Pandemic Planning CIA Conference June Judy Cameron Director Legislation & Policy Initiatives – OSFI 613 –

2 Agenda Background on regulators focus on BCP Why pandemic concerns Canadian authorities International responses to pandemic threat What has OSFI done What does OSFI look at? Next steps

3 Background Heightened focus on BCP post Y2K and 9-11 Some regulators issued specific guidance Need for international collaboration : –Importance of global financial sector –Increasing inter-dependencies within financial system Various international initiatives –Protocols for cross-border crisis communications –Basel principles expect banks to have contingency and business continuity plans. –Joint Forum high level principles on BCP

4 Background Principles for BCP Joint Forum principles focus on Business Continuity Management (BCM) Effective BCM includes –Business impact analysis to identify critical services/activities –Recovery strategy – objectives for recovering critical services –Business continuity plans to implement recovery strategy Relevant for all financial sector participants and authorities Global principles for financial sector Common base of resilience across national boundaries

5 Background Principles for BCP Joint Forum Principles (December 2005) 1.Boards are responsible for effective BCM 2.Organisations should explicitly consider & plan for major operational disruptions 3.Recovery objectives should reflect FIs’ risk to the operation of the financial system. 4.BCPs should address range of internal & external communication issues 5.Communication protocols should address cross- border communication 6.Business continuity plans should be tested to assess effectiveness 7.Financial authorities should assess BCMs as part of supervisory reviews

6 Why pandemic concerns Canadian authorities Historical pattern - pandemics every 30 to 50 years (e.g. Spanish flu , Asian flu ) Spread of H5N1 could lead to pandemic As of June 06/06, 225 human cases with 128 deaths Predominantly in SE Asia (also China and Middle East) Characteristics of H5N1 similar to 1918 virus –Fatality in the 15 – 40 age range Experts believe a flu pandemic is inevitable Potential for significant economic consequences

7 Why pandemic concerns Canadian Authorities Financial services critical to Canadian economy. Adverse impacts due to increased absenteeism, social distraught, restrictions on travel and trade, etc. –30 – 50% absenteeism could disrupt operation of critical financial system functions (payments, clearing and settlement). –Insurance exposure due to loss of revenue and increased claims –Impact on economy leads to increased credit risk. –Temporary increase in risk aversion. Could lead to high demand for liquidity.

8 Pandemic vs “typical” disruption. Traditional BCP scenarioPandemic scenario Single event (in one geographic area), comes as a surprise Multiple waves over 6+ months Widespread, comes in phases Impacts: Likely main impact is IT and / or premises & facilities People may be generally unaffected Impacts: IT and / or premises & facilities generally not affected Main impact is on people; magnitude hard to project Risk Assessment: Full assessment possible – easier to invoke recovery plans Risk Assessment: Full assessment not possible - impacts grow as more people are affected

9 Pandemic vs “typical” disruption. Traditional BCP scenarioPandemic scenario Possible assumptions: Key people/alternatives available Back-ups (IT & premises / facilities) available Limited use of multiple worksites & work at home Outsourcers / suppliers generally not affected Possible assumptions: Key people or alternatives may not be available, and some may never return Back-ups (IT, premises / facilities) cannot be used Extensive use of multiple worksites and work at home Outsourcers / suppliers may be affected

10 Pandemic vs “typical” disruption. Pandemic scenario Unique Challenges: Management: succession over long horizon BIA: gradual, widespread, and changing impacts (services critical over long term), unknown reactions (e.g., anxiety) BCP / alternate sites: focus on continuity over longer term, difficulty to assess scope of problem, HR focus (safety, telework, distance communications), difficult to set recovery objectives Testing: scope of pandemic and associated costs

11 Global Regulatory Approaches Pandemic is a world-wide threat Significant collaboration between regulators through JF, IMF IMF seminars - knowledge sharing with less advanced countries Regulators – various responses: –UK – FSA is surveying preparedness of key firms –US – regulatory agencies are monitoring FI preparedness, liaising w industry groups –HK – set out planning assumptions –Australia – may issue guidance

12 What has OSFI Done? Financial Institution Preparedness: August 2005: high level BCP reviews, major FRFIs February 2006: raise awareness with industry associations February 2006: initiate desk-top review of pandemic plans of 11 major FRFIs April 2006: pandemic letter to all FRFIs. –Pandemic preparedness an area of increasing supervisory focus –Board/senior mgmt should: understand possible implications of a pandemic on operations and financial condition review the institution’s preparedness plans. consider a pandemic scenario in financial stress tests May/June 2006: onsite review of selected FRFIs’ plans Ongoing: discussions with industry associations and other regulators

13 What has OSFI Done? OSFI Preparedness: OSFI Internal “pandemic” working committee Planning linked to triggers: 1)pre-pandemic 2)public report of inter-human transmission 3)affected person in NA/Canada 4)affected person in OSFI cities 5)illness of OSFI employee or family member 6)20-40% of OSFI workforce affected 7)Second wave Items key to OSFI’s pandemic readiness –Governance and Decision-making Structure –Communications Strategy/Plan –HR/Employee Safety and employee concerns (safety is key!) –Maintaining Business Operations –OSFI’s Unique Role & Responsibilities

14 What is OSFI Looking For? OSFI has not issued guidance/set deadlines Review of big FRFIs’ plans vs. benchmark criteria: : –Risk assessment –Planning strategies –Communications and Response plans –For lifecos – DCAT scenarios Expects plans will vary.

15 What is OSFI Looking For? Risk Assessment Considerations Has the FI: –Determined potential impact of pandemic on business –Conducted assessment that identified critical functions and essential employees –Assessed risks associated with critical suppliers –Considered/tested a variety of scenarios considered

16 What is OSFI Looking For? Planning Considerations Has the FI: –Established a pandemic contingency project team –Developed business continuity plans (BCPs) that consider pandemic scenario –Included authorities, triggers, and activation procedures in BCPs E.g. are the triggers linked to the WHO pandemic stages of

17 What is OSFI Looking For? Communication and Response Does the FIs’ planning : –Establish command and communication structure –Implement HR / work environment procedures –Foster staff awareness –Develop communication strategy (to inform stakeholders including regulatory authorities).

18 What is OSFI Looking For? Stress Testing Has the FI considered: –Impact of pandemic on claims experience. In particular, impact on claims, earnings, capital Life insurance vs. annuities Reinsurance By region –Scenario comparable to 1918 flu –Severity of scenario that would bring insurance company to insolvency

19 Next steps Increased supervisory focus. –On-site meetings with 11 largest FIs re: planning gaps –Monitoring pandemic plans based on benchmark review criteria Continued discussions with industry associations and international regulatory agencies

20 How to ward off Avian Flu