scotiabank crisis communications plan

2010

APRIL 2010

CRISIS COMMUNICATIONS PLAN

2 Scotiabank Crisis Communications Plan

Introduction

Message from our CEO

As a world-class corporation that manages some $500 billion in assets belonging to

millions of Canadian and global customers, we at Scotiabank have an obligation to plan for any

eventuality that may harm the well-being of our business and reputation. It’s not just our assets

that we are safeguarding, it’s the hard-earned dollars of everyday people around the world.

That raises our obligation to the highest standard.

People don’t like to talk about the potential of “things going wrong.” But we must.

Unfortunately, crises are a fact of life. Disasters, accidents, mistakes and, yes, even criminal acts

occasionally happen. We must be particularly mindful of attempts to “hack” or steal banking

information, PIN numbers and other confidential information. While we can take some well-

meaning steps to ward these events off, we can’t avoid them entirely. One of the core values

that define a good corporation is how it plans and deals with crises. We must be prepared.

That’s the reason for this crisis communications plan.

I thank all those employees who had a hand in drafting this plan. Their dedication to

protecting Scotiabank, our enviable reputation and our well-being is to be commended.

Yours sincerely,

Rick Waugh


Crisis Communications Plan -- Purpose and Objectives

The general purpose of Scotiabank’s crisis communications plan is to ensure we have the

knowledge, training, resources and information channels to quickly and effectively deal with a crisis.

More specifically, this plan will help us:

1. Protect the value of the assets we manage

Our primary business and obligation is to protect the assets of customers who put their trust in

us. We manage some $500 billion in assets for customers around the world, from families and

pensioners to the wealth of major corporations.

2. Protect our reputation

The success of Scotiabank is built on an enviable reputation that has been built up over more

than 170 years. Our reputation is built on longevity, financial stability, protecting the assets of

customers, our team of employees, and our deeds and actions in the many communities we

serve. Our reputation is our most precious resource.

3. Protect our sales and market share

Scotiabank has grown and prospered over the years by not only building on the past, but also

looking to the future. Our values emphasize the need to be innovative and responsive to the

needs of our many customers. We continue to build our presence in Canada and around the

world by stressing customer service.

4. Spell out protocols to follow

In the event of a crisis, this plan spells out the protocols and procedures employees – from the

President’s office to the customer service associate – will follow to mitigate the impact on

Scotiabank’s business and reputation.


