Click here to download a PDF document of the Pandemic Plan Checklist for BCP.

When building a strong pandemic plan, your main goal is to plan for absenteeism. Use this checklist to ensure you have included the FFIEC recommended elements of a pandemic plan as part of your Business Continuity Plan. The FFIEC indicates you need these five primary elements of a pandemic plan: Preventative Program, Documented Strategy, Comprehensive Framework, Testing Program, and Oversight Program.

Before you get started, here are 3 tips for reviewing your pandemic plan.

Preventative Program

Monitoring

  • We have documented plans for keeping tabs on potential outbreaks, such as checking international health organization websites, like the CDC and WHO.

  • We know which emergency and healthcare organization contacts we would use to get quick and accurate information
Educating Employees
  • We have training in place so our employees are familiar with how we will respond to a pandemic, including how employees will be expected to maintain their business functions.
Service & Supplier Communication
  • We have clear lines of communication with our critical service providers.
  • We have reviewed our critical service providers' business continuity plans and/or subcontractor documentation to confirm they will be capable of sustaining services to us.
Hygiene Training
  • We have official and continuous hygiene training for employees to decrease the onset of widespread disease.

Watch our recorded webinar, Understanding and Updating your BCP for Coronavirus, as we review pandemic resources (including the FFIEC's latest "Interagency Statement on Pandemic Planning"), discuss practical steps your organization can take to prepare, and look at Tandem features designed to help you be ready.

Documented Strategy

Know what triggers each Pandemic Intervals Framework (PIF) phase, have response plans in place, and communicate clearly. Every step should include specifics on who to contact (e.g., employees, service providers, media, customers/members, etc.), how to contact them (e.g., email, phone, website notices, collaborative platforms, signage, etc.), and what to communicate (e.g., hygiene expectations, service expectations, etc.).

Investigate

The Investigate phase happens when a new virus is identified in people.

  • We have defined what cues indicate this phase for us.
  • We have defined how frequently we will check for outbreak information.
  • We have documented plans to review our preventative program elements for accuracy.
  • We have documented plans to test our Documented Strategy.
  • We have documented plans for communication.
Recognition

The Recognition phase happens when an increasing number of cases are identified, and the virus has the potential to spread from person-to-person.

  • We have defined what cues indicate this phase for us.
  • We have defined how frequently we will check for outbreak information.
  • We have documented plans to review pandemic planning documentation for effectiveness.
  • We have documented plans for communication.
  • We have documented plans to perform a risk assessment. The assessment will analyze how a pandemic could affect our business. From the results, we will determine anything we could do ahead of time to mitigate those consequences.
Initiation

The Initiation phase happens when a pandemic is declared.

  • We have defined what cues indicate this phase for us.
  • We have defined how frequently we will check for outbreak information.
  • We have documented plans for which elements of the Comprehensive Framework should be implemented.
  • We have documented plans for communication.
Acceleration

The Acceleration phase happens when the disease reaches a significant upward curve and extreme measures are implemented.

  • We have defined what cues indicate this phase for us.
  • We have defined how frequently we will check for outbreak information.
  • We have documented plans to implement the full Comprehensive Framework.
  • We have documented plans for communication.
Deceleration

The Deceleration phase happens when the number of the cured begins to outnumber those being infected per day.

  • We have defined what cues indicate this phase for us.
  • We have defined how frequently we will check for outbreak information.
  • We have documented plans for employees re-entering the workforce.
  • We have documented plans for returning to "normal" operations.
  • We have documented plans for communication.
Preparation

The Preparation phase happens when deceleration has ended and you begin preparing for the next wave.

  • We have defined what cues indicate this phase for us.
  • We have documented plans for evaluating our response to the previous outbreak and improving
    our plans for the next.

Businesses should ensure their pandemic plans are reviewed, updated, and tested. Read our article, as we ask four questions to help you evaluate and update your plan.

Comprehensive Framework

To reduce the effects of a pandemic, implement all possible distancing methods.

  • We have defined what it means to practice social distancing in the context of our company.
  • We have documented and tested plans for how employees can communicate with each other through telecommuting.
  • We have documented plans for how to redirect customers to electronic service options (e.g., online banking, telephone banking, ATMs, call centers, etc.). We have tested our capacity to manage the increased interactions.
  • We have documented plans of where and how to work from alternative sites if a pandemic is specific to a location.
  • We have documented plans for how to restrict visitors.
  • We have documented plans to stay informed of official actions by public health authorities and other government authorities so we may act accordingly as soon as possible.

Testing Program

  • We have scenarios which test defined roles and responsibilities of management, employees, vendors, and customers/members. These tests confirm the validity of our cross-training and order of succession.
  • We have scenarios which test if we are adequately staffed and trained for increased reliance on our services (especially online and telephone services).
  • We have scenarios which test our remote access and telecommuting capabilities including (1) vendor ability to provide associated services, (2) technology ability to meet capacity requirements, (3) employee ability to effectively use remote access from their location.
  • When we test we consider the Department of Health and Human Services (DHS) Planning Assumptions https://www.dhs.gov/sites/default/files/publications/cikrpandemicinfluenzaguide.pdf
  • We have phishing testing and training regarding targeted pandemic phishing attacks.

Oversight Program

  • We have documented plans to review and update pandemic program content on an appropriate frequency.

About Tandem Business Continuity Planning Software

An enterprise business continuity plan can be tedious to develop and maintain, especially with evolving business processes and regulatory guidance. Plans can be hundreds of pages long — unmanageable from a compliance perspective, but more importantly, unusable in an emergency.

With Tandem the process is much simpler.

The Tandem Business Continuity Planning module allows financial institutions to outline plans and procedures to effectively manage operations before, during, and after a disaster. Learn more about Tandem Business Continuity Planning Software.