Examiners can postpone examinations if a major disaster strikes a financial institution, but when exam time finally comes, that institution’s business continuity plans, response, and post-disaster risk management will be major points of discussion and may even impact its CAMELS or ROCA rating.
While the guidance encourages examiner flexibility for financial institutions impacted by Presidential declarations of a major disaster, including those with loans or investments in the area, it also recognizes that a disaster changes the risks facing an institution’s earnings, capital, funding, liquidity, operations, and sensitivity to market risk. That is why the agencies expect impacted institutions to conduct initial risk assessments in these areas based on available information and to regularly update them as more is known.
Operational risk assessments “should address the effectiveness of the institution’s operational capability and its business continuity plan. Institution management should be able to explain its review and assessment methodology and demonstrate reasonable progress, given the circumstances.”
When evaluating CAMELS or ROCA ratings, examiners are instructed to review an institution’s BCP and response plans to determine whether they are practical considering an institution’s business strategy and operations when the disaster has impacted economic and business conditions. “In particular, when assessing the management component, examiners should consider management’s effectiveness in responding to the changes in the institution’s business markets and whether the institution has addressed these issues in its longer-term business strategy and future response plans.”
While examiners may lower the CAMELS or ROCA rating as a result of this assessment, supervisory action may not be needed as long as “the institution’s management has appropriately planned for continuity of operations; implemented prudent policies; and is pursuing realistic resolution of the issues confronting the institution.”
The effectiveness of disaster recovery and business continuity plans will be assessed by how well management can communicate, deal with damage, and restore data and operations.
Financial institutions will be evaluated on how they communicate with employees, customers, and third-party providers before, during and after the disaster. That includes identifying and informing essential personnel where and how they’ll perform operations, addressing how to operate with a less-than-full staff roster, and sharing information. There should be plans for keeping customers in the loop about the institution’s ability to operate and informing third-party service providers and suppliers of the impending event to take preemptive action and then to follow through with the BCP plan.
Facilities, equipment and records can all be damaged. The guidance tells examiners to assess how the institution recovers, which includes steps such as: