Dear Sir/Madam,

Examinations on Preparedness for Influenza Pandemic

The Hong Kong Monetary Authority (HKMA) has recently completed a round of on-site examinations of selected authorized institutions (AIs) on their preparedness for the possible influenza pandemic outbreak.  The objective of the exercise is to assess the readiness and effectiveness of selected AIs’ business continuity plans (BCPs) to deal with the possible outbreak.

Overall, the HKMA is satisfied that the AIs concerned have stepped up their preparedness and implemented a series of contingency measures to handle the possible outbreak.  All AIs assessed have drawn on the relevant experience and lessons learned from the SARS outbreak in 2003 and the preparation for the Sixth Ministerial Conference of the World Trade Organization in December 2005 when developing their BCPs.  To help the industry to better prepare for the possible outbreak, set out in Annex 1 and Annex 2 respectively for your reference are some good practices adopted by certain AIs and a list of major common issues identified during the on-site examinations. 

In view of the increased level of threats of the possible outbreak in Hong Kong, I would like to remind AIs to remain vigilant and continue to review the adequacy of their emergency preparedness. 

Should you have any questions on the above, please contact Mr Shu-Pui Li on 2878 1826 or Mr Raymond Suen on 2878 1817.

Yours faithfully,

Arthur Yuen
Executive Director
(Banking Supervision)

Annex I – Good Practices Adopted by Certain AIs

General Good Practices

(a) A multi-disciplinary pandemic contingency planning team and a clear emergency response structure have been set up to monitor the latest developments of the pandemic and manage any possible incidents.

(b) The related BCPs have been reviewed and accordingly updated to be in line with the three-tier response system (Alert Response Level, Serious Response Level and Emergency Response Level) established by the Government of the Hong Kong Special Administrative Region (HKSARG).

(c) Adequate infection control procedures including the acquisition of personal protective equipment (e.g., masks, liquid soap, disinfectants, hygiene kits) have been put in place. Office premises are cleansed more regularly to maintain a high standard of environmental hygiene. 

(d) Staff awareness programmes (e.g. briefings, posters, e-Bulletin on the Intranet) have been organised to disseminate to staff relevant health information and guidelines on the importance of good personal hygiene.

Specific Practices

(a) Certain AIs have established permanent sites which are readily available for split-operations arrangement when needed. Some AIs have also conducted live drills to simulate the split-operations arrangement for various disaster scenarios (e.g., staff absentee up to 30%).

(b) Some AIs have identified the detailed requirements for supporting the “work-from-home” and “split operations” strategies for a prolonged period (up to 3 months) and acquired additional mobile computing equipment (e.g. laptop computers and dial-up phone lines) for such strategies. Pre-arrangement with the Internet service providers to increase the network bandwidth within a short period of time has also been made in case the strategies are triggered.

(c) A number of AIs have established a centralised registry for contact tracing, temperature logging for key operational staff and temperature screening for visitors. Some AIs have also established a dedicated 7x24 hotline for enquiry and reporting of sickness of internal staff. These measures will be activated when the HKSARG declares the serious or emergency response level in Hong Kong. 

(d) A number of AIs have appointed medical practitioners to organise health talks and seminars for their staff on infection control measures. Certain AIs have also established stress management and counseling services for individual staff, particularly for those who are likely to be exposed to a higher stress environment (e.g. frontline staff).

(e) Several AIs have implemented effective measures for improving indoor facilities within their office premises. These include conducting inspections of such facilities as internal drainage pipes and sanitary fitments as well as arranging more frequent cleaning of air ducts and dust filters.

Annex II – Major Common Issues Identified in On-site Examinations

(a) Split operations/ work-from-home arrangement - Although all AIs that were examined planned to adopt the split operations or/and “work-from-home” strategies, some AIs had not formally documented the detailed arrangements. The AIs concerned should document clearly on which business and support functions and staff are subject to the split operations and/or “work-from-home” arrangements, what resources and equipment are required, and what specific steps are needed to facilitate such operations. 

(b) Determination of bare minimum services for worst-case scenario – Some AIs had not completed the process of determining in advance the bare minimum banking services that must be continued in the worst-case scenario, as a result of which they could not plan ahead on what minimum resources are required for the provision of such services. AIs are recommended to determine in advance what the bare minimum services are, some examples of which include Internet banking services, payment-related services, access to safe-deposit boxes under special requests, services for the elderly and people with disabilities. Any special service arrangements should also be communicated clearly to their customers when needed.

(c) Planning for high absentee and loss of key staff – Some AIs had yet to complete their impact assessment on, and develop a contingency plan for, a high absentee rate scenario (e.g. in the range of 30%). AIs are reminded the importance of such impact assessment as well as the related contingency plan. In addition, the back-up arrangement for all key staff should be properly identified and documented. 

(d) Overseas support on key business functions – While overseas support on key business functions could be a solution for high absentee rate, AIs should carefully assess the possible legal and compliance issues involved (e.g. conduct of regulated activities by overseas offices, licensing and registration requirements of overseas staff) and, where appropriate, seek adequate legal advice on such issues. 

(e) Preparedness of key service providers – Some AIs had specified the criteria for assessing, and conducted their own assessments on, the preparedness of the key service providers. As a general practice, AIs should ensure the preparedness of their key service providers and establish appropriate verification criteria for evaluating them. In particular, contingency plans should be developed for those key service providers which are considered to be poorly prepared for the possible outbreak. 

(f) Communication strategy – Several AIs had not developed a specific plan for communicating with key external parties (e.g., regulators, customers, counterparties, the media and other stakeholders). AIs should develop a communication plan, including guidelines for media handling, pre-arrangements of official spokespersons, sample press releases and/or Q&As for different possible scenario. 

(g) Verification of plans and procedures – Some AIs had not verified their emergency response plans and contingency procedures for the possible outbreak. AIs are recommended to perform drills or walk-through exercises of their enhanced BCPs to allow staff to get familiar with the contingency procedures.