Community Banking Connections

Print Article

Disaster Recovery Planning: Key Strategies in Navigating the Unknown
by Jennifer R. Grier, Senior Examiner, Supervision, Regulation, and Credit, Federal Reserve Bank of Atlanta

Hurricanes. Cyberattacks. Pandemics. Wildfires. Whether resulting from natural causes or human intervention, all these events pose the potential risk of significantly disrupting a community bank’s normal operations. Unfortunately, there is no fail-proof predictor of when or if a disaster event will occur at any given time. Therefore, it is important that bank management be proactive in developing a comprehensive disaster recovery and business continuity plan (BCP) to mitigate the uncertainty of these risks.

The occurrence and severity of natural disasters have increased significantly over the past decade. Between 2010 and 2019, the United States experienced almost twice the number of billion-dollar natural disasters than in the 2000s, at 119 and 62, respectively.¹ During 2020, the United States was impacted by 16 separate billion-dollar disasters (see Figure 1): one drought event, 11 severe storms, three tropical cyclone² events, and one wildfire³ event. As of October 7, 2020, the 16 weather/climate disaster events resulted in losses exceeding $1 billion in the United States.⁴

In addition to natural disasters, banks are also the frequent target of cybersecurity threats, such as malware and distributed denial-of-service attacks. Reportedly, banks and financial services organizations represented 25.7 percent of all malware attacks in 2018.⁵

Whether or not a bank can quickly resume operations after a disaster can have a lasting effect on its brand. From a macro perspective, a bank’s quick recovery can also serve as a positive sign of resilience for the local community. Not surprisingly, preparation is the key distinguishing characteristic of those banks that have been able to demonstrate agility and resilience during a crisis. These banks developed a disaster recovery plan with the intention of minimizing disruptions to both the bank and its customers.

Business Continuity Plan

A thoroughly tested BCP provides bank management with the appropriate framework for decision-making in the midst of a crisis. Lessons learned from previous disasters, such as Hurricane Katrina in 2005 and Superstorm Sandy in 2012, have highlighted why banks should develop a BCP that defines how to respond to and recover from business disruptions. The goal is to review all of the possible disruptions that could occur and then identify the appropriate mitigant for each risk.⁶

For most banks, the planning process to develop an effective BCP will require multiple iterations. As outlined in the 2015 Community Banking Connections article “Business Resumption Planning for Banks,”⁷ an effective business continuity program has four key components: (1) business impact analysis, (2) risk assessment, (3) risk management, and (4) monitoring and testing.⁸ Additionally, if the bank uses outside vendors for key bank functions, there should be a discussion of the potential third-party risk.⁹

Pandemic Planning

Until recently, most banks developed BCPs that primarily focused on recovery strategies for cyberattacks and natural disasters most prevalent in their respective markets. However, the COVID-19¹⁰ global pandemic has heightened the awareness and need for all banks, regardless of asset size and complexity, to incorporate pandemics in their BCPs.

On March 10, 2020, the Federal Financial Institutions Examination Council (FFIEC)¹¹ issued updated guidance identifying actions that financial institutions should take to minimize the potential adverse effects of a pandemic. Supervision and Regulation (SR) letter 20-3/Community Affairs (CA) letter 20-2, “Interagency Statement on Pandemic Planning,”¹² encourages financial institutions to periodically review related risk management plans, including BCPs, and ensure that an institution is able to continually deliver products and services in a wide range of scenarios with minimal disruption (see Addressing the Unique Challenges of Pandemics box).¹³

Unique Characteristics of Pandemic Planning

Pandemic planning presents a unique challenge for financial institutions because there are more unknown factors to consider than in plans for recovery from a natural disaster or a business disruption. For example, the planning process should consider the difference in anticipated scale and duration of the bank’s operational disruption, as the disaster event may be more widespread, limiting public and commercial services in the bank’s community. Furthermore, unlike traditional disasters that have limited time durations, previous pandemics have been characterized by waves of activity spread over several months (see Figures 2 and 3).¹⁴

The ramifications of a pandemic are far-reaching and encompass many disparate issues, including health and economic concerns. A severe pandemic could lead to extensive illness, loss of business productivity, and disruption or closure of school systems. For example, during the 2006 avian flu outbreak in Southeast Asia, the U.S. pandemic plan recommended that the public and private sectors assume that up to 40 percent of their staff might have been unable to report to work for two weeks because of personal or family sickness.¹⁵ The potential lack of vital staff to deliver an institution’s critical financial services (i.e., operational resiliency) and to maintain its infrastructure (i.e., technology and cybersecurity risks) should be incorporated into the ongoing business impact analysis and risk assessment processes. Thus far in the COVID-19 pandemic, financial institutions have generally demonstrated operational resilience related to cybersecurity and technology risks. However, institutions need to remain vigilant by considering the probability of additional service disruptions and update their BCPs accordingly.

Addressing the Unique Challenges of Pandemics

SR letter 20-3/CA letter 20-2 suggests that a financial institution’s BCP address five elements:

1. A preventive program
2. A documented strategy that provides for scaling the institution’s pandemic efforts
3. A comprehensive framework of facilities, systems, or procedures
4. A testing program
5. An oversight program to ensure ongoing review and updates to the pandemic plan

See the full text at www.federalreserve.gov/supervisionreg/srletters/SR2003a1.pdf.

Conclusion

The increasing occurrence and severity of natural disasters and other business disruptions have heightened the potential risk to community banks. Based on lessons learned from previous disasters, a bank should consider using an organization-wide approach in developing a BCP to ensure that the institution’s board of directors and senior management are aware of their respective roles in limiting disruptions to the bank’s operations and services to its customers. In addition, the bank’s BCP should address a pandemic event and provide for an appropriate operational response, a documented strategy scaled to the stages of a pandemic outbreak, a comprehensive framework to ensure the continuance of critical operations, and a testing program to ensure that the BCP is effective in recovering critical operations. To confirm the adequacy of the planning process and the execution of the plan, the BCP should identify roles and responsibilities for overseeing business continuity during a disaster, including periodic review and updating of the plan to reflect actual experience in recovering from a disaster.