According to the Center for Public Health Preparedness, 2007 was the most active flu season in many years.1 As they do each year, influenza virologists will convene this summer to determine the formula for next year's flu vaccine, although the U.S. Centers for Disease Control and Prevention notes that the existing flu vaccine is only effective in fighting one of the three strains of influenza that are currently circulating in the United States.2 There have been concerns in recent years regarding the possibility of a pandemic, since several pandemics have occurred throughout history, and experts predict that we will experience at least one pandemic outbreak in this century.3 While there is currently no certain threat of such a pandemic, it is important to institute a pandemic plan and prepare your institution for potential disruptions.
A pandemic is defined as a global disease outbreak, and an influenza pandemic occurs when a new influenza "A" virus emerges-for which there is little or no immunity in the human population-and begins to cause serious illness and to spread easily from person to person.4 Back in November 2005, the U.S. government issued its National Strategy for Pandemic Influenza to address the potential of a pandemic influenza outbreak.5 And in February 2008, the Federal Financial Institutions Examination Council (FFIEC) issued its Interagency Statement on Pandemic Planning, which identifies the actions that should be taken by financial institutions to lessen the adverse outcome of a pandemic.6 The statement expands upon the Interagency Advisory on Influenza Pandemic Preparedness issued in March 2006, wherein FFIEC agencies, in a joint effort, reminded financial institutions of the importance of addressing pandemics within their business continuity plans.7
How Is Pandemic Planning Different from Business Continuity Planning?
Business continuity planning is based on the various degrees of difficulty caused by the potential outcome of natural and technical disasters, as well as deliberately harmful acts. Traditional business continuity planning develops responses suitable for disasters limited in duration and intensity. Most incidents that would prompt the activation of a business continuity plan would be confined to a particular region, physical structure, or network of related data or transmission devices. The severity of such incidents can be successfully minimized through effective recovery efforts.
Pandemics, on the other hand, pose distinctive challenges for financial institutions. Unlike natural and technical disasters, the duration and overall impact of a pandemic are unpredictable. The very nature of operating in a global economy heightens the possibility of effects involving a wide geographical area and an unknown duration, as pandemics generally occur in multiple waves, each lasting two to three months. In addition, unlike other disasters, a pandemic outbreak would likely have an enormous impact on staffing levels for prolonged periods of time. While no organization is protected from the inauspicious effects of a pandemic, financial institutions must plan for the unique circumstances that may arise. During business continuity planning, financial institutions must consider and address the complexities associated with a pandemic because so many of the services offered by financial institutions are critical to the local and national infrastructure.
What Are The Fundamentals of Pandemic Planning?
According to FFIEC guidance and the Federal Reserve's subsequent SR Letter 07-18, FFIEC Guidance on Pandemic Planning, issued on December 12, 2007, a financial institution's business continuity plan should include the following:8
The FFIEC guidance on business continuity planning (BCP) serves as an excellent resource for developing and maintaining a sound and comprehensive BCP plan.9 In addition, the FFIEC Business Continuity Planning Booklet has been updated to assist financial institutions with incorporating the elements of pandemic planning into an overall business continuity plan.
Who Is Responsible for Pandemic Planning?
It is important to note that, as with business continuity planning, all members of senior management within the organization who are involved in critical areas of operation, essential product lines, information technology, and human resources should be included in pandemic planning efforts. Senior management is charged with the development, internal communication, and regular testing of the pandemic plan. Ultimately, the board of directors is responsible for overseeing the actual development of the pandemic plan and should approve the written plan.
Financial institutions and their service providers alike should review the national strategy to better determine what actions may be most appropriate for them. Financial institutions with a global presence and those considered critical to the financial system may have greater preparation and response challenges. As with any unexpected event, a pandemic outbreak is a real possibility and potential menace to any financial institution. Benjamin Franklin coined the phrase "An ounce of prevention is worth a pound of cure." When it comes to pandemic preparation, the ounce of prevention is in the planning process; therefore, institutions and service providers should take the necessary measures to be prepared, should a pandemic outbreak occur.