Is Your CU Ready for a Pandemic?

Valerie Moss, CUNA’s director of compliance information
July 8, 2009 | COMMENTS

Credit unions can experience a disruption in operations anytime, ranging in severity from a short-term power outage to a severe weather-related event such as tornado or flood. A disruption also may come from an infectious disease outbreak, such as the swine influenza (H1N1) virus, affecting credit union employees.

The National Credit Union Administration (NCUA) expects federally insured credit unions' business continuity plans to address all types of risks, including a pandemic and its potential impact on service delivery to members.

Each credit union's board of directors is responsible for overseeing development of a pandemic plan and must approve the written plan. Senior management, however, must develop the plan and translate it into policies, processes, and procedures.

Pandemic planning should involve senior management from all areas of the credit union, including administration, human resources, legal, information technology, and key product lines. Senior management must communicate the plan to staff and regularly test it to ensure it will respond effectively to a pandemic event.

Preparedness plan

A credit union's pandemic preparedness/business continuity plan should provide for:

1. Prevention. Develop a preventative program to reduce the likelihood a pandemic will affect your operations significantly, including:

• Monitor potential outbreaks.
• Educate employees about potential outbreaks and the credit union's pandemic preparedness plan.
• Communicate and coordinate with service providers and suppliers, and consider potential alternatives.
• Provide hygiene training and tools (gloves, masks, hand sanitizers, and so on) to employees.

2. A scaled response. Have a documented strategy for scaling efforts so they're consistent with pandemic stages, such as first cases of a virus overseas, first cases in the U.S. , and first cases within the credit union. Your response to an overseas threat will differ from cases closer to home.

Communicate to employees and key service providers the actions the credit union plans to take at specific triggering points. The strategy also must address how the credit union plans to recover from a pandemic wave, as well as prepare for subsequent waves. This is no easy task, because it's hard to predict how long each wave may last.

3. Maintenance of critical operations. Have a comprehensive framework of facilities, systems, or procedures allowing the credit union to continue critical operations if large numbers of staff can't work for prolonged periods. Management also should consider how actions by public health and other government authorities may affect operations (for example, a mandatory quarantine).

Consider using “social distancing” techniques to minimize face-to-face contact: telecommuting, drive-up windows, ATMs, online and telephone services, or alternative operations sites.

There may be a high reliance on telecommuting, so credit unions should assess remote access capabilities to ensure work-at-home strategies will function during a pandemic. Also, make sure employees know each others' job functions and that succession plans are up-to-date. Inform members of any changes that would affect their interaction with credit union staff.

4. Testing. Implement a testing program to ensure your planning practices and capabilities will be effective and allow critical operations to continue. Testing for a pandemic may differ from other disaster preparedness drills.

Pandemic plan testing may include “work from home” days to test remote access capabilities, crisis management team communication (call-tree) exercises, or testing scenarios related to increased absenteeism rates. Don't forget to include key service providers and suppliers when developing scenarios.

Also consider taking part in community, regional, or industry-wide exercises with members of the financial services sector. Management should update the pandemic plan based on test results and new risk mitigation approaches. Update the testing program to reflect changes in your operations, processes, or procedures.

5. Oversight. Recognize that developing a pandemic plan is a continuing process, not a one-time event. The credit union must have an oversight program to ensure regular review and updates (at least annually) to the pandemic plan so policies and procedures reflect up-to-date risk mitigation techniques.

No organization is likely to escape the effects of a pandemic should one occur. Check your disaster recovery/business continuity plans now to make sure your credit union is adequately prepared.

Reprinted with permission from Credit Union Magazine.