Why the FFIEC’s pandemic statement was an evidence checklist

The week

On March 6, 2020, the Federal Financial Institutions Examination Council issued an updated interagency statement on pandemic planning for banks, credit unions and other supervised financial institutions. The FFIEC, as it is known, is a coordinating body for the federal agencies that supervise banks and credit unions. When it speaks, it speaks for the examiners who visit institutions to check how they are run. The statement arrived in a week when the world was changing by the hour, and its procedural tone hid a practical message for every bank and credit union board in the country.

The statement was not new rulebook material. It pointed institutions to existing guidance, including interagency pandemic planning material from 2006 and 2007, written when avian flu was the global worry, and the FFIEC Business Continuity Management booklet revised in November 2019. That booklet is the examiners’ handbook for judging whether an institution can keep running through a disruption. In effect, the regulators were saying: you already know what we expect, so make sure your plans actually reflect it.

Formally, the statement updated the 2007 interagency statement on pandemic planning and replaced an influenza preparedness advisory from 2006. The FDIC sent it to every institution it supervises, and to their service providers. It suggested routing it to the chief executive, the chief information officer, the chief information security officer and the head of human resources. That routing list was itself a signal. Pandemic planning was being framed as a matter for the whole management team, with technology as one part of it.

The statement emphasized three areas. Plans should address the potential effects of a pandemic on operations, on staffing and on service providers, the outside companies that run much of a modern bank’s technology and customer service. And plans should describe a scaled response as conditions changed, meaning a set of steps that grow stronger as a situation worsens, rather than a single switch from normal to emergency.

The text was more specific than its tone. It said a continuity plan should provide for five things. The first three were a preventive program, a documented strategy scaled to the stages of an outbreak, and a framework for continuing critical operations if large numbers of staff were unavailable for long periods. The last two were a testing program and an oversight program to keep the plan current. For the stages, it pointed to the six pandemic intervals described by the CDC.

It also set out planning assumptions that turned out to matter. Pandemics, it noted, tend to come in multiple waves, each lasting two to three months, so plans should cover recovery from one wave and preparation for the next. It cited a federal planning assumption that absenteeism in a severe pandemic could reach 40 percent in the peak weeks of a community outbreak. It asked institutions to plan for bringing staff back into the workplace, for customers shifting to online and telephone banking, and for actions by public health authorities that could affect operations.

On governance it was direct. The board, or a committee of it, and senior management should review and approve the pandemic plan at least annually. Test results should be reported to management and used to update the plan. The FFIEC had revised its Business Continuity Management booklet only four months earlier, so examiners had fresh criteria to apply.

Events then moved quickly. A few days later, federal and state financial regulators issued a joint statement encouraging institutions to work constructively with borrowers and customers affected by the outbreak. They signaled that reasonable flexibility for people struggling to pay, such as deferring payments or waiving fees, would be viewed favorably rather than criticized.

Markets and monetary policy were moving too. On March 3, the Federal Reserve made an emergency half-point cut to its policy rate, its first unscheduled cut since the 2008 financial crisis, citing the risks the virus posed to economic activity. Bank treasury and lending teams were working through the effects on margins and borrowers in the same days that operations teams were reopening their continuity plans.

On March 11, the World Health Organization characterized the outbreak as a pandemic.

So within a single week, banks and credit unions were told to check their plans, encouraged to help struggling customers, and confronted with a global emergency. Read today, the March 6 statement is most useful not as a warning but as a checklist: it told institutions, in advance, what evidence they would later be asked to produce.

The FFIEC statement created no new obligations. It restated expectations that had existed for more than a decade and asked institutions to make sure their plans reflected them. That might sound like a non-event, but it was not.

Read with hindsight, its most useful feature was that each expectation implied a record an examiner could later request. Bank examinations run on evidence. An examiner wants more than an assurance that an institution handled a crisis well; they ask to see what was decided, when, by whom and on what basis. An institution that kept good records during a crisis can answer those questions in an afternoon. One that did not may spend months reconstructing events from email and memory.