Inventory of Vulnerabilities

1. CEO dies suddenly

2. Employee defrauds company

3. Employee defrauds customers

4. Employee accused of high-profile crime

5. Insider trading

6. Successful class-action lawsuit over unpaid overtime (now before courts)

7. Computer system crashes

8. Internet banking system crashes

9. Telephone system crashes

10. Hacker breaks into system

11. Terrorist attack on branch or office

12. Natural disaster hits branch

13. Fire hits branch

14. Power outage

15. Stock market crash

16. “Run” on bank, with customers demanding their cash

17. Discrimination/human rights violation

18. Accusation of unfair labour practices

19. Labour dispute

20. Union certification drive

21. Backlash over executive bonuses

22. Sexual assault on company property

23. Workplace violence

24. Robbery

25. Hostage taking

26. High-profile foreclosure of home, business or farm

27. Outbreak of communicable disease

28. Pandemic

29. New government regulation

30. Government probe or investigation

31. Widespread crisis in banking

32. Layoffs

33. Corporate takeover – hostile

34. Corporate merger

35. Protests

36. Boycotts

37. Security threat – irate customer

38. Vandalism

39. Reputation attacked or threatened

40. Hike in rates – example: credit card fees, banking rates, mortgage rates

41. Internal financial crisis – example:

bankruptcy, creditor protection

42. Sudden drop in stock value

43. Chairman of board of director dies


SCOTIABANK RISK ASSESSMENT

Highly probable

--Robbery --Hostage taking --High profile

foreclosure of home, farm, business

--Anger over hike in rates

Employee defrauds company

Labour dispute Reputation

attacked

Possible Vandalism Security threat

from irate customer

Employee accused of high profile crime

Natural disaster hits branch

Fire hits branch Discrimination,

human rights violation

Internal human resources issues

Workplace sex assault

Workplace violence

Outbreak of communicable disease

Protests Chairman of

board of directors dies

CEO dies suddenly

Insider trading Successful class-

action lawsuit over unpaid overtime

Terrorist attack Power outage Union

certification drive Pandemic Layoffs Friendly

corporate takeover

Boycott

Internet banking system crashes

Telephone system crashes

Hacker breaks into system

Computer system crashes

Stock market crashes

Strike Government

probe Widespread

banking crisis Hostile corporate

takeover Merger Sudden drop in

stock value

Unlikely Run on bank by worried customers

Internal financial crisis, such as bankruptcy

Impossible

Low Medium Considerable Devastating

PR

OB

AB

ILIT

Y O

F R

ISK

IMPACT OF RISK


Social Media/Internet Risk Evaluation

In today’s world, with the use of technology, the Internet and social media, companies are

prone to having bad news or rumours spread about them quickly and globally.

It would be easy for a disgruntled customer to spread their complaint quickly using Twitter,

YouTube, Facebook, blogs and other social media channels. For example, if someone has had their home

foreclosed because of non-payment of their mortgage to Scotiabank, the customer could easily turn to

social media to express their displeasure. If their story is particularly heart-wrenching -- say, a family

struggling to take care of a disabled daughter or a fifth-generation dairy farmer who can’t afford to pay

the bills -- the risk factor heightens. Since the media monitors social media and are looking for good

stories, they could pick up on an online story and take it mainstream.

Meanwhile, more and more websites and blogs are popping up where customers and

employees can rate companies. For example, glassdoor.com contains reviews and ratings of Scotiabank

by anonymous employees, giving them an opportunity to gripe or praise their bosses (CEO Rick Waugh

receives a 79% approval rating). Other sites, such as yelp.ca and qualisteam, allow customers to write

reviews of businesses and their customer service. Such sites should probably be monitored occasionally

to get a snapshot of what customers and employees are thinking and saying.

Top Three risks

1. Employee fraud

Employee fraud can come in several forms: chiefly, an employee defrauding the bank or defrauding

a customer. Both can have a major negative impact on a bank’s reputation even if the dollar amounts

involved are small compared to the billions the company manages.

The financial impact when an employee steals money from the company depends on the amount of

money. Chances are that major banks have enough checks and balances in their system that no single

employee can have access to hundreds of millions of dollars. Major banks with assets in the hundreds of

billions are also cushioned from an impact on their balance sheet. However, rogue employees can have

a major impact on a bank’s reputation. Bank fraud has a ripple effect, causing customers to question

whether the company has enough checks and balances in place, supervises employees properly or does

proper screening when hiring. Since so much of the banking industry is based on faith and trust, fraud


can impact reputation negatively. Briton Nick Leeson lost about $1.5 billion of Barings Bank in 1995,

while Bernie Madoff was responsible for the loss of many more billions in the United States a few years

ago.

Cases where bank employees defraud customers of their savings can have a severe reputational

impact on a company. There have been numerous examples of financial advisors being caught for

defrauding customers who entrusted their money with them. The most recent example is Canadian Earl

Jones. These cases get a large amount of media attention. While most of these cases involve advisors

not working for Canada’s major banks, it is a possibility and must be considered as a major risk,

especially due to its potential reputational damage.

There may be prodromes that thoughtful managers or employees may pick up regarding potential

internal fraud. An employee may indicate they face a personal financial crisis and are being stressed out

because of it. Also, fellow employees may notice that a colleague doesn’t follow all the spelled-out

policies and procedures regarding money accounting or online trading.

2. Hacker breaks into bank’s secure system

Banks and other financial institutions spend millions of dollars to put up firewalls and other

safeguards to guard against increasingly creative and clever hackers who seek to access secure

computer systems. Banks encourage customers to migrate to online banking. To help do so, banks offer

numerous assurances that their systems are safe and secure, even offering money-back guarantees if

somehow customers lose money to hackers through no fault of their own.

