Asia Pacific Regional Committee SARS CRISIS Business Continuity Planning and Moving Forward Andrew Sheng Chairman Securities and Futures Commission Hong Kong Wednesday,15 October 2003
Why SARS is different from other crises? The steps the SFC has taken to deal with SARS crisis Externally Internally Business Continuity Planning The Lessons Learned 2
Why SARS is different from other crises? I I felt more safe in Iraq during the war, at least I knew who my enemies were. Fear of the unknown and that the person next to you could have it and could spread divisive and morale shattering. All other business contingency planning scenarios propose that at least part of your team will be there as survivors can maintain operations - SARS threw that supposition out the window. Lack of credible information and answers who had it and who didn t, where the hot spots were what to do and how to avoid it. 3
The steps the SFC took to deal with SARS Externally Objectives: Intermediaries could continue to operate in the event that a SARS infection is confirmed. To ensure intermediaries have procedures in place to minimise the spread of the disease. 4
The steps the SFC took to deal with SARS Externally Distributed the World Health Organisation circulars to all licensed and registered persons. Requested reporting if intermediaries have staff that are suspected or confirmed as having SARS. Worked with Hong Kong Exchanges & Clearing on their contingency plans. Requested all intermediaries review their business contingency plans and add SARS related issues. Briefed and advised the government on the measures taken by the financial services sector. Fielded questions from intermediaries on SARS issues. 5
The steps the SFC took to deal with SARS Internally Started a SARS working group to discuss issues internally Segregation of staff to mitigate risk Greater than 20% (60-80 SFC staff from various divisions and departments) working from home. Masks handed out to all staff on a weekly basis. Increased frequency of cleaning/deep cleaning of building and facilities. Non-essential meetings were cut down - conference calls encouraged. Pregnant staff were encouraged to take special paid leave and remain home. 6
The steps the SFC took to deal with SARS Internally Quarantine procedures put in place if staff were either suspected or confirmed with SARS. Reporting and monitoring procedures for staff that reside in buildings with confirmed SARS cases. Kept staff informed of the measures the SFC has taken, briefings with DOH etc. NO SFC STAFF HAVE BEEN CONFIRMED WITH SARS. 7
SFC Requirements for Business Continuity Planning The SFC requires that all registered or licensed persons must have a business contingency plan in place. Our Intermediaries Supervision Department monitors the implementation of plans: Code of Conduct S4.3 Internal control, financial and operational resources A licensed or registered person should have internal control procedures and financial and operational capabilities which can be reasonably expected to protect its operations, its clients and other licensed or registered persons from financial loss arising from theft, fraud and other dishonest acts, professional misconduct or omissions. 8
SFC Requirements for Business Continuity Planning Management, Supervision and Internal Control Guidelines 36. An effective business continuity plan appropriate to the size of the firm is implemented to ensure that the firm is protected from the risk of interruption to its business continuity. Key processes in this area include: a business impact study, identification of likely scenarios involving interruptions (e.g. break down in its data processing systems) and documentation and regular testing of the firm s s disaster recovery plan. 9
SFC Requirements for Business Continuity Planning Documented plan with policies and procedures to ensure business continuity or to prevent substantial disruption to the operation of the firm in the event of an emergency. The plan should be tested on a regular basis. The plan should document the action the intermediary would take for business continuity in the event certain scenarios occur such as: Failure of utilities, Central rendered uninhabitable, fire/or other natural disasters, dealing with infectious diseases where the staff of the organization are no longer able to perform their normal functions and there may not be backup, etc 10
SFC Requirements for Business Continuity Planning Contact lists should be updated regularly with the contacts of all staff and key telephone numbers. Depending on the size of operations, arranging for a back-up office site or other location so that the intermediary can continue to provide services. Ensure that duplicate records are available so that the intermediary can have access to their own books and records in the event their offices are uninhabitable. The intermediary should ensure that IT operations can handle the increase in workload with staff working off-site. 11
Specific SARS Related Issues for Business Contingency Planning Arranging for a (reciprocal) back-up office at unaffected premises; Arranging for certain staff members to work at compatible remote premises where feasible; Arranging for additional cleaning and other health measures (e.g. distribution of masks) for staff and clients; 12
Specific SARS Related Issues for Business Contingency Planning Arranging with counterparts or exchanges on contingency closing out of positions, clearing and settlement matters; Encouraging clients to use telephone or online facilities in place of physical branch presence; and Notifying clients of suspected staff infection and advising clients on the relevant contingency measures. 13
Lessons Learned This is not the last emergency of this type take the time now to implement or upgrade business contingency procedures, contact lists, and communication methods. Keep up health and cleanliness awareness. Ensure your operations are clean and are up to standards for your staff and clients. Communication is essential to your staff, clients and regulators. The SFC will take a flexible approach to the intermediary s s operations during a crisis situation but communication with us is essential. Contact us with your questions. 14
Questions & Answers