Business Continuity Tips to Prepare Your Financial Institution for COVID-19 and Pandemic Planning

As it relates to the recent coronavirus outbreak (COVID-19), pandemic planning is a current topic of discussion among financial institutions and financial services firms. COVID-19 was declared a pandemic by the World Health Organization (WHO)1.

Quick Highlights for Pandemic Planning
  • Implement your pandemic response plan and review your business continuity strategy.
  • Consider performing a high-level business continuity risk assessment.
  • Assess IT infrastructure and your potential capacity for virtual work and telecommunication.
  • Work with your HR department to update policies and procedures to accommodate changes in work arrangements.
  • Create and disseminate a communication plan to share important information with your employees.
  • Establish a pandemic response task force to actively monitor risk daily.

The Federal Financial Institutions Examination Council (FFIEC) recently provided updated guidance to help financial institutions proactively reduce the possible adverse impact of a pandemic. Pandemic preparedness must be an integral cornerstone of a financial institution’s business continuity framework and strategy. The updated FFIEC guidance provides guidelines and expectations for regulated institutions to follow in order to ensure their ability to continue critical business operations within a wide range of scenarios and with minimal business disruption2.

Pandemic Planning Objectives

In the event of a pandemic, employers must meet their health and safety obligations with respect to their employees and are likely to face significant employee absences. Regulators expect that their financial institutions will implement appropriate measures to ensure business continuity in the event of a pandemic. By its nature, it is impossible to predict the scale, duration and impact of a pandemic, but the expectation is to provide a framework that allows for flexible and agile responses.

A financial institution’s objective should be to define, document and implement a flexible, bank-wide pandemic plan to achieve the following in the event of a pandemic outbreak:

  • Reduce disease transmission among employees.
  • Protect employees identified as increased risk of flu-related complications.
  • Maintain critical business operations.

The business framework for a financial institution should consider two possible scenarios with respect to a pandemic:

  • Pandemic with normal levels of employee absence.
  • Pandemic with severe or worst-case levels of employee absence.

At the forefront, as with other business continuity management practices, a task force should be formed and actively engaged in the daily execution and monitoring of the institution’s pandemic planning and response. This should not be viewed as an issue for just human resources (HR) or information technology (IT) departments; rather, as a significant risk to the entire business. The updated FFIEC guidance suggests cross-functional business support should be involved, including IT, HR, legal and product lines, among others that are important to your business.

A financial institution’s business continuity strategy should address pandemic impacts through reduced workforce planning with a need to review network and workforce capabilities for increased virtual work in the event of a contagious situation. The alignment of an institution’s pandemic strategy with its sick leave policy also encourages optimal employee behavior.

Business Continuity and Contingency Planning

Financial institutions should also consider performing a high-level business continuity risk assessment to identify the expected risk profile of the bank and to safeguard the proposed preventative and contingency activities are appropriate and proportionate to the risk at various pandemic intervals.

HR should evaluate and consider updating or implementing policies/guidance specific to a pandemic situation, for example: sick leave absences; flexible/remote working; absences for caring for sick relatives/children sent home from school; restricted business travel; etc.

HR should also take the lead on steps required to ensure employee awareness:

  • Guidelines on action to be taken if symptoms occur (including when to return to the office).
  • Guidelines on hygiene, cough etiquette, etc.
  • Prevention measures to prevent the spread of coronavirus or other illnesses within the workplace (e.g., enhancing awareness via posters and intranet communications, vaccinations, provision of hygiene supplies, regular cleaning of premises and equipment, specific consideration of additional measures for “at risk” employees, etc.).

Contingency planning should be a focus from the business continuity function and coordinated with the following objectives:

  • Identification of key processes and employees in each location/function leveraging the business impact analysis.
  • Planning for pandemic with normal levels of employee absence to define, document and implement contingency plan that reflects such levels of absence.
  • Planning for a severe pandemic to define, document and implement contingency plan that reflects severe or worstcase levels of employee absence. Absence levels should be based on those levels predicted by scientific modelling and published by government agencies.
  • Defining and determining communication strategy to be implemented in the event of a pandemic outbreak, including roles and responsibilities, and document within the overall contingency plan.
  • IT preparation to review existing provisions and take required actions to ensure adequate IT infrastructure to meet expected requirements in respect of telecommuting, video conferencing, etc.
  • Communication to employees about healthcare provisions in the event of pandemic outbreak.
  • Insurance policy review to determine whether additional coverage is required/desirable to mitigate risks associated with a pandemic.

Pandemic planning measures in the wake of the current COVID-19 outbreak should include a comprehensive assessment of all factors that could affect business continuity. Take measures to understand the dependencies of the business and the potential impact of their failure, identifying the risks associated with such failures and effective countermeasures for each one. Continuously review the dependency model, the risk and the adequacy and quality of those countermeasures. Task those charged with communication to provide transparency to senior management and board members on appropriate usage of organizational assets within the business continuity management framework.

Once the aforementioned strategies are addressed, financial institutions can begin to execute a formal program and structured approach to identify and mitigate risk and work toward resiliency and recovery during current or future pandemics. For more information on pandemic planning and response or improving your business continuity plans, reach out to us at

About DHG Financial Services

DHG Financial Services professionals provide you with in-depth industry knowledge and a wide range of advisory, assurance and tax services to address issues facing your industry in today’s challenging environment. For more information, visit


  1. Centers for Disease Control and Prevention,
  2. FFIEC Updated guidance, March 3, 2020.

Related Knowledge Share