<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Been Through a Disaster? Be Ready to Talk BCP and Risk During Your Next Exam

author Michael Berman
3 min read
Mar 10, 2022

Examiners can postpone examinations if a major disaster strikes a financial institution, but when exam time finally comes, that institution’s business continuity plans, response, and post-disaster risk management will be major points of discussion and may even impact its CAMELS or ROCA rating.

Assessing Risk After a Disaster

While the guidance encourages examiner flexibility for financial institutions impacted by Presidential declarations of a major disaster, including those with loans or investments in the area, it also recognizes that a disaster changes the risks facing an institution’s earnings, capital, funding, liquidity, operations, and sensitivity to market risk. That is why the agencies expect impacted institutions to conduct initial risk assessments in these areas based on available information and to regularly update them as more is known.

Operational risk assessments “should address the effectiveness of the institution’s operational capability and its business continuity plan. Institution management should be able to explain its review and assessment methodology and demonstrate reasonable progress, given the circumstances.”

Related: What’s the Difference Between Business Continuity Management (BCM) And Pandemic Planning?

BCP Plans and Response

When evaluating CAMELS or ROCA ratings, examiners are instructed to review an institution’s BCP and response plans to determine whether they are practical considering an institution’s business strategy and operations when the disaster has impacted economic and business conditions. “In particular, when assessing the management component, examiners should consider management’s effectiveness in responding to the changes in the institution’s business markets and whether the institution has addressed these issues in its longer-term business strategy and future response plans.”

While examiners may lower the CAMELS or ROCA rating as a result of this assessment, supervisory action may not be needed as long as “the institution’s management has appropriately planned for continuity of operations; implemented prudent policies; and is pursuing realistic resolution of the issues confronting the institution.”

The effectiveness of disaster recovery and business continuity plans will be assessed by how well management can communicate, deal with damage, and restore data and operations.

Communication plans

Financial institutions will be evaluated on how they communicate with employees, customers, and third-party providers before, during and after the disaster. That includes identifying and informing essential personnel where and how they’ll perform operations, addressing how to operate with a less-than-full staff roster, and sharing information. There should be plans for keeping customers in the loop about the institution’s ability to operate and informing third-party service providers and suppliers of the impending event to take preemptive action and then to follow through with the BCP plan.

Dealing with damage

Facilities, equipment and records can all be damaged. The guidance tells examiners to assess how the institution recovers, which includes steps such as:

  • Establishing temporary facilities;
  • Obtaining replacement equipment and supplies;
  • Handling and reproducing contaminated loan files and legal and collateral documents;
  • Replacing contaminated cash and coins;
  • Handling contaminated safe deposit boxes and their contents; and
  • Retrieving and restoring data systems, electronic information, and operational capabilities.

What does this mean for financial institutions? Several things.

  1. Have an actionable business continuity plan. The plan needs to be accessible, tested and implementation ready. It should have communication and disaster recovery components and management should be familiar with it. Your plan should ensure your institution recovers as quickly as possible.

    Related: 9 Steps to an Effective Tabletop BCP Test

  2. BCPs should be accessible. If your institution is relying on manual processes that count on specific employees finding documents or files on specific machines or filing cabinets, you’re adding more risk to an already a risky situation. Management needs to easily find, follow and report on its marching orders and make adjustments as it goes. Make sure you plan is centralized and includes components for reporting.
  3. BCPs should be updated. BCPs are not a one-time exercise. Your plan should be regularly maintained and updated to keep pace with your institution’s environment so that it will be effective.
  4. Be prepared to assess and reassess risk. If your institution already has a strong ERM program in place, it should be regularly identifying, assessing, measuring and monitoring risk. Those best practices and systems will be put to good use if disaster strikes. If your institution isn’t yet on board with ERM, this is yet another reason why risk management needs to be ingrained in your culture. Management needs to be prepared to assess the post-crisis landscape and steer the institution, its employees and its customers to safety. Make sure you have tools to analyze and measure risk and identify shortfalls.
Learn more at: 

Business Continuity Resources

 

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Business Resiliency: Your Guide to Business Continuity Management
Banks

Business Resiliency: Your Guide to Business Continuity Management

Sep 23, 2020 6 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)

Apr 10, 2020 4 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Compliance and Risk (Part 4)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Compliance and Risk (Part 4)

Apr 6, 2020 3 min read