The issue of hackers trying to steal information or money is a serious one for banks. The Canadian

Bankers Association presented a brief to a House of Commons committee in the fall of 2009 supporting

the need to pass the Electronic Commerce Protection Act, noting that Canada was the only G8 nation

without rules in this area. The paper warns about the practice of “phishing” where hackers use spyware

to steal personal information and send counterfeit messages trying to entice people to disclose personal

information, including bank information.

Also in 2009, the Bankers Association warned another House of Commons committee about the

threat of identity theft. In doing so, it revealed how seriously banks take this issue:

“As businesses that handle personal information and the financial accounts of millions of

Canadian consumers, the banks take their role in the fight against identity theft extremely seriously.

The banking industry in Canada, for example, spends in excess of $100 million annually to prevent,


detect and deter fraud and other crimes against banks, including criminal activity resulting from

identity theft, in addition to reimbursing bank customers who are proven victims of many financial

frauds.”

Canada passed a law to combat identity theft in October 2009, making it illegal to possess personal

information belonging to others before it is used for fraud or theft.

Finding information on successful bank hacking and identity theft is hard. Obviously, banks don’t like

to reveal they’ve suffered losses, partly because it could bring bad publicity and partly because it might

encourage other hackers.

While a hacking attack may catch banks off guard, they are not surprises. Banks routinely upgrade

their computer defense systems and routinely test them. In fact, there have been news reports of banks

hiring so-called “ethical hackers” to test their defences and reveal weaknesses. These hackers are not

after money; they are trying to see if they can beat the system as an experiment that will benefit the

banks.

3. Successful class-action lawsuit over unpaid overtime

Scotiabank is currently facing a $300-million class-action lawsuit over unpaid overtime to some

5,000 employees. An Ontario court judge gave the lawsuit class-action legal status in February 2010.

Class-action lawsuits in Canada are rarely certified to proceed, so this is a case that is being closely

watched and could be precedent setting. A similar $600-million lawsuit on behalf of CIBC employees has

failed to win status, prompting the law firm representing staff to appeal.

The Scotiabank lawsuit is based on a claim filed by lead plaintiff Cindy Fulawka based on her

experience dating back to 2000. The names of more than 5,000 other current and past employees have

been added. The employees allege they were routinely expected to work overtime, especially if they

were to meet sales targets and wanted to get ahead at the bank. Judge George Strathy of the Ontario

Superior Court of Justice said the case was worth hearing since it dealt with “systemic wrongs that give

rise to common issues, the resolution of which would advance the claim of every class member,”

according to the Canadian Press account of the decision. Strathy added that "systemic wrongs included

the failure of Scotiabank to establish a system-wide procedure to record overtime, making it all the

more difficult for employees to obtain fair compensation for their overtime work."


Scotiabank has denied the allegations and tried unsuccessfully to fight the lawsuit’s elevation to

class-action status. The bank has not announced if it intends to appeal the judge’s decision, but it is

expected to.

If successful in the long run, the class-action suit could take a $300-million bite out of Scotiabank’s

balance sheet. Even though Scotiabank is financially strong, reporting about $800 million in profit per

quarter, $300 million is still a big chunk of change. Legal costs to defend the suit will also be

considerable, well into the millions.

Of greater concern, is the reputational damage a successful lawsuit will have on Scotiabank. There

would be major “bad press” if a judge rules that the bank didn’t treat some 5,000 employees fairly and

contravened the Canada Labour Code. The Code calls for employees to be paid 1.5 times when they are

required to work more than eight hours in a day. Stories would be run across Canada. Canadians would

question if Scotiabank is a good place to work, as would other employees. Canadians who feel strongly

about workers’ rights, including trade unions, would think twice about doing business with Scotiabank

and could withdraw their business.

It was not a surprise that employees were unhappy with arrangements regarding working extra

time. Undoubtedly, there were complaints from employees. Even if these were not voiced loudly, they

were known to management. The issue of pay for bank employees, especially those at the lower levels

such as tellers, has been in the news for years.

Key Audiences

A multi-national financial company with the scope and assets the size of Scotiabank has many

key audiences, publics and stakeholders.

