Financial institutions have long taken a leading role in developing sophisticated and complex business continuity programs that are designed to assist their critical operations to maintain or recover their functionality despite a potentially disruptive event. These plans have evolved over the past few years to also cover low probability but high impact events such as terrorist attacks, and to broaden their focus to also cover wide-scale disruptions that might affect an entire financial district or metropolitan area. Nevertheless, a number of financial institutions have recently become increasingly concerned that their current “all hazards” approach to business continuity planning may not be sufficient to address circumstances in which the organization must try to function during an outbreak of “avian flu” or another serious infectious disease.

A number of financial institutions with worldwide operations have already had to deal with the difficulties of maintaining staff and facilities in locations touched by the 2003 outbreak of Severe Acute Respiratory Syndrome (“SARS”). For many of these organizations, the 2003 experience showed that planning and preparation efforts could prove invaluable in providing their organizations with the ability to function effectively in an “avian flu” outbreak. Just as importantly, however, the SARS experience has convinced planners that, if a much more contagious outbreak does occur, it could present their organizations with difficult challenges that are unlike any in recent history:

• A serious “avian flu” outbreak could erupt in waves over weeks or even months, with some waves appearing to be mild only to be followed by others that are much more severe. Even after a particular wave appears to subside, follow-up waves could develop after safeguards are relaxed. As a result, business continuity plans that address discrete events that might affect organizations for limited time periods may prove inadequate for the longer-term impact of an “avian flu” outbreak.
• During an “avian flu” outbreak, organizations may have to deal with unprecedented absenteeism for weeks at a time, from illness, family demands or fear of contagion. Personnel absences may become so widespread that existing succession plans may prove inadequate to have sufficient personnel available to maintain even critical operations.
• An “avian flu” outbreak is likely to simultaneously affect multiple regions of the country and the globe. As a result, the backup facilities that have been established by many financial organizations – even remote sites hundreds of miles distant from primary facilities – may be just as affected by the outbreak as the primary locations they are intended to back up.
• Disruptions could spread to other key infrastructures, such as power, transportation, telecommunications, water systems – even police, fire, and emergency medical services. Moreover, basic retail services might also be disrupted. These types of problems might make it very difficult for employees to function effectively at work. Further, since corporate business continuity strategies often rely heavily on the availability of public sector emergency service providers, disruptions in these services from high absenteeism could present significant challenges to corporate plans.

Set forth below is a compilation of some of the key issues that some financial institutions have been seeking to address in their business continuity plans to respond to this potential threat. This list is neither all inclusive nor authoritative – instead, it is intended simply as an “issues spotting” exercise to help financial institutions’ efforts to prepare for a potential “avian flu” outbreak. As noted elsewhere, the issues identified below are generally equally relevant to preparations for a serious outbreak of any infectious disease, or, indeed, to any biologically based threat.*

Standard Business Continuity Issues

1. Identification of Critical Operations – Most business continuity plans identify critical operations that need to be constantly maintained or recovered within a few hours after an event, and identify other operations – activities such as payroll and administrative functions – that can be slated for longer recovery periods or even suspended completely during an emergency. An “avian flu” outbreak, however, could constitute an event that could last weeks or even months. As a result, disruptions in this second category of operations may severely compromise an organization’s ability to function if continuing wide-spread absenteeism is experienced among support staff for weeks on end. Accordingly, many organizations are reviewing their current business continuity plans to determine how they can better take into account the potential difficulties posed by an “avian flu” outbreak.

2. Identification of Suspended Operations – A corollary to the above item is the recognition among some organizations that they need to review their existing business continuity plans to identify activities or functions that should be suspended throughout the duration of even an extended outbreak. For example, some organizations plan to cancel any non-essential face-to-face meetings (internal or external).

3. Splitting and Segregating Staff and Office Quarantines – Some organizations are attempting to address the risk of a potential disruption to critical operations that might arise if even a single individual in a particular office, such as a firm’s trading floor, becomes ill with a highly contagious flu, raising the possibility that other employees in that office need to be quarantined. (FSSCC is aware that in some locations – such as Hong Kong and Singapore – local officials may have the authority to order a quarantine of a facility under these circumstances. FSSCC has no information that such measures would be put into effect in U.S. locations, but financial organizations must understand in advance the decision-making process governmental entities would use to address this question and how information about any such steps would be communicated to the public.)