The statement asked boards and management to check three things: a staged response with clear triggers, critical operations with fewer people, and service providers facing the same disruption. Each maps to a different owner and produces different evidence.

How examiners look at a crisis afterward

For readers outside banking, a little background helps. Banks and credit unions in the United States are supervised by federal and state agencies. Supervision is ongoing oversight, quite different from a one-off inspection. Examiners from those agencies periodically review an institution’s finances, risk management and operations, and they can require changes when they find weaknesses.

Guidance documents, like the FFIEC booklet, tell institutions what examiners will look for. They are not laws in the usual sense, but an institution that ignores them should expect hard questions.

Records also protect the people who made the calls. A branch manager who closed early, or an operations head who approved a remote wire process, made a judgment with the information available that day. Months later, with hindsight, the same judgment can look careless. A dated note of what was known, and why the choice was made, lets the decision be assessed against the facts of that day rather than facts that emerged later. People who know their reasoning will be judged fairly are more willing to decide quickly.

Who examines whom

Which examiner arrives depends on the charter. The Office of the Comptroller of the Currency supervises national banks and federal savings associations. The Federal Reserve supervises state-chartered banks that are members of the Federal Reserve System, as well as bank holding companies. The FDIC supervises state-chartered banks that are not members. State banking departments examine state-chartered banks alongside the federal agency, often alternating or sharing examinations. The National Credit Union Administration supervises federally insured credit unions, together with state regulators for state-chartered ones.

All of these agencies sit on the FFIEC, alongside the Consumer Financial Protection Bureau and a committee representing state regulators. This explains why one FFIEC statement could speak for every examiner a bank or credit union is likely to meet. It is also why the evidence an institution keeps should be the same whichever agency asks.

Scale changes the evidence, not the principle

A large bank typically has a dedicated continuity team, an operational risk function that challenges the business, and an internal audit department that tests the plan independently. Its evidence is produced by several groups and has to be consistent across them.

A community bank may have one person who owns continuity alongside other duties, and an outsourced internal audit. A credit union adds its supervisory committee, which federal law requires and which oversees audit. For smaller institutions, the risk is that the record depends on one busy person. Simple formats and a named deputy for record-keeping matter more there than any software.

The principle does not change with size. Every institution should be able to show what it decided, when and on what basis. Only the volume of evidence and the number of hands it passes through differ.

What an examiner actually asks for

An examination usually begins with a request list sent ahead of time. For business continuity, it typically asks for the policy and plan, the business impact analysis, the risk assessment, recent test results and the board minutes in which the plan was approved. It often asks for the files used to monitor critical service providers.

On site or remotely, examiners then interview the people named in the plan and test whether reality matches the documents. A plan that names a decision-maker who has never seen it, or a test report that lists issues with no follow-up, tells the examiner more than the plan itself. Findings feed into the management assessment that every supervisory rating includes.

Reading the statement as a request list

Each of the statement’s five elements implies a record. The preventive program implies dated communications to staff and a record of what was being monitored. The scaled strategy implies stage definitions and a log of moves between them. The framework for critical operations implies a list of those operations, with tested remote capacity and backups. The testing program implies results reported to management. The oversight program implies board approval at least annually.

An institution that read the statement that way in March 2020 could have built its evidence file as events unfolded. Doing so is far cheaper than building the file from memory a year later.

Supervision looks backward as well as forward. After a major event, examiners want to understand how the institution actually behaved, as well as what its plan said it would do. That is why records matter so much. A plan is a promise. A record is proof that the promise was kept, or an honest account of where it was not.

An airline cockpit works the same way. Pilots follow checklists, and the flight recorder captures what actually happened. After an incident, investigators rely on the recorder, not the checklist. The FFIEC statement, in effect, told institutions to make sure their flight recorders were switched on.