They include:

Current customers

Potential customers

Small and medium-sized businesses

Shareholders

Bond holders

Board of directors

Employees

Government – Canadian and foreign

countries where Scotiabank does

business

Bank of Canada

Banking regulators – Office of the

Superintendent of Financial Institutions,

Financial Consumer Agency of Canada,

Canadian Payments Association


Canadian Bankers Association

Consumer advocacy groups

(Consumers’ Association of Canada)

Police, including RCMP

Charitable organizations and causes

that receive donations from banks

Toronto and New York stock exchanges

Securities regulators (different in each

province)

Pension funds (holders of stock or debt)

Mutual funds (holders of stock or debt)

Creditors

Business analysts

Suppliers (example: stationary,

computer equipment suppliers)

Media (print, radio, TV and online)

Neighbours of branches, offices

Key Audiences for Top-3 Risks

RISK KEY AUDIENCES

Employee fraud

Police – need to be notified to pursue criminal investigation

Top managers – need to be aware of incident to review security policies

and procedures

Other employees – need to be reminded how serious the bank takes these

incidents

Media – if word comes out, will need to be messages that this is an

unfortunate but extremely rare incident

Hacker attack

Police, including RCMP’s Reporting Economic Crime On-Line (RECOL) –

need to be notified

Government regulators – need to be notified if widespread affect

Top managers – need to be aware to review security procedures

Board of directors – need to be aware of major incidents

Employees – need to be reassured they did nothing wrong but that all

employees need to be vigilant and remind customers of this need, as well

Media – if word of incident comes out publicly, need to be told this is an

extremely rare incident and the banks spends heavily to protect customers


and bank assets

Consumers – to issue information, advice on protecting themselves

Securities regulators – may need to know if widespread attack that may

compromise stock value or trading

Canadian Bankers’ Association – likes to keep track of these incidents,

since speaks on behalf of all banks

Successful

class-action over

unpaid overtime

Managers – need to know, since they will need to review overtime policies

in light of decision and may need to make policy changes accordingly

Employee groups – Scotiabank needs to reassure employees they will be

treated fairly and in accordance with the law; that they are a valuable

resource

Board of directors – need to be notified because will be a major cost to

company

Business analysts – will want to know what affect a major settlement will

have on Scotiabank’s balance sheet

Media – will have questions; will want to know Scotiabank’s reaction, what

it will do differently from now on, about impact on company reputation

Consumers – may need messaging telling them that Scotiabank will follow

the law, felt it was treating employees fairly before but will redouble its

efforts to be considered a leading employer


Communications Channels

It is important that Scotiabank has plans in place to communicate with its key audiences and

stakeholders during a crisis. These channels must be pre-determined, not left to sorting out during a

crisis itself.

Among the channels we will use for various groups:

KEY AUDIENCE COMMUNICATIONS CHANNEL

Board of directors

Personal phone call from board secretary; e-mail is backup if can’t be reached by

phone; fax message; company Intranet website for internal communications

Top managers

Personal phone call from communications team; e-mail is backup if can’t be

reached by phone; fax message; company Intranet website

Employees

Internal e-mail system; company’s Intranet website; phone system, if necessary;

news media; memos place on workplace bulletin boards

Government

regulators, bank

regulators

Personal phone call; e-mail; information on Scotiabank’s public website; fax

message; news media

Business analysts

Pension funds

Mutual funds

Shareholders

News release; information on Scotiabank’s public website; fax message

Customers

Charities

Information on Scotiabank’s public website; news release; advertising on radio

Media News release; information on Scotiabank’s public website; e-mail; phone call

Police Personal phone call.

Even during a power outage, Scotiabank is confident it will be able to get the majority of its

messages out to the majority of its intended audiences. This confidence comes from ensuring backup

power generators are operation in our Emergency Operations Centre, located in the sub-basement of

Scotia Plaza in downtown Toronto (see more details below).

However, when faced with extraordinary circumstances, we have backup plans. We have the

ability to use telephone systems, either landline or mobile, to reach key audiences such as police,

company directors, top managers and government regulators. For a widespread crisis, we would turn to


the news media to primarily get the message out, for example, asking radio and TV stations to broadcast

that there’s a fire at a Scotiabank branch on Toronto’s Queen Street West that has shut it down.

