How financial services firms can manage through crises

Firms need to define the appropriate activities of the board and senior leadership during a crisis: who will be making decisions, how will those decisions be informed and made, and who will be brought in to assist? 

Some key issues stand out: 

1. Clarify roles and responsibilities. 
   
   First, start with identifying the key decision-making in crisis. Who needs to be involved? In what capacity? Who determines when an event — and of what kind — necessitates moving from continuity plans to crisis? Does everyone appreciate how decision-making authorities shift in crisis? Ironing this out beforehand is essential, as is determining who owns the crisis management process so there is clear accountability for validating that it stays in line with evolving industry practice and regulatory expectations. 
   
   
2. Identify substitutes. 
   
   Once you have determined who can make decisions in crisis, make sure qualified, experienced backups are known. For example, if the treasurer is on vacation during a crisis, who should senior management call upon for questions regarding liquidity and capital? If they can’t reach the CIO, who are the next three people in line, and are they prepared to step up? All of the identified decision-makers should be fully knowledgeable of the firm’s contingencies processes and should have delegated authority to act in times of crises. 
   
   
3. Define escalation processes and triggers. 
   
   Make certain that crisis decision-makers receive information they need, when they need it, without being flooded with extraneous detail. Ahead of an actual crisis, decide which key issues must be elevated to business unit leaders, senior management, and the board and other governance bodies, including risk committees. Where possible, adopt explicit escalation triggers, so as to limit the degree to which upward communications are inadvertently delayed — it’s all too easy for employees to wait another 5 or 10 minutes to problem solve, yet those minutes can be critical. 
   
   
4. Anticipate when established thresholds may need to be exceeded 
   
   During a crisis, a firm may need to accept greater financial and operational risks than typically expected. Confirm that decision-makers including the likes of second-line risk management, legal and compliance are engaged in those decisions. Review regulations, corporate policies (e.g., risk appetite thresholds) and insurance provisions to identify any “red lines” that should not be crossed. Document controls that may be overridden in crisis, by whom and when, and establish protocols for documenting such decisions. 
   
   
5. Practice making decisions in a simulated crisis.
   
   While some types of crises are predictable in the generic sense, each one has its own distinct characteristics. Moreover, inevitably, the crisis that hits the hardest is the one a firm doesn’t expect. Building top executives’ experience in making decisions in crisis — crisis muscle memory, if you will — is vital. Firms often conduct tactical simulations or tabletop exercises lower down the organization — say on liquidity or cyber — but it is important that these simulations are also undertaken at the most senior levels of the firm, so leaders know how they should operate in crisis. 
   
   
6. Line up specialist resources. 
   
   Inevitably, firms need some specialist resources, during and after the crisis — whether it be outside counsel, forensics, cyber or other areas. Advice from privacy, compliance and public-relations executives may also be required. Identifying and contracting with credible sources of such advice ahead of time, cross-referencing those with approved-vendor lists in insurance policies, and making certain that they can be onboarded and situated at speed allows the firm to move quickly into accessing and using this experience and resources. 
   
   
7. Designate someone to consider “what-if” questions.
   
   In the early stages of a crisis, groups tend to focus on the detail of immediate actions and sometimes arrive at premature conclusions as to the scope and causes of the problem. To avoid groupthink, establish a protocol to give someone the responsibility of stepping away from the immediate demands of the event to evaluate alternate explanations and possible responses. 
   
   
8. Design how to get back to business as normal. 
   
   As much as it is important to know when to escalate decisions and drive a sense of urgency, it is as important to determine the de-escalation approach, so the firm can transition back to business as usual, in an orderly, controlled and well-documented fashion. (See Prepare for post-event activities, below.)

Numerous key decisions on how to operate during a crisis should be made beforehand with the active participation of the firm’s senior leadership and, where necessary, the board. The tradeoffs involved have a direct impact on customer and counterparty perceptions of the organization, firm liquidity and legal exposures, among others, so they should be considered ahead of time: 

1. Establish processes for identifying the likely most-affected customers. 
   
   For each scenario anticipated, firms can prospectively identify the most important customers who will likely be most affected — especially those who use the firm across business lines and products. Ahead of time, firms should plan for how to prioritize communications to the most affected customers and which types of transactions and customers should switch over manual or partially automated processes, and consider what concessions could be offered, such as advice, fee waivers or extensions. 
   
   
2. Test playbooks and manual processes, and train employees to use them. 
   
   Firms should use simulations or tabletop exercises around continuity plans to identify and manage choke points and key supporting technologies, and to determine alternatives for each key process that supports customers. For example, if mobile networks and credit card networks are down, banks need a process to rapidly replenish ATMs. Firms should figure out how they would handle a surge in calls and branch visits, with processes for scheduling additional workers to support core functions. They should assess their onboarding requirements to validate they can bring on new resources quickly in times of needs. 
   
   
3. Assess potential exposures with suppliers and counterparties. 
   
   Firms should determine how they would assess the potential impact of a crisis on third parties and should establish contingency arrangements with major business partners, especially critical vendors. Firms have to keep in mind that that their response to a crisis (e.g., reduced withdrawal limits) may undermine confidence in its solvency and liquidity, so they need to prioritize communications with key vendors and counterparties to calm their nerves.
   
   
4. Understand and protect your “high-value assets.” 
   
   The term “high-value assets” (HVA) refers not to financial assets, but rather the assets of the firm that have enterprise-wide impact on operations, compliance and legal functions, as well as on reputational risk, liquidity risk and disaster recovery. Firms need to document and deeply understand their HVA inventory so that, in crisis, they know where those assets are and how they may be affected. This knowledge can guide business-impact assessments during a crisis and decision-making through to resolution. The inventory should include points of connectivity between key systems and resources for protecting customer data, so that using this information firms have identified ways to protect HVA during different scenarios, e.g., choke points for repelling a ransomware attack or approaches for quarantining compromised systems or data. 
   
   
5. Link crisis management and management of financial resources. 
   
   During crisis, firms need access to solid financial resources inside the firm or from outside, and those resources have to last a prolonged crisis. Firms need robust, tested financial contingency plans in place, which are linked directly to firmwide crisis management processes, so that, when crises hit, the crisis and operational teams can work effectively with treasury resources to manage liquidity. 
   
   
6. Determine documentation protocols. 
   
   As decisions are made during a crisis, it is important they be properly documented, especially when ones are made to go out of policy or take on more risks than is typically accepted. A robust, well-known process for documenting such decisions should be designed and implemented.
   
   
7. Consider how to maintain employee morale. 
   
   Most firms survive through crises because of the sacrifices of their employees — long, extended hours in the office dealing with the crisis. During prolonged crises, employees can become exhausted, and morale can be low. Firms should develop plans for how to maintain morale during crises, such as through internal communications, combat pay and other such ways to reward commitment.