A staged response with clear triggers

Pandemic guidance from the avian flu period expected plans to scale up as conditions worsened, from monitoring to restricted travel to split teams to widespread remote work. Split teams means dividing staff into groups that never work in the same place at the same time, so that illness in one group does not take out the other.

Stages without triggers

Many institutions had the stages written down but not the triggers: who decides to move from one stage to the next, on what information and how quickly. Without triggers, decisions are made ad hoc, at different speeds across business lines and locations. One branch might close while a similar branch nearby stays open, simply because two managers read the news differently.

What the statement said about stages

The March 2020 statement was concrete about stages. It pointed institutions to the CDC’s six intervals of a pandemic, which run from investigation of a new virus through recognition, initiation and acceleration of spread, to deceleration and preparation for later waves. It asked management to monitor alerts from health authorities and to tell employees and key service providers in advance what it would do at specific triggering points.

Two features of that framing are easy to miss. The stages were defined by external conditions, not by what the institution happened to be doing. And the triggers were meant to be communicated before they fired, so that staff and providers could prepare. Both features depend on writing triggers down ahead of time.

Indicators that can actually be observed

Good triggers rely on information the institution can see quickly and reliably. Public health orders in the counties where branches and operations centers are located qualify. So do absence rates in specific critical teams, school closures affecting staff, and the stated status of key providers. National headlines and stock market moves are poor triggers, because they say little about conditions at a particular branch.

The obvious objection is that triggers cannot anticipate every situation, and that rigid rules can force the wrong move. That objection is fair. The answer is that a trigger should start a decision, not make it. When an indicator crosses its threshold, the named decision-maker must decide and record the decision, including a decision not to move. Judgment stays in place, and the record shows it was exercised.

Coming back is a stage too

The statement asked for plans to bring staff back into the workplace, and that stage needs the same discipline. Reopening involves reversing temporary arrangements: restoring controls that were adapted, retrieving equipment issued for home use and closing remote access granted in a hurry. Without a record of what was changed on the way out, there is no list to work from on the way back.

A good plan names the decision-maker and the indicators for each stage, such as local public health orders, staff absence rates and the status of key suppliers. It also states what each stage changes in practice: which branches open and in what form, which staff work remotely, which processes pause and which customer messages go out.

The evidence: a decision log

The evidence is a decision log. Each entry records the date, the stage, the information relied on and who approved the move. It need not be sophisticated; a well-kept spreadsheet will do.

A credit union board that can show a dated sequence of decisions is in a far stronger position than one that can show only the plan document. Board minutes should reflect the same sequence, since directors are expected to oversee the plan rather than approve it once a year.

The log also helps after the event, when management reviews which triggers worked and which were ignored. That review is how a plan improves from one crisis to the next.

Critical operations with fewer people

The statement asked institutions to consider the effect of significant staff absence over an extended period. In practice that means identifying critical operations, such as payments, deposit operations, lending operations and customer support, and confirming that each can run with reduced staff, including staff working remotely.

Remote capacity: a question with a number

Remote capacity was the immediate technical question, and it had a measurable answer: concurrent remote sessions supported compared with the number of operations staff who would need them. “Concurrent” means at the same time. A system that comfortably supports a hundred people logging in at different points in the week may fail when four hundred try at nine o’clock on a Monday.

Could the institution support most of its operations staff on remote access at once, with enough laptops, authentication tokens and licenses? Authentication tokens are the small devices or phone apps that generate a one-time code, proving that the person logging in is who they claim to be. Without one, a staff member at home may be unable to log in at all.

Remote access is a security decision as well

The statement flagged the strain telecommuting could put on capacity, bandwidth and authentication. It also noted that employees who normally worked on site might lack remote access authority or the equipment to work from home. Granting that access at speed is a security decision. Banks are subject to the interagency guidelines on safeguarding customer information, and federally insured credit unions to NCUA’s parallel rule, so expanding access does not suspend those obligations.

The useful record here is simple: who was granted remote access, on what date, with what authentication, using which device, and when the access was reviewed or removed. Examiners and auditors asked exactly these questions once the first wave passed. An institution that issued personal-device access without multi-factor authentication, and kept no list, faced an uncomfortable conversation.

