People and Process: Pandemic-Era Lessons for Modern Resilience
ERM Pilot | Business Continuity & Resilience Series, Part 3 of 3 by William Hord - Chief Strategy Officer
Five years after the onset of COVID-19, the pandemic's operational legacy in financial services is complicated. Institutions that were forced to rapidly digitize workflows, deploy remote work infrastructure, and maintain service delivery without physical branch access discovered capabilities they didn't know they had — and vulnerabilities they hadn't previously considered.
The question for business continuity management today is which of those lessons have been institutionalized and which have quietly eroded as organizations returned to normal operations.
What Regulators Have Taken From the Pandemic
The OCC has noted that failure to "upgrade systems and digitize" risks market share losses and operational fragility — a lesson the pandemic illustrated in real time. Institutions with paper-heavy workflows, wet-signature requirements, and branch-dependent processes were operationally disadvantaged during lockdown periods in ways that have lasting competitive and resilience implications.
The FFIEC's BCM framework has evolved to incorporate workforce continuity as a explicit element — not just the continuity of technology systems, but the continuity of the human capacity to operate them. This includes secure remote access infrastructure, workforce cross-training, and documentation of critical processes that does not depend on institutional memory residing in a single person.
The NCUA's 2026 Supervisory Priorities Letter references workforce resilience indirectly through its emphasis on operational continuity — credit unions are expected to demonstrate that their operations can continue across a range of disruption scenarios, including those that affect staff availability.
Remote Work Infrastructure as a Resilience Asset
The remote work infrastructure deployed during COVID-19 is a resilience asset — but only if it is maintained. An institution that deployed VPN infrastructure, cloud-hosted collaboration tools, and remote-capable workflows in 2020 and has since allowed that infrastructure to deteriorate as in-person operations normalized has lost a material resilience capability.
Examiners are beginning to ask whether pandemic-era remote work capabilities remain functional and tested — not just whether they were deployed five years ago. An annual test of remote work capability for critical functions is a practical and defensible standard. Can your loan officers process applications remotely? Can your member service team handle call volume from distributed locations? Can your leadership team conduct board meetings and make time-sensitive decisions without physical co-location?
Workforce Cross-Training and Succession
One of the most significant pandemic-era vulnerabilities was key-person dependency: critical processes that relied on a single staff member's knowledge, access, or institutional relationships. When that person became unavailable — through illness, quarantine, or caregiver obligations — the process broke.
The Federal Reserve's supervisory framework and the FFIEC BCM Booklet both reference succession planning and cross-training as elements of sound continuity governance. For credit unions and community banks, where staffing is lean and role specialization is common, this is particularly acute. The BCM objective is not to eliminate specialization — it is to ensure that specialized knowledge is documented and that backup capability exists for critical functions.
Supply Chain Resilience Beyond IT
The pandemic surfaced supply chain vulnerabilities that most financial institutions had not previously considered in their BCPs: PPE for branch staff, paper currency logistics for ATM networks, office supply chains that suddenly mattered when remote work infrastructure needed to be physically shipped to employees' homes.
While these may seem peripheral compared to technology and operational continuity, the OCC's FY2025 guidance directs examiners to consider the full scope of external shock scenarios — including physical supply chain disruptions. BCPs that address only technology and operational continuity may miss physical supply chain dependencies that matter during extended disruptions.
Building Durable Resilience Capabilities
The goal of pandemic-era lessons is not to maintain a permanent state of emergency preparedness — it is to institutionalize the capabilities that emergency conditions revealed. This means:
— Remote work infrastructure that is maintained, tested, and current, not archived — Cross-training programs that are documented and refreshed, not completed once and forgotten — Critical process documentation that does not depend on institutional memory — Periodic exercises — at least annually — that test workforce continuity under realistic conditions
Regulators will continue to evaluate whether pandemic-era lessons produced durable capability or temporary adaptations that have since lapsed. The institutions that will perform best in those evaluations are the ones that treated the pandemic as a curriculum, not a crisis to survive.
ERM Pilot's Business Continuity module tracks plan completeness, review dates, and linked processes — so resilience capabilities are maintained and documented, not just deployed during crises. Start your free trial at ermpilot.com.
Article References —
1. Federal Financial Institutions Examination Council. Business Continuity Management. IT Examination Handbook. Washington, D.C.: FFIEC, November 2019. Available at: https://ithandbook.ffiec.gov/it-booklets/business-continuity-management
2. Federal Financial Institutions Examination Council. 'Financial Regulators Revise Business Continuity Management Booklet to Stress to Examiners the Value of Resilience to Avoid Disruptions to Operations.' Press Release, November 14, 2019. Available at: https://www.ffiec.gov/news/press-releases/2019/pr-11-14
3. Office of the Comptroller of the Currency. Semiannual Risk Perspective, Spring 2025. Washington, D.C.: OCC. Available at: https://www.occ.gov/publications-and-resources/publications/semiannual-risk-perspective/files/semiannual-risk-perspective-spring-2025.html
4. Office of the Comptroller of the Currency. Fiscal Year 2025 Bank Supervision Operating Plan. Washington, D.C.: OCC, October 2024. Available at: https://www.occ.gov/news-issuances/news-releases/2024/nr-occ-2024-111a.pdf