Our Crisis Team -- Roles and Responsibilities

PERSON, TITLE RESPONSIBILITIES

Crisis Communications Chair

Sylvia Chrominska, Group

Head, Global Human

Resources and

Communication

Ensures communication with top managers, including CEO

Verifies extent of crisis and resources that will need to be deployed

Looks at big picture, regarding impact on corporation

Directs messaging that public relations staff will produce

Keeps record of events during crisis

Communications with bank operations staff as needed

Joe Konecny, Corporate

Media Relations (bilingual)

Handles media relations with English and French media

Drafts key messages under direction of chair

Also drafts messages and communications material for employees

Monitors media coverage

Elsa Mercado, International

Banking Media Relations

(called in if crisis outside

Canada; speaks Spanish)

Called in when crisis involves banking operations outside Canada

Handles media relations with Canadian and foreign media (will

access to translators if needed)

Joe Pisces, Government

Affairs Information Officer

(bilingual)

Handles communications with government, bank-related regulators,

industry associations

Bobby Brown, Manager

Corporate Security

Communicates with team regarding investigation into security

breaches, particularly around computer systems, hacker attack,

Internet fraud

Siha Mohammed,

Communications

Webmaster

Will activate Dark Websites when directed by team chair

Will post information to websites for employees, media and public

Samantha Small, IT Support

Technician

Assists with maintaining emergency centre computer systems

operational

Assists webmaster with posting of information

Rebecca Orsini, Section

Manager, Human Resources

and Administration Support

Works with team to provide human resources support

Does administrative duties as needed

Basil Thistlewaite, Manager

Corporate Reputation

Works closely with chair to look at big picture, safeguarding the

reputation of the corporation

Offers strategic thinking and planning support


Identification of Spokespersons

The choice of spokesperson will depend on the level and breadth of a crisis.

CEO and President Rick Waugh

If a crisis affects the entire Scotiabank reputation or operations, the best spokesperson to speak

for the bank is our CEO, Rick Waugh. Mr. Waugh has extensive experience talking to government

leaders, bank regulators, associations, the business community, the media and employees. He is

recognized as a dynamic leader. Examples of crisis where he would likely to be called on to speak

include: a widespread banking crisis, stock market crash, large-scale government probe, the class-action

lawsuit over unpaid overtime, widespread computer system crash or hacker attack that shuts down our

banking systems. Mr. Waugh is also the spokesman for any issue related to changes or attempted

changes to the corporation, such as mergers and takeovers.

Sylvia Chrominska, Group Head, Global Human Resources and Communications

Ms. Chrominska is head of Scotiabank’s public affairs and communications branch, responsible

for Canada and out-of-Canada operations. As part of Scotiabank’s executive team, she has detailed

knowledge of our operations. She would be the lead spokesperson for most crises that do not require

comments or messaging from the CEO’s office. Also, as head of human resources, she is well qualified to

speak on issues regarding employee relations, including the class-action lawsuit over unpaid overtime,

labour disputes, unionization drives, allegations of discrimination, cases of workplace violence whether

physical or sexual. Similarly, as head of human resources, Ms Chrominska can speak about the affects

and responses related to a pandemic. Ms. Chrominska has the power to delegate spokespersons from

the public affairs and media relations department in cases of more localized or more minor crises.

Bobby Brown, Manager, Corporate Security

Mr. Brown is an expert in corporate security, with two decades of experience formerly working

for the RCMP in its corporate fraud section. He has received media training and is qualified to speak on

the bank’s behalf related to issues where there have been security breaches: hacker attack, Internet

bank fraud, phishing and identify theft. He is also qualified to speak on behalf of Scotiabank when there

have been terrorist attacks on branches or offices.


Notification Procedure

Internal notification

The procedure for internal notification can vary depending on the type of crisis and severity of

crisis. Generally speaking, some crises can be handled at the local or branch level with some assistance

from communications, operations, human resources and security staff from corporate office.

Examples of these types of crises include:

Fire or vandalism at branch;

Local computer or telephone system

crash;

Internal workplace issue;

Robbery;

Local protest;

Local power outage;

Natural disaster hits branch.