In order to minimize this possibility, some organizations are considering plans to split their critical staff into two or more teams operating out of different locations. (Some firms implemented such plans at the time of the recent SARS outbreak.) For this to work, however, these teams need to remain segregated from each other throughout the height of an outbreak – planners recognize that it does no good to separate teams if they use common restrooms, eat in the same cafeteria or are periodically called to the same staff meetings. Even the sharing of printed (as opposed to electronic) documents between the groups should be minimized. This approach, therefore, involves potentially significant inefficiencies and costs.

4. Expanded Telecommuting – Many organizations recognize that vastly expanded telecommuting capabilities for employees might prove essential for improving the organization’s ability to maintain critical operations in these circumstances. Accordingly, many organizations are attempting to upgrade their automated systems and expand their training and administration programs to accommodate a sudden need to expand existing telecommuting programs.

Expanded telecommuting, of course, raises a number of issues in its own right:

• Upgrades to firms’ IT infrastructures to accommodate vastly expanded use of telecommuting may require substantial budget resources and weeks or months of advance planning.
• Expanded telecommuting from diverse locations using a wide range of devices and communication links may raise significant cyber security issues that must be addressed to minimize the chances that sensitive information might be compromised.
• In a severe “avian flu” outbreak, expanded use of online services by the general public may result in slow internet service that may interfere with telecommuting capabilities.
• Telecommuting may not be permitted for some functions, such as trading, that entail significant compliance issues or require substantial IT support. Even if these issues can be resolved, supervisory and record-keeping regulations may preclude telecommuting for these functions, and would have to be addressed.

5. Expanded Teleconferencing and Videoconferencing – Most contingency plans call for canceling all but the most essential face-to-face meetings with persons (both internal and external) during such an event. Accordingly, some organizations are seeking to vastly expand their ability to conduct teleconferences and video-conferences This sometimes includes establishing at least one “reservationless” teleconference number for the exclusive use of staff in each office or department so that its staff can more easily share critical information from home or other diverse locations.

6. Long-Distance Travel Limitations – Many organizations recognize that long-distance travel (particularly international travel) may be difficult if not impossible during a severe outbreak; an employee’s travel to areas where an outbreak has already occurred raises difficult issues regarding restrictions on the employee’s return to work (discussed below). As a result, even if an organization decides to refrain from canceling its own meetings under these circumstances, it may be forced to use teleconferences and videoconferences to conduct business that ordinarily would involve travel. In addition, organizations recognize that it may be difficult or impossible to send key staff to remote sites during a severe outbreak.

7. Local Transportation Issues – During the SARS outbreak, some organizations in Hong Kong made special arrangements so that their critical employees who needed to report in person to a facility would not unduly increase their risk of contagion by taking mass transit to and from work. Some U.S. organizations are developing plans to take similar measures during a future health emergency, particularly for an outbreak as contagious as influenza. These plans often include arranging for additional parking spaces at key facilities.

8. Security Issues – Because of the potential for police and other security services to be severely compromised because of a combination of absenteeism and heavy demands for area-wide security efforts, some organizations are planning to enhance in-house or contractor security services during an “avian flu” outbreak.

9. Information-Gathering Issues – In preparation for an “avian flu” outbreak, some organizations have determined that their senior management would need to have in place an automated system to keep track of how the event is affecting employees. For example, such a system could be used to provide management with up-to-date information on how many employees are absent (for whatever reason) or working from a location (home or an alternate facility) that is not customary for the employee. Any such automated systems generally would have to rely heavily on self-reporting by employees due to the possibility that staff members who normally perform routine payroll and administrative functions may themselves be unavailable to support such a system.

10. Phased Implementation Plans – Some organizations that have decided to develop specialized business continuity plans for an “avian flu” outbreak are structuring these plans to phase in escalating responses as developments warrant. For example, an organization might develop its own phase-in plan along the following lines.