Controls that assume people are in the room

Controls that relied on physical presence, such as dual control in vaults, wet signatures or paper approvals, had to be adapted without weakening them. Dual control means that two people must be present to perform a sensitive task, such as opening a vault, so that no single person can act alone. A wet signature is a handwritten signature on paper. Both are hard to perform from two separate kitchens.

Each adaptation needed a record: the original control, the temporary version, the risk it introduced, the compensating measure and the approval. A compensating measure is an extra safeguard that makes up for a weaker control. For example, if a payment that normally required two signatures in the office is now approved by two people over a video call, a compensating measure might be a daily review of all such payments by a third person.

Examiners and auditors would later ask how controls operated during the period, and a contemporaneous record answers that question far better than reconstruction months later. “Contemporaneous” simply means written at the time, which is what makes it credible.

Paper, signatures and the law

Many paper-based controls turned out to rest on habit more than law. The federal E-SIGN Act of 2000 gives electronic signatures legal effect for most transactions, with specific exceptions. Some documents, such as those requiring notarization, depended on state law, and many states issued emergency orders in 2020 allowing remote notarization.

Each switch from paper to electronic process deserved the same short record as any other control change: what changed, under what legal basis, with what safeguards and who approved it. Counsel should confirm the legal basis for each document type. Several of those temporary switches proved better than the paper process they replaced and became permanent, which is easier to justify when the original decision is on file.

Planning at 40 percent

The statement’s 40 percent absenteeism assumption gives a concrete way to test the critical operations list. For each operation, apply that rate to the team that performs it and see who is left. A five-person wire room becomes three. A two-person core administration team may become one, or none.

Run that arithmetic for every critical operation and the weakest points appear quickly. The result can be recorded with the date, the assumptions and the actions agreed. That record is exactly what an examiner hopes to find when asking how management assessed staffing risk.

The one-person problem

Smaller institutions faced a particular problem. Key functions such as BSA monitoring, wire release or core system administration might rest with one or two people. BSA refers to the Bank Secrecy Act, the federal law requiring institutions to watch for and report signs of money laundering. Wire release is the final approval that sends a large electronic payment. The core system is the central software that keeps track of every account, balance and transaction, the institution’s master ledger.

For a community bank or credit union, documented backups for those roles, with access already granted and tested, were the single most valuable preparation.

Customers asking for help

Customer-facing operations needed the same treatment. Branch closures shifted demand to phones and digital channels, and the joint statement encouraging work with affected borrowers created new requests for payment deferrals and fee waivers.

Contact centers needed scripts, authority limits and a way to record every accommodation granted, so the institution could later show consistent and fair treatment. Authority limits set how much flexibility each staff member can offer without a supervisor. Without records, two customers in identical situations might receive different answers depending on who picked up the phone, which is both unfair and hard to defend.

Relief decisions carry fair lending risk

Inconsistent relief is a legal exposure as well as a fairness problem. The Equal Credit Opportunity Act and Regulation B prohibit discrimination in any aspect of a credit transaction, and that reaches decisions about deferrals, modifications and fee waivers. If accommodations differ between borrowers in similar circumstances, the institution needs to be able to show that the difference had a legitimate, documented reason.

Credit reporting added another layer. The CARES Act, signed on March 27, 2020, required lenders that granted accommodations to borrowers who were current to keep reporting those accounts as current. Getting that right depended on knowing exactly which accounts had been granted an accommodation, and when. An institution with a clean record of every accommodation could meet that requirement. One that granted relief by phone without a record could not reliably do so.

Regulatory filings did not pause

Some obligations ran on fixed clocks throughout. Suspicious activity reports are generally due within 30 days of detecting the facts that call for one. Currency transaction reports are due within 15 days. Quarterly call reports and credit union call reports kept their schedules. FinCEN asked institutions in mid-March 2020 to contact it if the pandemic threatened their ability to file on time.

