Business as usual?

Doug Johnson of the American Bankers Association discusses ways to approach business continuity. “It’s all about flexibility,” he says.

Financial services have always had to try and anticipate what future events might be. Of course, every now and then you will get an event you didn’t anticipate, such as 9/11 – it’s a shock, but you recover and you take those lessons, learn them and move on. The ability to come back from these events is what marks the strongest companies out from the rest.

I think we’re still learning how best to deal with unexpected events. For instance, one of the things we’ve been really focusing on over here at the American Bankers Association is how to deal with a pandemic such as avian flu. We’ve got some pretty good initial ideas of what kinds of things institutions need to do differently – such as practicing social distancing, putting in better hygiene practices, and other things that just make sense even during a regular flu season – but we’re also encouraging institutions to examine what their essential services actually are and consider how they’re going to provide those. What things are not so essential that you can afford to shut them down? Those are hard decisions for banks to make, and they can only be made on a case-by-case basis because every institution is different.

In this respect, business continuity is much more of a cultural process – it’s not like there’s a technological fix. Sure, there are technological enablers (telecommuting, for instance, is one of those) and you certainly have to consider issues such as whether you have enough capacity. But if you decide you don’t have sufficient capacity to run everything in the event of an unexpected event, that’s where the tough decisions come in – are there things you can do without, or do you have to get in extra capacity in order to run your business critical functions?

The key thing is that there’s an opportunity here. You may well have to make tough decisions about whether you need all your non-essential services, but the plus side is that you are more than likely to have some extremely talented people running those non-essential services that can be cross-trained to provide that extra capacity for your mission critical functions if and when you might need it. Unusual events can make everyone essential.

The human side is so important. We have a tendency to think that technology is the solution, but really it’s only an enabler. If you’re not looking after your employees properly, there’s no way that your employees can look after your customers properly, so business continuity is really all about ensuring that you have the proper plans in place to look after your people and give them the information and the tools they need to understand what’s going on, communicate effectively and talk to one another. You need to be able to test those plans to see how they work under pressure, and learn the lessons from those experiences.

There is also a role for the regulatory agencies in terms of establishing the level of regulatory flexibility that might be required during a pandemic or other unexpected event. What we saw during Katrina is that the banking regulatory agencies are doing a very good job at recognizing what banks can and cannot do during such events and are responding accordingly. They acknowledge the fact that banks should be able to give customers who’ve lost everything in a hurricane some sort of relief period if they haven’t paid on their account within 90 days, for example, and not be penalized from a regulatory standpoint because of that. Now is that appropriate for a pandemic scenario? Well, maybe it is, because a lot of people might have jobs where the simple fact of whether they get paid or not depends upon them actually turning up for work, and if they can’t work they might need that same kind of flexibility. It’s all about flexibility.