<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Compliance and Risk (Part 4)

author Michael Berman
3 min read
Apr 6, 2020

Earlier this year, if you had asked a compliance professional if they expected any major compliance changes during the first quarter, they’d have answered no. That was before COVID-19 began spreading across the U.S., readjusting the regulatory agency’s top priorities.

This month has seen numerous guidance from regulators delaying exams, postponing reporting, and prioritizing helping customers during these challenging economic and social conditions.

While many necessary compliance and risk functions continue, it’s by no means business as usual. COVID-19 is creating new operational risks that need to be identified, assessed, mitigated, and monitored.

In this fourth blog in Ncontracts’ series breaking down key operational risk considerations department-by-department, we’re addressing two departments: compliance and risk.

Business Continuity Management (BCM): What Compliance Needs to Consider Right Now

In theory, the compliance department should be prepared for COVID-19. A pandemic doesn’t upend compliance or risk management policies or procedures. Business continuity plans, a regulatory requirement, should be in place.

Yet, there are still some questions that need answering:

  • When is the last time we conducted a Pandemic Test? What were the results? What were the material weaknesses and successes?
  • Can compliance and risk access everything they need to collaborate remotely?
  • How do we ensure those working from home follow policies & procedures?
  • How will we communicate with regulators?
  • Are there shifts in regulatory expectations that require changes to policies & procedures?
  • Do we need to develop new policies and procedures in response to new lending programs created by Congress?
  • What, if any, new compliance challenges does COVID-19 create? (increased fraud, difficulty keeping pace with suspicious activity reports (SARs), insufficient staffing, etc.)

Related: What is Business Continuity Management?

BCM: Considering the Regulators’ Response

Regulators have limited ability to respond to a pandemic because the financial distress was not created by a financial event. Their main goal is to promote confidence and stability in the financial system.

One of the most significant ways regulators have helped with the COVID-19 response is through preparation. Regulators provide guidance on business continuity planning, management, and resiliency and are a check on your controls. They’ve used past exams to check in on your planning and point out shortfalls.

The Federal Financial Institutions Examination Council (FFIEC) recently released an Interagency Statement on Pandemic Planning reminding FIs that their BCPs should address the threat of a pandemic outbreak to critical services. That includes a:

  • Prevention program
  • Documented strategy scaled to the stages of a pandemic outbreak
  • A comprehensive framework to ensure the continuance of critical operations
  • Testing program
  • Oversight program to ensure that the plan is reviewed and updated.

Regulators can also ease requirements to free up resources that would best be used to help customers in crisis. Compliance departments should consider:

  • What are the regulators going to do? What have they done with past pandemics? What have they already done?
  • What role will the regulators play if customers and members affected by the coronavirus can’t pay back their loans?
  • Will regulators be critical of our efforts to aid customers/members?
  • Will regulators expedite requests, if needed?
  • How will scheduled exams be impacted?
  • How will reporting requirements be impacted?
  • Will deadlines for things like resolving non-critical supervisory findings be extended?
RELATED: Download the Work-From-Home Risk Assessment

BCM: What Risk Management Needs to Consider Right Now

FIs with enterprise risk management (ERM) programs in place will be in the best position to ensure that different areas of the institution are working together to identify, assess, mitigate, and monitor risk. When risk information is centrally reported, it makes it possible to leverage each other’s work for a cohesive response.

Every risk function should be asking questions like:

  • Do all necessary parties have a seat at the risk table?
  • Have new risks been introduced?
  • What risks need to be reassessed due to the increasing probability of occurrence?
  • What, if any, new controls are needed?
  • Should the frequency of board and management reporting change?
  • Are remote workers from different departments still collaborating on risk?

While risk management should be leading the charge on these questions, it shouldn’t work alone when it comes to managing the operational risks of COVID-19. Compliance and risk management should coordinate its efforts with other departments, including human resources, operations/back office, frontline/branch management, IT, vendor management, and credit/lending, among others.

Risk management can’t work in a vacuum. We may be self-quarantining or sheltering in place, but when it comes to risk management, we all need to come together.

For more insights into how COVID-19 is impacting operational risk and resiliency, join us for our webinar Unprecedented: COVID-19, Vendor Management and Managing the New Normal, on Wednesday, April 8, 2020 @ 2:00 PM CT.

Next part: Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Finance & Lending (Part 5)

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Human Resources (Part 1)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Human Resources (Part 1)

Mar 23, 2020 3 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & IT (Part 6)

Apr 10, 2020 4 min read
Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Board & Management (Part 3)
Banks

Pandemic Preparedness & BCP Department-by-Department Series: COVID-19 & Board & Management (Part 3)

Apr 3, 2020 2 min read