Conference sponsored by:

Center for Biosecurity of UPMC

Deutsche Bank

The Contingency Planning Exchange

Financial Sector Lessons Learned from SARS
Kenny Seow, Director, Regional Head of Business Continuity Management, Asia Pacific, Deutsche Bank AG, Singapore

Speaker biography  |  Slide thumbnails  |  Slide show  |  Video

It's certainly a privilege to be among so many distinguished experts on this subject.

What I'd like to share with you today is our experience with the 2003 SARS outbreak in Asia, as well as to share with you some of the lessons learned from this and see how we can apply the lessons learned to the pandemic situation that we are facing today.

When I first started looking into planning for avian flu about 10 months ago in the industry, people thought I was crazy. I mean, they said, "What? Why are you concerned with avian flu?" Certainly we have forgotten the lessons that we learned from 2003, and I think people have short memories of the issues that we faced.

I think the summit we have today is timely. In fact last week, we had a similar event in Singapore that was attended by over 350 people, where we had the people from the Minister of Health in Singapore present to the industry on the risks of avian flu, as well as a panel discussion amongst banks to share ideas as to what we could be do to prepare for a pandemic.

My presentation is going to focus on Asia, specifically on the financial sector. In terms of background for SARS, I think that requires no introductions.

The problem started in Guangdong back in November in 2002, and within a short period of 8 or 9 months it had spread to 29 countries. There were more than 8,000 people infected, with more than 900 deaths. And the economic loss to Asia was estimated to be around $30 billion.

On the impact to the financial industry -- I don't think there was any direct financial impact as such. However, the banking sector did feel the fallout from lost opportunities, to slow economic growth, and so on.

One of the services that was greatly impacted were those that required physical contacts with clients and customers, for example, people in the private banking, private wealth management segment as well as people who had to present to customers to make sales opportunities, product launches and so on. This was primarily due to travel restrictions that were put in place in some locations, as well as fear of clients and suppliers from meeting up with people from infected locations.

Deutsche Bank, for example, being a global bank, our relationship managers are on the road all the time and when countries put up travel restrictions or quarantine measures, that impacted the way that business was conducted.

There were also a lot of other operational difficulties faced by organizations. For example, in some locations or some organizations, they would implement a quarantine period for anyone coming from Asia. You had to quarantine yourself for between 5 to 15 days before you were allowed to come into the office. And that created a lot of disruption to the work.

Some employees in a bank in Hong Kong came down with SARS, and a number their co-workers had to be quarantined was well. As a precautionary measure, the bank also sent the entire team of their Bond traders home to be quarantined for 10 days before they were allowed back to work again. From an operational point of view, the reduced workforce would have certainly adversely affected some of the work in the office.

Higher rates of absenteeism -- before SARS, it used to be the case where if you were not feeling well or you had the sniffles you came to work anyway. But during the SARS period, anyone with the sniffles would get "the look" or "the stare" from their colleagues because they wanted to know what you were you doing in the office! "Why don't you go back home?" And that resulted in higher rates of people reporting in sick and productivity was impacted.

Staff morale -- some of the organizations went into "split operations" mode, whereby they would divide the team into two separate locations, with the assumption that should one of your offices by quarantined, then at least you have a backup team working off site. What we found from our experience in Deutsche Bank was that such arrangements affected staff morale. When teams were split up, they were given instructions not to socialize with other teams, such as not to have lunch together.

The risk to bank employees -- the risk of SARS to staff was not just at the place of work but from the time that they left their homes to get on the public transportation systems. By the time they got to the office they would have been exposed as well.

And there was also the threat of forced closures of business premises. In the early days of SARS, around about the February-March timeframe, depending on which country you were in, you were getting conflicting information from the authorities as to what they would or would not do should an employee came down with SARS in the office.

We had cases where the authorities would say, "Yes, we would quarantine the entire building."

In other cases they said, "No, we would not quarantine the building but we would quarantine the office in which the infected employee worked."

There was lots of conflicting information, and certainly there was a threat of office closure. Banks were very concerned with that. Hence some of them went to into split operations.

The challenges that the banks and most organizations faced were that when you look at the typical business continuity plans, in particular after September 11, we were basically planning on the basis of building and infrastructure failures. We were basically planning on the basis of terrorist attacks, where it would take out your building's infrastructure. It would take out public transportation and so on. And that was really the basis of the planning.

And what we found with SARS was that these plans did not work at all. Very few organizations actually took into consideration infectious diseases that would directly impact their employees as well as the community in which they lived. Therefore, very quickly, certainly with the banking industry, we had to scramble and we had to deal with the situation as it occurred.

The second challenge was dealing with the unknowns. For example, how would the health authorities react in different countries? There were different policies and different legal requirements which were implemented by different countries.

How would the employees react? For example, we've heard of cases where expatriate staff would evacuate themselves and their families, and tbis became a problem. Some of the banks, particularly the global banks, had a lot of employees from overseas working in Asia. Some essentially packed up and left. So, again, that created business continuity issues.

How would landlords react? Some of the banks were in multi-tenanted buildings. Some landlords were more cooperative than others in terms of providing information as to whether anyone in the building had been infected or not and so on.