• Phase One at a particular organization might be the current situation, with no outbreak. At that point, an organization’s efforts might be limited to planning and stockpiling some basic supplies.
• Phase Two might be when an epidemic is declared in a foreign location. Planning might be accelerated, briefings held for key staff, and travel to the affected jurisdiction might be curtailed.
• Phase Three might be declared internally when isolated outbreaks are confirmed in the U.S. Further measures, such as preparing for distributions of antiviral medication and temporarily splitting staff into teams operating from segregated locations, might be triggered.
• Phase Four might be declared internally when there is evidence that an outbreak is affecting the locations of the organization’s critical facilities, in which case the full array of the organization’s response measures might be employed.
• Phase Five might cover a period after the worst of an outbreak appears to have passed but worries of a follow-up wave of infection remain high. At that point, protective measures might be slowly relaxed and normal operations restored incrementally until a return to Phase One can be declared.

Other organizations have decided instead to have the phases in their plans coincide with alert programs that are being developed in locations in which the organizations’ facilities are located. In this regard, Hong Kong and Singapore currently have in place phased-in alert programs for a potential “avian flu” outbreak. While such alert programs are not yet common in the U.S., some firms contemplate having their own response measures tied to whatever alert programs are established either nationally by HHS or DHS or at the state or municipal level.

11. Testing – Testing is central to any effective business continuity management strategy. Many organizations realize, however, that comprehensive testing of response plans for an “avian flu” outbreak that could last for an extended period of time may be unrealistic. Accordingly, some firms are concentrating their tests on discrete portions of their response plans, such as the ability to handle high volume levels of the firms’ telecommuting or teleconferencing capabilities.

Education and Communication Issues

12. Human Resources Programs – Most business continuity plans recognize that organizations need to take into account the emotional toll of a catastrophic event on employees and their families. Some organizations are therefore reviewing their own human resources programs to determine if special efforts beyond internal communication protocols (discussed below) are needed to address the high degrees of fear and family worries that employees are going to have to deal with while trying to work during the weeks or months of an “avian flu” outbreak.

13. Education Programs – Some organizations are preparing their own education programs to clarify their policies during an “avian flu” outbreak and to use publicly available information to educate their employees on the need to take relatively simple precautions to limit exposure to a flu outbreak.

These educational programs include such items as:

• Common sense reminders on the importance of hand washing and cough/sneeze hygiene; the importance of healthy habits (e.g., getting plenty of rest and maintaining a healthy diet and exercise routine) to strengthen immune systems; the need to keep space between you and your coworkers (at least three feet according to HHS) and to avoid unnecessary gatherings to limit the risk of contagion.
• Reminders for employees at high risk (e.g., those with compromised immune systems) of the need to take special care. Firms are considering policies stressing the willingness of the organization to take reasonable measures to accommodate such persons during an “avian flu” outbreak.
• Advice on how to recognize the difference in symptoms between flu and a cold and, when known, between the relevant “avian flu” strain and annual flu (this is critical to avoid overreacting to symptoms of annual flu).
• Strong reminders on the importance of not reporting to work if you have reason to believe that you may be contagious.
• Guidance on policies for using earned sick leave, advance sick leave, administrative leave or leave without pay during a pandemic.
• Instructions on how to respond if a coworker becomes seriously ill at the office.
• Cites to websites (such as www.pandemicflu.gov) or other sources of the latest reliable information on an outbreak and health measures that should be taken to address the situation.

14. Communication Strategies – Most business continuity plans also recognize that effective communication strategies are essential to maintain employee morale and to inform external parties, such as regulators, customers, suppliers, counter-parties, and the public of the condition of the organization and measures that are being undertaken to address any potential disruptions in critical operations. Many organizations recognize that communication protocols and procedures may prove especially valuable in an event such as a severe “avian flu” outbreak that is likely to result in high levels of fear and stress. As a result, some firms are attempting to craft carefully worded statements that might be distributed via emails, press releases or postings on intranets or websites in the event of an “avian flu” outbreak. These precautions may prove especially valuable if high absenteeism among public affairs personnel during an event makes it difficult or impossible to compile such materials during a crisis.

15. Coordination with Local Emergency Management Organizations –Organizations are reviewing their processes for coordinating with emergency management organizations at the municipal and state level, recognizing that in a severe “avian flu” outbreak local authorities might be imposing quarantines and limiting crowd exposures by restricting public gatherings and use of mass transit. Similarly, organizations need to determine how they would respond if a locality issued a “Snow Day” declaration asking that businesses temporarily shut down to limit their employees’ exposure to the outbreak.

