Financial Services Case Study
Case Study: Financial Institution
Influenza Protection (IP Ltd) were commissioned by a leading Financial Institution, based in the City of London, to carry out a comprehensive audit of their pandemic planning. The initial scoping meeting identified that the pandemic plan was an intrinsic element of the organisations overall business continuity plan and therefore this was included in the scope of the project. The increase in scope was in turn ratified at board-level and a consultancy contract was agreed.
IP Ltd then held a meeting with key stakeholders and business critical responders, to explain the requirement for the audit and the process. Further meetings were held with key individuals who explained their perceptions of their role within the plan. This approach generated excellent constructive feedback and made huge progress in building a platform of trust and cooperation between the parties.
IP Ltd’s leading consultant carried out a complete audit of the organisation with particular attention paid to the areas of business critical functions. This exercise was then consolidated with a forensic study by both parties of the company’s current risk analysis and approach to business critical functions in the light of a rising tide crisis. This process helped identify the individuals and roles that would be business critical in the circumstances of the high absenteeism expected in a pandemic
Against the backdrop of the agreed risk map a full audit of the Pandemic Plan was carried out enabling the business critical issues to be identified.
This joint analysis proved to have numerous benefits including agreement on elements of the plan that were perceived to be effective and how these elements could be adapted to facilitate a robust pandemic plan. Through previous experience this approach invariably speeds up the process and vitally gains commitment to embrace the new recommendations that the audit will deliver.
The findings of the audit were as follows:
The trigger points for implementation of the contingency plan were found to be largely misunderstood by the key responders and the activation time was found to be potentially too slow.
Critically the human resource allocated to contingency was not aligned with the timeframe for evolution of the risk to the company.
Not all business critical suppliers had been clearly identified and a substantial number were found to have inadequate business continuity plans
There was found to be a distinct lack of awareness of the unique risk posed by an influenza pandemic with the issue of ‘family commitment’ unaddressed.
The need for cross training was identified to support business critical roles
There was a lack of co-ordination between the stakeholders within the organisation for redeployment of staff
Additional business critical functions were identified (Details withheld for commercial reasons)
The current emergency plan for twinning office locations and closure of non critical sites required further refinement
There was found to be an understandable lack of willingness for senior management to contemplate the true potential of the impact of a pandemic.
The perceived commitment to continuity plans by critical staff was deemed to be low due to both poor understanding of the emergency process and the lack of practical resource to provide protection.
IP Ltd Solutions
• A robust timeframe for trigger points of the business continuity plan was agreed by all stakeholders and a specific timeframe of action was established for a pandemic linked to the WHO phases.
• All business critical staff were clearly identified and informed. Then other individuals approached for their ability to adopt key roles in a crisis or a willingness to be cross trained for key roles.
• A robust training and refresher program was designed and recommended for all involved.
• The amended list of business critical suppliers was further ratified and inadequately prepared suppliers were supported by IP Ltd in their efforts to reach a required standard.
• A crisis management group was recommended.
• Agreement was reached for rationalisation of the branch network in emergencies based on a hub and spoke system.
• A robust hygiene regime was agreed for all locations with the adoption immediately of measures for hand hygiene.
• All public facing staff were trained and resourced with personal protection equipment to enhance their confidence and commitment to business continuity.
• All branch networks were issued with patient handling packs in order that staff could deal safely with potentially sick members of the public.
• Agreement was reached at board level for business critical staff and directors to be medically assessed and, where appropriate, prescribed with antiviral medication.
• All these initiatives were the subject of a company wide questionnaire evaluating individuals understanding of the business continuity process and their commitment to the process.
• The revised and enhanced pandemic plan was robustly tested and validated via a desktop exercise and walk through simulation. A timeframe for consistent testing and simulation was established.