Fraud did not pause either. Scams exploiting the pandemic appeared quickly, and the monitoring teams expected to catch them were among those working from home. An institution that can show its monitoring kept running, with alerts reviewed and reports filed on time, has answered one of the questions examiners were most likely to ask.

Service providers facing the same disruption

Most banks and credit unions depend on core processors, card processors, call center vendors and technology service providers. A core processor is an outside company that runs the core system for the institution, often for hundreds of institutions at once. For a small bank, the core processor may effectively be its operations department.

The statement expected institutions to understand their providers’ pandemic plans. That is harder than it sounds. Providers serve many institutions and may prioritize in ways that individual clients cannot influence, and some depend on offshore operations subject to different public health measures.

Ask specific questions

Specific questions produce useful answers: which critical services depend on a provider’s staff being on-site, where those staff are, what the provider’s plan is if those sites close, and how it will notify clients of degraded service. Answers to those questions are worth more than a copy of a generic continuity plan.

Provider notices are records too

During 2020, providers sent a steady stream of notices: changed support hours, delayed file processing, suspended change requests, staff moved to home working. Each notice told the institution something about its own risk. Many institutions read them and moved on.

A better habit is to log each notice in the provider file, note which internal process it affected and record what the institution did in response. Over a few months, that log shows which providers degraded and how badly. It becomes the most useful input to the next contract renewal and the next due diligence review, because it describes how the provider actually behaved under strain.

What the agencies already examine

Smaller institutions have one advantage here that is often overlooked. Under the Bank Service Company Act, the federal banking agencies can examine significant technology service providers, including the largest core processors. Client institutions can request the resulting reports of examination from their own regulator. Those reports do not replace an institution’s own due diligence, but they give a view of the provider that no single small client could obtain through its own questions.

The statement also encouraged institutions to work with peers. It suggested coordinating through business and community groups and considering cooperative arrangements with other institutions in the same area. For community banks and credit unions that share a core processor, a joint set of questions put through a user group is more likely to get a substantive answer than a dozen separate requests.

Why an audit report does not answer the pandemic question

Many institutions rely on a provider’s SOC 1 or SOC 2 report, an independent auditor’s report on the provider’s controls over a defined period. Those reports are valuable, but they describe how controls operated in normal conditions. They rarely test whether the provider can keep delivering with a large share of its staff absent for months. The pandemic question has to be asked directly, and the answer kept in the provider file.

Plan for slow as well as stopped

Institutions also have to plan for degraded service rather than outright failure. A core processor running with reduced staff might process files later than usual, answer support calls slowly or defer changes. Manual workarounds and member messaging for those cases are more realistic than plans for a complete outage, and degraded service is what most institutions actually experienced in 2020.

The difference matters. A plan for a total outage often assumes a dramatic switch to backup arrangements. A plan for degraded service asks humbler questions: if overnight files arrive three hours late, what do branch staff tell customers about their balances, and who decides?

The evidence: a file for each provider

The evidence here is a file for each critical provider: the questions asked, the answers received, follow-up on gaps, and any service problems logged during the event.

Institutions should check with counsel and their regulators on documentation expectations, but one principle holds: if a control or dependency changed, write down how, why and who approved it.

Two credit unions, one difference

Take two credit unions of similar size, each with a handful of branches and a core processor.

The first had a pandemic plan with four stages, but no triggers. As events moved, its chief executive made sensible decisions by phone and email. Branch hours changed, staff went home, a wire approval process was moved to video calls, and members were offered payment deferrals. When examiners later asked how decisions had been made and how controls had operated, the team spent weeks searching inboxes and interviewing staff, and could not fully explain why one branch had stayed open longer than the others.

The second had the same four stages, each with a named decision-maker and simple indicators. It kept a one-page decision log, updated after each move and reported to the board. It recorded each temporary control change on a short form, including a daily third-person review of wires approved remotely. It kept a folder for its core processor with the questions asked and the delays logged. Its contact center recorded every deferral granted. When examiners asked, the answers were on the table within a day.