16. Communication with Other Organizations – Some organizations are reviewing their existing procedures to share crisis-related information with other businesses located within the affected area. These might include leveraging financial trade associations’ “crisis conference call” structures, and coordinating with regional groups, local chapters of the Association of Contingency Planners (ACP), local Chambers of Commerce, and local Health Coalition Groups. All of these information-sharing and coordination programs may prove invaluable during an “avian flu” outbreak.

17. Coordination with Service Providers and Suppliers – Organizations will also need to understand how their critical service providers and suppliers plan to respond to an outbreak. Discussions between organizations and their service providers should address how they will communicate during such an event and work around any disruptions that might take place. Organizations may wish to consider increasing the levels of critical supplies on hand if they learn that the “avian flu” strain has mutated and is easily communicable between humans.

18. Cross-Border Communications – An “avian flu” outbreak, if one were to occur, unquestionably would have an international aspect (and thereby, by definition, reach a “pandemic” stage). As a result, some financial sector organizations with operations in multiple jurisdictions are reviewing their procedures to consult with financial authorities in these jurisdictions to coordinate efforts to maintain the organizations’ operations at these non-U.S. locations. FSSCC understands that financial regulators in the U.S. are holding similar discussions with their counterparts in other countries.

Employee Health and Safety Issues

19. Medical or Other Health Care Expertise – Efforts to prepare for the potential of an “avian flu” outbreak will require access to reliable medical information. To address this need, some organizations have identified a medical expert (either in-house or on a consulting basis) who can assist. For example, this expert can provide insights into how to organize any in-house vaccination, medication distribution, disinfection or quarantine programs (see discussion below), as well as advice on the types of medical supplies that an organization might want to have on hand should an outbreak occur.

20. Reliable Information Sources for Developments – In the event an “avian flu” outbreak does occur, organizations would need to have reliable sources of accurate information on the latest medical developments. As a result, many business continuity officials are trying to familiarize themselves now with how to access more reliable information from sources such as the Centers for Disease Control and Prevention (“CDC”). The Federal government has established new website (www.pandemicflu.gov) to provide the public with additional information on these issues.

21. Vaccination and Medication Programs – In the event an “avian flu” outbreak does occur, vaccines for the strain involved in the particular outbreak are not likely to be available for some months. Nonetheless, some organizations are developing plans to operate or sponsor programs to provide vaccinations for their employees once such vaccines do become available (though such vaccines would not become available early enough to mitigate the need to develop alternative solutions to the business continuity issues resulting from the outbreak). Similarly, some organizations are planning for the possibility that they will need to operate or sponsor programs to provide their employees with medications (such as antiviral medications) that, if taken properly, might lessen the duration or severity of an employee’s illness. Such vaccination and medication distribution programs, of course, raise privacy issues that need to be taken into account in the planning.

22. Testing and Monitoring Programs – Some firms are contemplating establishing programs to routinely test employees for signs of infection during an outbreak (e.g., by monitoring temperatures using tools ranging from simple thermometers to expensive scanning devices to screen staff at facility entrances). Some firms are also developing procedures to require supervisors to report any instances in which a member of their staff is evidencing signs of an infection (such as coughing and sneezing). These testing and monitoring procedures, of course, may raise significant privacy and employee rights concerns; in addition, such procedures may be less useful during an “avian flu” outbreak in which employees could be highly contagious for several days before evidencing any symptoms.

23. Disinfection Programs – During the recent SARS outbreak, some firms in Hong Kong reportedly supplemented routine office cleaning programs with special disinfection procedures for certain common areas at their facilities. Some U.S. organizations are developing similar procedures for a potential “avian flu” outbreak.

24. Distribution of Hygiene Supplies – Some organizations are planning on distributing certain hygiene supplies throughout their offices during an “avian flu” outbreak. These supplies would include hand sanitizers, tissues, and special trash receptacles with hands-free lids.

25. In-House Health Units – Some organizations with in-house health units have taken measures to bolster their operations to handle not only influxes of ill employees but large numbers of the “worried well” who might overwhelm current capacity. In addition, some organizations have arranged for additional health care staff to serve as backups in case in-house health care professionals themselves become too ill to serve. Organizations that do not currently have an in-house health unit should consider establishing such a unit temporarily in the event of a pandemic. Alternatively, having a nurse on-site would be beneficial. Whatever course of action is chosen – enhancing existing units or establishing other arrangements –must be implemented beforehand.

