Experts agree that it’s not a matter of if coronavirus is going to impact your business—it’s a matter of when. As COVID-19 spreads across the country at an alarming pace, creating panic, quarantines, and serious health risks, it’s important to make sure your financial institution is doing everything it can to limit the risks the virus poses.
The Federal Financial Institutions Examination Council (FFIEC) issued pandemic planning guidance last week reminding FIs that business continuity plans (BCPs) should address the threat of a pandemic outbreak to critical services. This plan should include a:
- Prevention program
- Documented strategy scaled to the stages of a pandemic outbreak,
- Comprehensive framework to ensure the continuance of critical operations,
- Testing program
- Oversight program to ensure that the plan is reviewed and updated.
The plan should be flexible due to the wide range of possible effects, the FFIEC notes.
In addition to an FI’s internal plan, the FFIEC emphasized the importance of vendor management. Communicating and coordinating with third parties, especially critical vendors, is essential to minimizing the risk of pandemic-related business disruptions.
A good pandemic plan requires checking in with critical vendors to ensure they’ll be able to deliver the products and services needed to maintain critical operations. FIs need to assess the risk that a vendor won’t be able to perform and make alternate arrangements to mitigate that risk if there are concerns.
Are your vendors prepared for a pandemic? Find out by asking these 10 questions:
-
When was the last time you updated and tested your BCP and do you have a pandemic plan?
Review your vendor’s BCP plan and the results of any testing to assess the strength of the plan. Compare its pandemic preparedness to the Centers for Disease Control and Prevention (CDC) checklist for business pandemic planning. Note any weaknesses and determine if they’re likely to impact the vendor’s pandemic response. If you suspect your vendor isn’t prepared, begin thinking about how to mitigate the risk of vendor non-performance, including alternate providers.
-
What are you doing to monitor the situation?
COVID-19 is a dynamic threat. It’s newly discovered and much is unknown, so responses are based on the most current information (quarantine times, death rate, how it spreads). It’s impacting different parts of the countries at different rates with some areas, like Washington state, in the middle of a large outbreak. And unlike an earthquake or cyber breach, coronavirus isn’t an event that hits once and is over. Viruses often come in waves with a series of outbreaks over time, as demonstrated by the 1918 Spanish flu.
Find out what your vendors are doing to stay on top of the latest updates and where they are getting their information. It’s possible they may need to change their coronavirus responses when new information emerges. They should have a process in place for adjusting their preparedness and response plan if needed.
-
How will you communicate ongoing updates?
The coronavirus has created a dynamic environment where sudden closures are common. How will your vendor inform you of any important updates? Who is your point person for questions?
-
What are you doing to limit the spread of coronavirus among employees?
Coronavirus is highly contagious, making preventative measures essential to maintaining a healthy workforce. Is your vendor following CDC recommendations? Promoting best practices for handwashing and covering coughs? Staggering work hours or encourage employees to work from home? Are they encouraging self-quarantine for the sick, offering sick leave policies that encourage ill employees to stay home? How are they handling travel? What health resources are they providing to employees?
-
How will you continue to provide services in the event of large-scale employee absenteeism?
Is the vendor equipped and have experience allowing its employees to work remotely? How will they be able to fill your needs with a remote workforce? Are employees cross-trained to fill in key roles if needed? Have these accommodations been tested?
-
What if you are unable to use one or more offices or sites?
A whole company may not have to close, but it may have to shutter a site in the event a geographic area experiences a high infection rate. Does the vendor have backup sites, especially data centers, that are geographically dispersed? How strong is the staffing at these sites? What’s the process for shutting down a site?
-
Will this delay the delivery of new products, services or updates?
If you’re heavily invested in a new initiative, it’s important to ask if it’s likely these products, services or updates will be delayed by the coronavirus. This can impact your financial projections, marketing initiatives, and strategic goals.
-
Are your critical third-party vendors prepared?
Your vendor may have strong pandemic planning, but if its vendors aren’t prepared, there could still be issues. Find out what your vendor is doing to oversee its own vendors’ pandemic preparations and how strong those plans are.
-
Are you financially prepared to weather coronavirus?
A major disruption can be expensive and cause financial distress, especially for startups and other young companies. Great pandemic planning won’t save a company if it doesn’t have the funds to support it.
-
Is your supply chain secure?
Does your ATM provider have a ready supply of replacement parts? Does your office supply provider have ready access to print toner? What about soap and hand sanitizer? Will you be able to get more cards for in-branch issuance of debit and credit cards? On-demand inventory has grown in popularity, but it may mean that supply disruptions are possible if vendors sell out of stock and are unable to get more.
Read also: 4 Reasons to Add Cyber Monitoring to Your Vendor Management Program
Don’t worry about a potential pandemic—prepare for it. Join Ncontracts’ Michael Berman and the American Bankers Association on 18, March 2020, for the webinar, Managing Coronavirus Operational Risk Department-by-Department: What You Need to Do Today.
Learn More Here: Business Continuity Resources
Subscribe to the Nsight Blog
Share this
Does Your BCP Have a BCP?
How Have Critical Vendors Performed During the COVID-19 Pandemic?