Both credit unions made broadly similar decisions, but only the second could show examiners how and why it made them.

The difference also showed up beyond the examination. When the second credit union’s board reviewed the response that summer, it could see which triggers had worked, which control changes were still in place and which provider had caused the most disruption. The first credit union’s board had only management’s recollection, and no way to test it.

Why records pay off beyond the examination

The records the statement implied are more than paperwork for regulators. They serve the institution at least as much as they serve its supervisors.

• Money. Undocumented control changes can turn into audit findings, remediation programs and consultants’ fees long after the crisis has passed. A short form completed at the time is far cheaper than a reconstruction project later.
• Risk. Temporary workarounds have a habit of becoming permanent. A record of each one, with its approval, makes it possible to find and retire them when normal conditions return, instead of discovering a weakened control a year later.
• Customers and members. Recorded, consistent relief protects people from arbitrary treatment and protects the institution from complaints that it played favorites.
• Staff. Clear triggers and named decision-makers spare branch and operations managers from guessing. People under pressure work better when they know who decides.
• Reputation. An institution that can explain calmly and precisely how it behaved in a crisis earns trust from its board, its regulators and its community.

There is also a learning benefit that is easy to miss. The decision log, the control change records and the provider files are the raw material for an honest review after the event. Without them, the review relies on memory, and memory tends to remember the decisions that went well.

Auditors ask the same questions

Examiners are not the only audience. Insured depository institutions above certain asset sizes must file annual management reports under the FDIC’s Part 363 rules, and larger ones need an auditor’s attestation on internal control over financial reporting. Public holding companies face similar requirements under the Sarbanes-Oxley Act, and must disclose any change during the quarter that has materially affected, or is reasonably likely to materially affect, that internal control.

A temporary control change made during remote operations can fall within that scope, for example a change to how journal entries or wire approvals are reviewed. The external auditor will want to know when it started, how it worked and whether it was effective. The same short record that answers an examiner answers the auditor, and avoids paying twice for a reconstruction.

The objection that records slow decisions down

The strongest case against this argument is that documentation competes with action. In the first weeks of a crisis, managers are making dozens of decisions a day. Asking them to fill in forms can delay decisions that need to be fast, and it can push people toward the defensible choice rather than the right one.

That concern is real, and the design of the records should respect it. A decision log entry needs a date, a decision, the reason in one line and a name. A temporary control change needs a short form, not a memorandum. Many institutions assigned one person, often from risk or compliance, to keep the log during crisis calls, so that decision-makers did not have to. The aim is a record good enough to reconstruct what happened, kept by someone other than the people under the most pressure.

Where the objection does hold is in volume. Records that try to capture everything end up capturing little, because nobody keeps them up. Fewer, shorter records, kept consistently, are worth more than a comprehensive template abandoned in week two. The test of a record format is whether it is still being filled in a month later.

The record-keeping habit, and where it breaks down

Drawn from the statement and from the experience that followed, the habit looks like this:

• A staged plan with named decision-makers and clear indicators for each step.
• A dated decision log, mirrored in board minutes.
• A list of critical operations, each with tested remote capacity and documented backups.
• A short record of every temporary control change, with its compensating measure and approval.
• A file for each critical provider, built from specific questions rather than generic documents.
• Consistent, recorded treatment of customers who ask for help.

Where it breaks down:

• Stages without decision rights. A plan that describes what to do but not who decides when.
• Undocumented workarounds. Sensible changes to controls that nobody wrote down, which later look like control failures.
• Backups on paper only. Named backups for critical roles who have never logged in to the systems involved.
• Generic vendor assurance. Accepting a provider’s standard continuity document instead of asking how it would cope.
• Planning only for total outage. Ignoring the more likely case of slow, partial service.
• Inconsistent customer relief. Accommodations granted case by case with no record, inviting complaints of unfair treatment.