Travel restrictions -- in some cases, some organizations in some countries implemented controls which were beyond those that had been recommended by WHO. Because of the inconsistency, there were a lot of uncertainties as to what needed to be done.

And of course the disease itself. In the early days, there were a lot of unknowns as to how virulent was the disease, whether that was a risk to the general public or was this confined within healthcare providers.

And the next point is communications. In the early days of SARS, I think there was a lack of transparency in certain locations. It was very difficult to get the true picture as to what needed to be done, what was actually happening. Eventually, at least in the banking sector in some locations, we began to share information amongst the banks, and that provided some relief.

And then there were fears and concerns of employees and customers. I think the psychological aspect probably created more business interruption and business impact than SARS itself. For example, staff would refuse to come to work for whatever reason. As an organization, we needed to provide information to them and essentially ensure that their fears were addressed. Or rather, their unfounded fears were addressed.

And the last point was preventing the spread of rumors. We had a case in Singapore where one bank threatened to sue another bank because a bank employee sent an SMS to say that there was a SARS outbreak in that particular bank. And that circulated through the SMS system, circulated through the company e-mail, and that created a big public relations problem for the bank that was impacted. From an organization's perspective, there was a need to control the spread of rumors.

And lastly, the challenge in terms of responding to SARS -- for example, the limitations imposed by split operations. What we found was that there were a lot of issues with workflow. Teams that used to sit together but now had been split. Communications became a problem. Documentation handling became a problem. Workflow became a problem and also, in some instances, cross border business continuity became a problem as well.

Pre-SARS days, some of the banks would have cross border plans, where, say something happens in Hong Kong, I would fly a whole bunch of traders to Singapore, and I'd continue trading from Singapore. And what happened in SARS was that did not work at all, obviously, because both Singapore and Hong Kong were affected at the same time.

And there was also a shortage of health and safety consumables, things like masks, gloves, disinfectant and so on. It is questionable if wearing a mask was effective, but for the psychological comfort of the employees, I suppose, a lot of organizations went ahead and provided masks to employees anyway. And that itself created a problem on the supply side.

So how can we apply some of the lessons learned from SARS to pandemic planning, the issues that we face today? I feel one of the most important things is to build a knowledge base, to find out what's happening, to consult the experts to understand exactly what the disease is all about, how it spreads, as well as the issues from a legal and regulatory perspective.

In particular for the multi-national banks, we need to understand what are the implications, for example, issues of quarantine, issues with building closures, and so on. What are the legal implications? How would the local regulators react when something happens? And that goes beyond your regular channels.

Apart from getting information from people like WHO and CDC, is that we have to engage the regulators. We have to engage the governments in dialogs so that we are able to build a knowledge base for the basis of our planning.

The second item. is that we need to define the trigger points. There are a lot of things that need to be done, both in terms of preventive measures, in terms of protecting the staff, in terms of protecting the businesses. But we need to be clear as to when do we need to activate, when do we need to execute these plans.

We need to be clear about that and one of the things that we have done in Deutsche Bank is to align our trigger points with those that have been published by WHO. And we essentially say that the moment that there is human-to-human infection we would execute a set of measures that have been predetermined.

The next point which is very important for global organizations is to plan globally and execute locally.

A bit of a cliché here, but I think it is extremely important for us to assimilate whatever plans we have with the local governments' health and legal guidelines.

There is no point in us making a plan on a global basis without understanding in every single location that we operate, in particular in Asia, what the limitations are, what the assumptions are that we need to make in each of those locations. You need to be aware of some of these legal regulations, what can and can't be done in each of these locations.

The fourth point is to maintain open communication. One of the most important things is that we need to educate senior management on the risks, on the threats, and what needs to be done, because without the sponsorship of senior management, I think nothing is going to move.

So, we need to educate them. On top of that, the plans and policies, as well as the rationale behind them need to be communicated to employees as well. For example, with quarantine measures, is it 5 days, 10 days, or 15 days? These have to be communicated, and the rationale behind that has to be communicated.

During SARS, we had some organizations where the official company policy was a 10-day quarantine, but in some other locations they said, "Well, no, it's not 10-days, I want you locked away for 15 days," for example. So there was a huge inconsistency in the application of this policy, within the same organization across different locations around the world. So, I think it's important that these things are communicated to the staff.

Last but not least, as we learned from SARS and as we learned from all the BCP's and all the contingency plans that we have developed, is that we need to maintain flexibility. We've learned that for SARS the regular BCP's did not work. We had to adapt them very quickly and I think, certainly, for pandemics, the planning needs to be done. We need to make the assumptions. We need to really understand what the assumptions are and what the limitations are.

We need to plan for it. However, at the same time, we need to maintain flexibility in the way that we execute the plans. For example, if you are looking to, say, a work from home strategy, I think which one of the speakers had mentioned, we also need to consider the "what ifs?" Could we do cross-boder BCP's, do split operations, and so on and so forth? It is really to have that flexibility so that you are able to adapt to the situation as it changes.

So, I think with that, that's the end of my presentation, and I'll be happy to take any questions now. Thank you.

[return to top]