In these cases, the notification procedure is (from bottom up):

In cases where a crisis is more widespread or affects the business and reputation of the

corporate Scotiabank, word goes further up the ladder and many should reach the ears of

CEO/President Rick Waugh.

Examples of these wider scope crises include:

Insider trading; Union certification drive;

Branch manager

Regional Manager

Security department Communications department Manager of Corporate Reputation


Pandemic;

Large-scale computer or Internet

banking crash;

Widespread hacker attack;

Stock market crisis;

Hostile takeover attempt;

Internal financial crisis

Major layoffs;

Major labour dispute;

Major case of employee fraud.

A more detailed Scotiabank organizational chart showing top executives follows this page:

Branch manager

Regional Manager

Security department Communications

department

Manager of Corporate

Reputation

Group Head, Global Human

Resources and

Communications

Executive Vice-President,

Information Technology

and Solutions

President and Chief

Executive Officer

Board of Directors


Scotiabank Organizational Chart 2010


Emergency phone tree

When faced with a crisis, employees will follow the above map to notify the appropriate

manager and the communications department. The communications department will initiate the phone

tree and contact the appropriate responders and upper managers.

Name Title Phone E-mail

Sylvia Chrominska

Group Head, Global Human Resources and Communications

Office: 416-933-1344 Cell: 416-771-4441

[email protected]

Joe Konecny Corporate Media Relations

Office: 416-933-1795 Cell: 416-791-1159

[email protected]

Elsa Mercado International Banking Media Relations

Office: 416-933-1212 Cell: 416-791-0023

[email protected]

Joe Pisces Government Affairs Information Officer

Office: 416-933-1435 Cell: 416-754-2423

[email protected]

Bobby Brown Manager Corporate Security

Office: 416-933-8485 Cell: 416-873-4887

[email protected]

Siha Mohammed

Communications webmaster

Office: 416-933-5873 Cell: 416-774-3397

[email protected]

Rebecca Orsini Section manager, human resources

Office: 416-933-9947 Cell: 416-771-4765

[email protected]

Basil Thistlewaite

Manager Corporate Reputation

Office: 416-933-7649 Cell: 416-771-8376

[email protected]

Sabi Marwah Chief Operating Officer

Office: 416-933-8471 Cell: 416-774-4876

[email protected]

Rick Waugh CEO and President Office: 416-933-7461 Cell: 416-771-9832

[email protected]

Sylvia Smith Executive Secretary to President

Office: 416-933-7207 Cell: 416-774-4765

[email protected]

Kim McKenzie Executive vice-president, Information Technology and Solutions

Office: 416-933-9817 Cell: 416-771-5836

[email protected]

Christopher Hodgson

Group Head Canadian Banking

Office: 416-933-0028 Cell: 416-771-6481

[email protected]

Patty Stathokostas

Multicultural Banking Media Relations

Office: 416-866-3625 [email protected]

Debbie Clark Corporate Social Responsibility, Media Relations

Office: 416-933-4153 [email protected]

Scotiabank Com. centre

1-800-713-8899 [email protected]


External Notification

When it is necessary to notify external authorities, some common sense rules will apply.

In the case of a crisis involving a branch or office, the branch or office manager will determine

when it is necessary to notify outside authorities based on our pre-established guidelines. For example,

obviously a branch manager’s first duty in the case of a fire, robbery, hostage taking, power outage,

terror attack or natural disaster, is to contact emergency authorities. After doing so, they should contact

their regional manager.

In cases, where the crisis includes a local labour dispute, protest, boycott, human resources

issue, outbreak of disease, system shut down, a local branch manager will notify their regional manager.

The regional manager will follow the prescribed notification procedure also used for internal issues. The

regional manager will notify the communications department, the Manager of Corporate Reputation

and the Security Department.

In more major cases which involve the legal and financial duties of the corporation, it will fall to

the either the Government /Public Affairs Office, Investors Relations or Legal department to notify the

appropriate authority.