The breakdowns share a cause. Each is a decision that was made but not written down, or a dependency that was assumed but never checked. No item on that list needs new technology to fix, only an owner and a habit.

Evidence the board should expect to see after a disruption

1. Who decides when we move from one stage of our continuity plan to the next, and on what information?
2. When we change a control temporarily, where is that recorded, and who approves it?
3. Which critical roles, such as BSA monitoring, wire release and core system administration, rest with one or two people, and do their backups already have working access?
4. What is our plan if a provider becomes slow rather than unavailable?
5. If an examiner asked tomorrow how we behaved in our last major disruption, could we hand over the decision log, control change records and provider files within a day?

The March 6 statement asked nothing new. What it did, for anyone reading carefully, was describe the evidence of good management before the test began.

With hindsight

The test came almost immediately. Within two weeks of the statement, most institutions had moved to their most severe planned stage, with branches limited to drive-through or appointment service and back-office staff largely remote.

The technology mostly held. Core processing and payment systems held up well, which reflected years of investment in resilience: backup data centers, redundant networks and well-practiced recovery procedures. The weaker points were people-dependent processes and paper-based controls that had to be redesigned in days. The vault that needed two people, the approval that needed a wet signature and the specialist role held by one person were where the strain showed.

Customer relief turned out to be the biggest new source of records. Within weeks, the agencies issued an interagency statement on loan modifications for borrowers affected by the pandemic. The CARES Act followed on March 27, with relief from troubled debt restructuring accounting for qualifying modifications and new credit reporting rules for accommodations. In early April, lenders began taking applications for the Paycheck Protection Program, often under enormous time pressure. Each of these produced decisions that institutions would later need to explain. Accounting standard-setters later removed the troubled debt restructuring category altogether, in a 2022 update that replaced it with disclosures about modifications made to borrowers in financial difficulty. The need to record each modification and its reason did not go away, and examiners kept asking for it.

Some of those explanations were required years later. In June 2023 the Small Business Administration’s inspector general estimated that more than $200 billion in pandemic loans under the Paycheck Protection Program and the disaster loan program were potentially fraudulent. Lenders that had kept clear records of what they checked, and when, were better placed when questions about individual loans arrived.

The examinations themselves changed shape. During 2020 much supervisory work moved offsite, and examiners relied on documents sent electronically and on interviews by video. That made the quality of an institution’s records more visible, not less. A well-organized evidence file could be shared in a day. A response assembled from inboxes showed its gaps on the screen.

Supervisors drew conclusions quickly. In October 2020, the Federal Reserve, the OCC and the FDIC, three of the main federal banking regulators, published sound practices to strengthen operational resilience at the largest banks. The shift was subtle but important: attention moved from recovering systems to continuing critical operations within defined tolerances. A tolerance here is the amount of disruption an institution decides it can accept for a service, such as how long payments can be delayed. Beyond it, customers or the wider financial system are seriously harmed.

Notification became time-bound as well. A rule from the federal banking agencies, with compliance required from May 2022, obliges banks to notify their primary regulator within 36 hours of determining that a significant computer-security incident has occurred. Service providers must notify their bank customers when an incident is likely to disrupt services for four hours or more. NCUA adopted a 72-hour reporting rule for federally insured credit unions that took effect in September 2023. Both rules reward the same habit the 2020 statement implied: knowing, and recording, what happened and when.

In June 2023 the banking agencies finalized interagency guidance on third-party risk management, the discipline of understanding and managing the risks that come from relying on outside companies. It brought the agencies’ expectations about service providers into a single, shared document.

The records the March 2020 statement implied, decision logs, temporary control changes and provider files, are the same evidence those later frameworks ask for. The difference is scope. That evidence is now expected for any severe disruption, whether a cyberattack, a major provider outage or a natural disaster, rather than for pandemics alone.

The practical message has not changed since March 2020. Good decisions under pressure matter. So does being able to show, afterward, what was decided, why and by whom. Institutions that build the habit of writing things down in calm periods find it far easier to keep in a crisis.