Compliance Blog

Greetings all, and welcome to the height of flu season.

According to a Weather Channel report, several schools in the U.S., and in some cases entire districts, have canceled classes this week due to a high percentage of students sick with the flu and other seasonal illnesses. While not a worldwide pandemic, local and regional flu outbreaks are risks to more than just schools and neighborhoods. Credit unions can be greatly affected by the outbreak of illness among staff and members. This blog serves to provide all our compliance friends with information on pandemic preparedness and remind you of the importance in having an updated business continuity plan.

NCUA explained in Letter to Credit Unions 01-CU-21, that a credit union’s contingency plans should consider the worst case scenario. Additionally, the board of directors and senior management should set procedures to ensure the plan’s success. A credit union’s contingency or business continuity plan should account for the operation of critical systems and anticipate where the greatest need would be if the credit union lost access to employees, resources, or systems. NCUA gives some insight as to how credit unions can establish a minimum acceptable service level based on the type of emergency faced:

“In evaluating minimum levels, credit unions should consider:

• Minimum number of employees required;
• Ability to bring in outside human resources;
• Amount of service or system down time before it will affect membership or reputation;  
• Regulatory requirements;
• Affect on other businesses (business checking accounts, line of credit advances, cash needs, etc.);
• Vendor and outside source list including their address, phone number, and contact person (service bureau, online banking provider, security company, power company, etc.);
• List of current systems and equipment including model number, version and manufacturer with address, phone number, and contact person;
• Other resources - credit union or personal cell phones, pagers, etc.;
• Legal and liability issues;
• Security; and
• Costs vs. benefits – cost, however, should not be the overriding factor in developing a good plan.”

To further assist credit unions’ pandemic planning efforts, in 2007, the NCUA and other Federal Financial Institutions Examination Council (FFIEC) member agencies published a Pandemic Planning guide.

According to the Pandemic Planning guide, a credit union’s business continuity plan should include:

• a preventive program to reduce the likelihood that an institution’s operations will be significantly affected by a pandemic event;
• a documented strategy that provides for scaling the institution’s pandemic efforts so they are consistent with the effects of a particular stage of a pandemic outbreak;
• a comprehensive framework of facilities, systems, or procedures that provide the organization the capability to continue its critical operations;
• a testing program to ensure that the institution’s pandemic planning practices and capabilities are effective; and
• an oversight program to ensure ongoing review and updates to the pandemic plan.

While not necessarily required to be addressed in a credit union’s business continuity plan, all of the above factors will be important for a credit union’s operations should a flu pandemic or epidemic occur.

Recently, the FFIEC released an updated version of its Business Continuity Management booklet, which provides guidance on managing risks in an ongoing and continuous manner. This ongoing risk management can put a credit union in a better position to respond to an emergency such as a major outbreak of the flu. If you’re not familiar with the updated booklet, check out this NAFCU blog all about it. Additionally, NAFCU has published tons of blogs over the years about business continuity planning and dealing with emergencies.