26. Other Emergency Care and Office-Isolation Issues – Some organizations are also developing procedures to address situations in which employees report to work feeling fine but suddenly become severely ill, potentially contaminating other personnel (e.g., employees trying to provide assistance to a stricken coworker) as well as areas in which they have become ill. Some organizations’ plans call for encouraging employees to volunteer to be trained and equipped (with masks, gowns, gloves, etc.) to assist in handling these situations. (Employees who have already been ill with the virus and have recovered are likely to have a degree of immunity to it and be available to act in a volunteer capacity; these employees also, due to their likely immunity, may be optimal replacement employees for areas experiencing high absenteeism rates.)

Some organizations are also attempting to obtain a supply of emergency care supplies to be better prepared to set up their own on-site emergency care sites if needed. They are also developing procedures to assist staff who may have been inadvertently contaminated by an ill employee (for example, advising staff to immediately take whatever measures that they can to remove or clean contaminated clothing, thoroughly clean themselves, or providing available antiviral medications). Organizations are also developing procedures to temporarily isolate any offices or other areas that may have been contaminated until they can be thoroughly cleaned and disinfected.

27. Travel and Meeting Restrictions and Self-Quarantine Issues – Almost every response plan for a biological incident incorporates some restrictions on personnel traveling to areas experiencing an outbreak and further restrictions on when travelers would be permitted to return to a work facility. For example, during the SARS outbreak in Hong Kong, many firms required personnel who had visited designated areas to remain out of the office for at least ten days after they returned. Many firms then required these travelers to check in with a health unit or private physician before being allowed back into the office. Some U.S. organizations are adopting similar programs in their current planning efforts. Such travel restriction and self-quarantine programs must take into account several difficult legal issues (e.g., can such “self quarantines” be required of employees who travel to areas with severe outbreaks for personal or family reasons).

28. Authority to Isolate and Remove Potentially Contagious Employees – Some organizations are struggling with similarly difficult issues concerning their authority to direct potentially contagious employees to remove themselves from facilities and from contact with other personnel.

Administrative Matters

29. Budget and Administrative Issues – A number of the issues discussed throughout this document have significant budget or administrative implications. For example, stockpiling some types of supplies that might prove essential – but scarce – during an actual “avian flu” outbreak would need to be budgeted for. In addition, advancing sick or administrative leave for large numbers of personnel involve both budget and administrative programs. Some organizations believe that work in this area now may prove extremely useful, particularly if key staff members who specialize in these programs are themselves unavailable during an “avian flu” outbreak.

30. Legal Issues – Many organizations recognize that their legal staffs would need to carefully scrutinize business continuity and employee safety arrangements implemented to address issues associated with an “avian flu” outbreak. For example, legal staffs will need to consider potential liability issues for in-house vaccination or medication distribution programs, as well as for any harm experienced or caused by in-house volunteers. In addition, these programs, as well as procedures for self-quarantine and other policies, would need to be reviewed for compliance with personnel and privacy laws and regulations. Legal staffs should also consider the implications of administrative decisions the organization intends to take regarding the application of its policies on sick leave, leave without pay and similar issues.

31. Documentation – Most financial organizations have already documented their business continuity plans. Most of these plans, however, are usually structured as “all hazards” documents designed to address impacts on critical operations without unduly focusing on single threats such as fires, floods or terrorist acts, and may not be adequate to address some of the unique challenges posed by an “avian flu” outbreak. As a result, some organizations are attempting to document their additional plans for such an outbreak. This work may prove especially valuable in the event that the organization’s business continuity managers become incapacitated at the onset of an outbreak.

* In preparing this paper, FSSCC has generally sought to refrain from using certain terms perceived as having alarming connotations for persons who are not medical professionals, to avoid contributing to the already alarming tone of the national discussion of this issue. Nonetheless, financial services professionals should be familiar with the distinction between an “epidemic” – a sudden outbreak of a disease in a given community or region affecting more than the expected number of people at a given time – and a “pandemic” – an epidemic that becomes very widespread, affecting multiple regions, a continent or the whole globe. In light of the frequency of international travel and for other reasons, it is believed likely that an “avian flu” outbreak would escalate quickly into a “pandemic” – a global outbreak of the disease.