Pandemic Planning

CIA Conference June 29-30

Judy CameronDirector Legislation & Policy Initiatives – OSFI613 – 990-7337

2

Agenda• Background on regulators focus on BCP• Why pandemic concerns Canadian authorities• International responses to pandemic threat • What has OSFI done • What does OSFI look at?• Next steps

3

Background

• Heightened focus on BCP post Y2K and 9-11

• Some regulators issued specific guidance• Need for international collaboration:

– Importance of global financial sector – Increasing inter-dependencies within financial system

• Various international initiatives– Protocols for cross-border crisis communications– Basel principles expect banks to have contingency and

business continuity plans. – Joint Forum high level principles on BCP

4

BackgroundPrinciples for BCP

• Joint Forum principles focus on Business Continuity Management (BCM)

• Effective BCM includes– Business impact analysis to identify critical

services/activities– Recovery strategy – objectives for recovering critical

services– Business continuity plans to implement recovery

strategy

• Relevant for all financial sector participants and authorities Global principles for financial sector

• Common base of resilience across national boundaries

5

Background Principles for BCP

Joint Forum Principles (December 2005)1. Boards are responsible for effective BCM2. Organisations should explicitly consider & plan for

major operational disruptions3. Recovery objectives should reflect FIs’ risk to the

operation of the financial system.4. BCPs should address range of internal & external

communication issues5. Communication protocols should address cross-

border communication6. Business continuity plans should be tested to

assess effectiveness7. Financial authorities should assess BCMs as part

of supervisory reviews

6

Why pandemic concerns Canadian authorities

• Historical pattern - pandemics every 30 to 50 years (e.g. Spanish flu - 1918, Asian flu - 1957)

• Spread of H5N1 could lead to pandemic• As of June 06/06, 225 human cases with 128 deaths• Predominantly in SE Asia (also China and Middle East)• Characteristics of H5N1 similar to 1918 virus

– Fatality in the 15 – 40 age range • Experts believe a flu pandemic is inevitable• Potential for significant economic consequences

7

Why pandemic concerns Canadian Authorities

• Financial services critical to Canadian economy.

• Adverse impacts due to increased absenteeism, social

distraught, restrictions on travel and trade, etc. – 30 – 50% absenteeism could disrupt operation of critical

financial system functions (payments, clearing and settlement).

– Insurance exposure due to loss of revenue and increased claims

– Impact on economy leads to increased credit risk.

– Temporary increase in risk aversion. Could lead to high demand for liquidity.

8

Pandemic vs “typical” disruption• . Traditional BCP scenario Pandemic scenario

Single event (in one geographic area), comes as a surprise

Multiple waves over 6+ months

Widespread, comes in phases

Impacts:

•Likely main impact is IT and / or premises & facilities

•People may be generally unaffected

Impacts:

•IT and / or premises & facilities generally not affected

•Main impact is on people; magnitude hard to project

Risk Assessment:

•Full assessment possible – easier to invoke recovery plans

Risk Assessment:

•Full assessment not possible - impacts grow as more people are affected

9

Pandemic vs “typical” disruption• .

Traditional BCP scenario Pandemic scenario

Possible assumptions:

• Key people/alternatives available

• Back-ups (IT & premises / facilities) available

• Limited use of multiple worksites & work at home

•Outsourcers / suppliers generally not affected

Possible assumptions:

•Key people or alternatives may not be available, and some may never return

•Back-ups (IT, premises / facilities) cannot be used

•Extensive use of multiple worksites and work at home

•Outsourcers / suppliers may be affected

10

Pandemic vs “typical” disruption• .

Pandemic scenario

Unique Challenges:

• Management: succession over long horizon

• BIA: gradual, widespread, and changing impacts (services critical over long term), unknown reactions (e.g., anxiety)

• BCP / alternate sites: focus on continuity over longer term, difficulty to assess scope of problem, HR focus (safety, telework, distance communications), difficult to set recovery objectives

• Testing: scope of pandemic and associated costs

11

Global Regulatory Approaches

• Pandemic is a world-wide threat• Significant collaboration between

regulators through JF, IMF• IMF seminars - knowledge sharing with

less advanced countries• Regulators – various responses:

– UK – FSA is surveying preparedness of key firms– US – regulatory agencies are monitoring FI

preparedness, liaising w industry groups– HK – set out planning assumptions– Australia – may issue guidance

12

What has OSFI Done?Financial Institution Preparedness:• August 2005: high level BCP reviews, major FRFIs • February 2006: raise awareness with industry associations• February 2006: initiate desk-top review of pandemic plans of

11 major FRFIs • April 2006: pandemic letter to all FRFIs.

– Pandemic preparedness an area of increasing supervisory focus– Board/senior mgmt should:

• understand possible implications of a pandemic on operations and financial condition

• review the institution’s preparedness plans. • consider a pandemic scenario in financial stress tests

• May/June 2006: onsite review of selected FRFIs’ plans• Ongoing: discussions with industry associations and other

regulators

13

What has OSFI Done?OSFI Preparedness:• OSFI Internal “pandemic” working committee• Planning linked to triggers:

1) pre-pandemic 2) public report of inter-human transmission 3) affected person in NA/Canada 4) affected person in OSFI cities 5) illness of OSFI employee or family member 6) 20-40% of OSFI workforce affected 7) Second wave

• Items key to OSFI’s pandemic readiness– Governance and Decision-making Structure– Communications Strategy/Plan– HR/Employee Safety and employee concerns (safety is key!)– Maintaining Business Operations – OSFI’s Unique Role & Responsibilities

14

What is OSFI Looking For? • OSFI has not issued guidance/set deadlines• Review of big FRFIs’ plans vs. benchmark criteria: :

– Risk assessment – Planning strategies– Communications and Response plans– For lifecos – DCAT scenarios

• Expects plans will vary.

15

What is OSFI Looking For?

Risk Assessment Considerations

Has the FI:– Determined potential impact of pandemic on business– Conducted assessment that identified critical functions

and essential employees– Assessed risks associated with critical suppliers– Considered/tested a variety of scenarios considered

16

What is OSFI Looking For?

Planning Considerations

Has the FI:– Established a pandemic contingency project team– Developed business continuity plans (BCPs) that

consider pandemic scenario– Included authorities, triggers, and activation procedures in

BCPs • E.g. are the triggers linked to the WHO pandemic

stages of

17

What is OSFI Looking For?

Communication and Response

Does the FIs’ planning:– Establish command and communication structure– Implement HR / work environment procedures– Foster staff awareness– Develop communication strategy (to inform stakeholders

including regulatory authorities).

18

What is OSFI Looking For?

Stress Testing

Has the FI considered:– Impact of pandemic on claims experience.

• In particular, impact on claims, earnings, capital• Life insurance vs. annuities• Reinsurance• By region

– Scenario comparable to 1918 flu– Severity of scenario that would bring insurance company

to insolvency

19

Next steps• Increased supervisory focus.

– On-site meetings with 11 largest FIs re: planning gaps

– Monitoring pandemic plans based on benchmark review criteria

• Continued discussions with industry associations and international regulatory agencies

20

How to ward off Avian Flu