Covid–19 coronavirus: prompts for board members

Board members need to not only consider and deal with events as they arise real-time, but also need to look forward and attempt to envision the impact of decisions made, or not made, today and whether these could constitute a regulatory issue. Boards should be cognisant of the need to engage with the executive whilst also allowing the executive the space to manage the firm in times of stress.

Set out below are some prompts designed to help Board members ask themselves the right questions to guide the conversations they have, the management information they request, and the decisions they make today to protect the firm for tomorrow. How relevant each of the items is to a particular firm would clearly depend in part on the nature, size, scale and complexity of the firm in question.

Operational

• Is the board clear on the efficacy of your firm’s Business Continuity Planning (BCP) arrangements? Are the contingency plans calibrated to the potential stages of the outbreak? Is the firm clear on its operational and IT capacity for longer term contingency arrangements being in place?
• Does the board understand your firm’s incident management framework and the protocols for how the board is provided with updates on decisions?
• Does the board understand the roles (if any) of the senior executive committee members in incident management and how in the moment decisions are made? Is the board clear on its role in incident management, including how the board can assess the adequacy of the approach given the nature of the issues?
• Has the executive kept the board informed on the latest analysis with regard to risks to material change programmes?
• Is the firm clear on protocols for ensuring that updates and communications to staff are based on information from reliable/official sources?
• How has the firm engaged with key third parties / outsourced service providers to understand their BCP arrangements and any potential impacts on critical services?
• Are the firm’s cyber security arrangements being reviewed to reflect potentially increased risks for customers and the firm?

Financial and strategic

• Does the board understand how aligned the firm’s stress tests are in severity and volatility to a Covid-19 coronavirus induced stress scenario? Is the firm’s previously agreed range of management actions appropriate in light of the nature of the stress? If revised planning is required, how are the board being kept informed?
• Does the executive judge that there is a need to revisit/revise the nature of the stress tests in light of recent/current customer/client behaviour and the impacts in markets?
• Is the board clear on the thresholds for providing market updates in light of the potential and actual impacts on the current and prospective financial performance of the firm?
• Are board members clear on their Senior Managers and Certification Regime (SMCR) statement of responsibilities and the need to ensure that decisions that may need to be taken are in line with the obligations under SMCR?
• Is the board aware of any actual or proposed changes to capital buffers by the PRA in response to the coronavirus outbreak and the PRA’s expectations around dividends, distributions and remuneration?
• Is the firm implementing any emergency measures that the government and regulators have outlined to provide payment relief to customers and have the direct or indirect impacts of these measures been taken into account in financial reporting and risk modelling?

Risk appetite

• Does the board understand the interplay between the current business performance and the early impacts of coronavirus on the business of the firm?
• Does the board understand how the revised stresses could impact across all board risk appetite measures? Has the board rehearsed the risk response – mitigate, manage, tolerate
• Is the board clear on its fiduciary duties with regard to the decisions that may need to be taken in light of the stress scenario materialising?
• Is the firm prepared with regard to its communication strategy in this regard for all stakeholders (shareholders, clients, customers)?

Customers, clients and markets

• Has the board been updated on the potential impact on customers and the firm’s planned response? Does this cover anticipated/actual vulnerable customers? Is the firm clear on its approach to determining whether to deviate from existing customer treatment approaches in light of the impact of coronavirus? What are the principles that will govern decision making?
• Is the firm clear on the approach being adopted by key third party vendors/suppliers in their interactions with the firm’s customers (eg for a retail bank where insurance is underwritten by a third party)? Do the third party approaches align with the values of the firm? How is the executive ensuring that consistency will be maintained as the situation changes over time?
• Is the firm clear on its approach to customer treatment in terms of strict adherence to terms and conditions vs. providing flexibility to deliver fair customer outcomes?
• Has the board been provided with updates on how provision of service for clients and customers will be continued in a range of short and longer term scenarios?
• Has the firm considered how it controls the risks of an adverse impact on markets arising out of the coronavirus situation?

People

• Have management been provided with briefings on likely key concerns from staff?
• Have plans for dealing with staff who contract coronavirus been tested and rehearsed?
• Is the board clear on thresholds for continuity of service in light of staff absences?
• Do relevant employees have appropriate guidance on best practice when working remotely?
• Is appropriate discretion being afforded to management to decide the approach to take for teams/individuals?
• Are the executive effectively monitoring the risk of poor staff/market conduct?
• How do firms ensure that employees’ wellbeing is appropriately monitored on an on-going basis?
• Is the board comfortable with the measures proposed to identify and address cultural issues arising from operating a disconnected/remote workforce?