AL 99-8 Subject: Additional Year 2000 Guidance on Contingency Planning Date: May 10, 1999 TO: Chief Executive Officers of National Banks, Federal Branches, Service Providers, Software Vendors, Department and Division Heads, and Examining Personnel This advisory is being sent to alert you to the recent release of FFIEC guidance, "Additional Questions and Answers Concerning Year 2000 Business Resumption Contingency Planning." The guidance clarifies FFIEC expectations for the completion of the validation phase of business resumption contingency planning by June 30, 1999, documentation requirements, and the role of "event planning" in the development of business resumption contingency plans. FFIEC guidance issued last year directed financial institutions to develop business resumption contingency plans and to validate those contingency plans by designing a method to test them by June 30, 1999. Accordingly, the FFIEC expects financial institutions to complete the following by June 30: (1) review of the business resumption contingency plan and validation processes by a qualified and independent party; and (2) review and approval of the business resumption contingency plan and the method of validation of the business resumption contingency plan by senior management and the board of directors. The attached guidance clarifies that financial institutions may execute tests of business resumption contingency plans after the June 30, 1999 milestone provided that such tests are conducted early enough to allow ample time to make necessary changes and to retest business resumption contingency plans, if necessary. Institutions should report to their board of directors on the outcome of business resumption contingency plan tests. The FFIEC defines "event planning" as a proactive and detailed planning process that covers specific operations prior to and during the century date change. It entails monitoring and detecting problems and resolving issues related to whether and how to implement business resumption contingency plans. Event planning is a sound risk management practice that can make Year 2000 business resumption contingency plans more effective. The FFIEC encourages, but does not require, financial institutions to develop event plans. However, operationally complex institutions or institutions that are especially vulnerable to Year 2000-related risks should give special consideration to developing event plans. The FFIEC guidance is available on the OCC's Web page at www.occ.treas.gov. For more information on Year 2000 issues, contact Year 2000 Supervision Policy at (202) 874-2340. Emory W. Rushton Senior Deputy Comptroller, Bank Supervision Policy Attachment