8 October 2003

Dear Sir / Madam,

Business continuity planning considerations relating to SARS

The HKMA has been reviewing with a number of authorized institutions (AIs) the implications of SARS (Severe Acute Respiratory Syndrome) for business continuity planning. The purpose of this letter is to summarise the lessons learnt and to recommend certain measures you may wish to consider.

Most AIs should have developed business continuity plans (BCPs) to cope with major physical disasters. We would like, however, to stress the importance of reviewing your existing preventive measures, contingency procedures, and recovery equipment and facilities to ensure that they are effective in handling another outbreak of SARS or any other similar communicable diseases. In this connection, we would recommend the following measures for your consideration:

1. Your institution should maintain a high level of environmental hygiene and encourage staff to maintain a high level of personal hygiene. The adequacy of the remaining stock of face masks, hand gloves, disinfectant etc., in case of need, should be reviewed from time to time;
   
   

2. You may consider retaining medical practitioners to provide regular advice on latest developments and to recommend appropriate measures for adoption. You may also encourage staff to take influenza vaccination for individual protection. This will reduce the number of false alarms and the related disruptions;
   
   

3. You should establish a clear command structure involving the senior management for crisis management, central SARS-related policy making and logistics management as early as possible when there is a possible outbreak. This is important to avoid confusion in the appropriate response to adopt in particular situations;
   
   

4. Clear communications of SARS-related matters and policies, both internal and external (e.g. customers and counter-parties), are key. You should ensure that the HKMA is apprised of the latest situation should you be affected, which should also be made readily available to the media if required;
   
   

5. You should check with your critical suppliers and major outside service providers to make sure that they are also well prepared for another possible outbreak of SARS;
   
   

6. The experience last time suggests that customers will shift to electronic channels of delivery should there be concerns of an outbreak. You should review the capacity of your computer systems to cater for the potential upsurge in transaction volume; and
   
   

7. In handling the last outbreak, many institutions found it necessary to operate in a split operation mode or adopt a mobile work force strategy (e.g. working from home). You should ensure that your back-up facilities, mobile computing / communication devices and network bandwidth are adequate if you plan to adopt such contingency measures. The related procedures should be rehearsed and the required facilities and devices should be tested before they are put into use.

 

I hope you will find the above useful. If you have any questions on this letter, please feel free to contact Mr Shu-Pui Li at 28781826 or Mr Raymond Suen at 28781817.

Yours faithfully,

Raymond Li
Executive Director (Banking Development)