of addressing pandemics within their business continuity plans.7

How Is Pandemic Planning Different from Business Continuity Planning?
Business continuity planning is based on the various degrees of difficulty caused by the potential outcome of natural and technical disasters, as well as deliberately harmful acts. Traditional business continuity planning develops responses suitable for disasters limited in duration and intensity. Most incidents that would prompt the activation of a business continuity plan would be confined to a particular region, physical structure, or network of related data or transmission devices. The severity of such incidents can be successfully minimized through effective recovery efforts.

Pandemics, on the other hand, pose distinctive challenges for financial institutions. Unlike natural and technical disasters, the duration and overall impact of a pandemic are unpredictable. The very nature of operating in a global economy heightens the possibility of effects involving a wide geographical area and an unknown duration, as pandemics generally occur in multiple waves, each lasting two to three months. In addition, unlike other disasters, a pandemic outbreak would likely have an enormous impact on staffing levels for prolonged periods of time. While no organization is protected from the inauspicious effects of a pandemic, financial institutions must plan for the unique circumstances that may arise. During business continuity planning, financial institutions must consider and address the complexities associated with a pandemic because so many of the services offered by financial institutions are critical to the local and national infrastructure.

What Are The Fundamentals of Pandemic Planning?
According to FFIEC guidance and the Federal Reserve's subsequent SR Letter 07-18, FFIEC Guidance on Pandemic Planning, issued on December 12, 2007, a financial institution's business continuity plan should include the following:8

  • A preventative program, which should establish controls in the workplace that are strengthened during the influenza season and may consist of off-site working arrangements for the ill or processes to reduce the transmission of infection, through hygiene tools and staff awareness.
  • A documented strategy, which should provide for flexibility and be commensurate with the size, complexity, and activities of the institution. The strategy should outline the potential impact of a pandemic at various stages and include procedures for preparation and recovery.
  • A comprehensive framework, which should establish contingency systems designed to maintain critical operations and services during significant periods of employee absenteeism. Facilities, systems, resources, and procedures necessary for the continuance of critical functions should be addressed and incorporated into an evolving risk assessment process. In addition, customer reaction and demand for electronic services should be considered.
  • A testing program, which should provide for the overall effectiveness of the institution's pandemic planning and may include partnerships with members of various private or government sectors for support.
  • An oversight program, which should ensure an ongoing review process and essential updates based on governmental guidance and the institution's monitoring system.

The FFIEC guidance on business continuity planning (BCP) serves as an excellent resource for developing and maintaining a sound and comprehensive BCP plan.9 In addition, the FFIEC Business Continuity Planning Booklet has been updated to assist financial institutions with incorporating the elements of pandemic planning into an overall business continuity plan.

Who Is Responsible for Pandemic Planning?
It is important to note that, as with business continuity planning, all members of senior management within the organization who are involved in critical areas of operation, essential product lines, information technology, and human resources should be included in pandemic planning efforts. Senior management is charged with the development, internal communication, and regular testing of the pandemic plan. Ultimately, the board of directors is responsible for overseeing the actual development of the pandemic plan and should approve the written plan.

Financial institutions and their service providers alike should review the national strategy to better determine what actions may be most appropriate for them. Financial institutions with a global presence and those considered critical to the financial system may have greater preparation and response challenges. As with any unexpected event, a pandemic outbreak is a real possibility and potential menace to any financial institution. Benjamin Franklin coined the phrase "An ounce of prevention is worth a pound of cure." When it comes to pandemic preparation, the ounce of prevention is in the planning process; therefore, institutions and service providers should take the necessary measures to be prepared, should a pandemic outbreak occur.

Additional Resources
The Department of Homeland Security - Pandemic Influenza Preparedness, Response, and Recovery Guide for Critical Infrastructure and Key Resources.External Link

The Department of Health and Human Services Center for Disease Control - Interim Pre-Pandemic Planning Guidance: Community Strategy for Pandemic Influenza Mitigation.External Link

The Department of Health and Human Services External Link - checklists to help prepare for a pandemic across all segments of society, including state and local governments, U.S. businesses with overseas operations, the workplace, individuals and families, schools, the healthcare industry, and community organizations.

The views expressed in this article are those of the author and are not necessarily those of this Reserve Bank or the Federal Reserve System.