Case Study Exercise [4]: Change in Scenario [A]

Change in Scenario [A]

Scenario Change and Local Monetary Authority Directives

Security and Infrastructure scenario

In the past, BCM generally deals with the recovery and resumption of business operations following a disruption. However, this may no longer be adequate to deal with security threats arising from terrorism.

Principle 2 of the BCM Guidelines 6 emphasizes the need for financial institutions to be proactive and to have in place sound emergency response procedures.

In this regard, institutions should implement a holistic BCM approach which includes proactive threat and vulnerabilities assessment, appropriate preventive and deterrent measures, as well as comprehensive immediate response plans which should include pre-defined trigger events and actions.

Preventive and deterrent measures should be commensurate with the different stages of security threat levels. This may include the implementation of more stringent security measures (e.g. physical security measures), pre-activating alternate sites and redeployment of key personnel and operations during specific periods of heightened security threat levels.

Contingency plans should cater for incidents such as wide area disruptions in the financial district, major disruptions to the public transportation system, and the inaccessibility of mobile phone communication. Institutions should ensure that they have the capability to contact and account for personnel, and to rapidly mobilise teams to respond to the emergency or commence recovery actions.

Pandemic Scenario

The World Health Organization has announced that controlling and monitoring avian influenza, and preparing for a future influenza pandemic are its top priorities. One key challenge of an influenza pandemic facing the financial industry is the possibility of low staff availability which could potentially disrupt business operations for prolonged periods. The BCM plans of financial institutions should therefore include measures to mitigate the impact of an influenza pandemic.

Institutions should put in place a comprehensive organization-wide preparedness and response plan to deal with the different stages of an outbreak. The plan should preferably be aligned with the Ministry of Health’s Disease Outbreak Response System Condition Flu (DORSCON-FLU) alert levels 1. This alert system is part of Singapore’s national response strategy for an influenza pandemic.

With reference to Principle 7 of the BCM Guidelines 2, institutions are encouraged to explore flexible and effective work measures when developing their response plan.  The plan should address the health and safety of both employees and customers, and the continuation of critical business functions. It should include business continuity measures such as alternate work arrangements, crisis management and communication, and corporate duty of care towards employees (i.e. workplace measures 3).

Proximity and Risk Issue

It has been observed that institutions are selecting their alternate recovery sites based on expediency rather than reflecting the actual BC/DR needs.  In one extreme case it has been bought to our attention that the recovery centre for key operations resides in the same building.  This greatly increase the risk associated with physical proximity.  At large recovery sites should be selected such that they do not inadvertently increase their concentration risk.

In view of the above institution should conduct a review of (i) their recovery centres, (ii) their operations, and attest that they do not suffer from the above proximity and/or concentration risks.

Link to Sections of Case Study