Anyone adding new threats to their Risk Assessment/ Emergency Response procedures this year? Obviously some will be regionally biased but I'm still interested.

A recent comment from an examiner is causing us to add to our risk assessment and business continuity plan a section on how we will handle customer service/banking transactions during the time between a disaster striking and the time our emergency modular building arrives and is set up (we thought it was a nice short time frame: 24 - 48 hours). We felt we were pretty well covered with a paid contract with a company that provides a modular building within such a short time frame. Examiner strongly believes we either need a contract with an offsite emergency bunker type location for DURING that 24 - 48 hour wait period OR we need to add it to the risk assessment and assign a risk and report it to the Board and have them fully accept the risk if we decide not to. This is not something we had thought about.

Our examiner has advised us to periodically review our risks and update the assessments when needed. We review these risks quarterly in our meetings and document the discussions. This seems to satisfay the examiners so far.

Thank you for your comments!
WBY - That is a great insight. I have also experienced examiners tightening up and wanting to see the gaps filled. I can't speak to this specific point but I am seeing more of an expectation of holistic and continuous coverage of the plan(s).

Goal Keeper - this opens up a new question as to what you consider to be risks.

We include basic emergency response items in our handbook:
evacuation/ shelter,
pandemic,
fire,
earthquake,
power failure,
hurricane,
hazmat spill,
medical emergency
chemical & bio warfare exposure,
suspicious packages and bomb threats,
violence (including robbery),
civil disturbance,
wind (tornado),
nuclear,
wildfire,
water contamination,
flooding,
winter storm,
cyberterrorism/ identity theft/ data breach

We are in OK so there are doubtless more regionally specific threats. We do a high level risk assessment over all, then a more detailed assessment and monitoring for high risks. Response procedures are in a handbook for everyone that is separate from the BCM. This way we can educate and train without concern for strategy leaking or over-education.

Is this what you guys are doing? I'd like to continue to refine our product and see what is best practice.