Branch manager

Regional Manager

Security department Communications

department

Manager of Corporate

Reputation

Group Head, Global Human

Resources and

Communications

Executive Vice-President,

Information Technology

and Solutions

President and Chief

Executive Officer


News conference checklist

Many crises require, at some point, holding a news conference to disclose important

information to the media. We must remember that news conferences afford us an opportunity to get

our message out to customers, employees, shareholders, government officials, the general public and

other stakeholders. Therefore, we must have the knowledge and tools to hold a successful news

conference event.

The following is a list of procedures and requirements:

1. Determine the time and place of holding a news conference, cross-referencing the availability of

key spokespeople and bank officials.

2. Notify the media of the time and place.

3. Invite outside officials if appropriate.

4. Make list of news media who will be attending.

5. Prepare backgrounder, both a general one on Scotiabank and a more specific one on the issue

that necessitated the conference.

6. Prepare agenda for event.

7. Prepare media kits to include backgrounders, agenda, bios of spokespeople or company

officials, business cards in hard copy.

8. Assign internal staff or hire external staff to hire the logistics of the event. This could include:

Set up speaker podium, tables and chairs;

Set up backdrop if appropriate;

Set up audio-visual equipment;

Have hookups for microphones for media members;

Arrange for Internet access for media members;

Have light food and refreshments, if appropriate.

9. Brief staff and speakers beforehand, regarding issue at hand, number of media, media

organizations attending, agenda for event, protocol for questions.

10. Work with spokespeople on speeches, interview tips, expected questions and answers, and key

messages.

11. Have sign-in sheet for media, collect business cards from media members.

12. Distribute media kits after sign-in.


13. Have staff member introduce news conference and spell out rules.

14. Have staff member record news conference in same way media would, including videotaping

event.

15. Have staff member – same one as who opened conference – select media members who have

questions to ask.

16. Close news conference, inviting any media with further questions to talk to the media relations

or communications spokesperson assigned to the event.

Emergency Operations Centre

The Emergency Operations Centre is activated during a widespread or particularly damaging

crisis that affects the entire Scotiabank corporate reputation, finances or succession planning.

Examples where the Emergency Operations Centre is activated:

Sudden death of CEO and President;

Stock market crash;

Widespread crisis in Canadian banking system;

Widespread crash of computer, telephone system or online banking during regular business

hours;

Hacker breaks into secure servers and compromises system-wide security.

Location: Corporate Headquarters, Scotia Plaza, 44 King St. W., Toronto, ON M5H 1H1, Sub-

basement, Room SB 100, accessible by security swipe cards and fingerprint recognition technology. The

room is equipped with clocks showing various world times.

Checklist of required supplies:

Backup generators;

Secure servers;

Secure telephone system;

Secure high-speed Internet access;

Laptops;

BlackBerry’s and cell phones, with spare

batteries, chargers;

Printers, photocopy machine;

Fax machine;

Radios and televisions;


Electronic and hard-copy versions of

crisis communications plans, emergency

contact lists, organizational charts; list

of branches, with phone and e-mail

addresses;

Stationary supplies;

Flip charts, bulletin board;

Spare batteries, battery chargers;

Digital cameras, extra memory cards;

Digital video camera to take videotape

message, if necessary, which can be

posted to YouTube, our Intranet and

company website, or sent out

electronically to the media;

Telephone directories;

Map showing location of

branches/offices.


Backgrounder Facts about Scotiabank

Scotiabank is one of North America's premier financial institutions, and Canada's most international bank. Since welcoming our first customers in Halifax, Nova Scotia, in 1832, Scotiabank has continued to expand its global reach. Today, through our team of close to 68,000 employees, Scotiabank Group and its affiliates offer a diverse range of products and services, including personal, commercial, corporate and investment banking, to almost 14.6 million customers in some 50 countries around the world.

Our corporate goal is to be a leading international financial services provider, based in Canada, by being the best at helping our customers become financially better off. We operate three business lines: Canadian Banking, International Banking and Scotia Capital under the leadership of CEO and President Rick Waugh.

Canadian Banking

Canadian Banking provides a full range of banking and investing services to more than 7.4 million customers across Canada, through a network of 1,019 branches, 2,964 automated banking machines (ABMs), and 101 Wealth Management offices, as well as telephone and Internet banking.

International Banking

International Banking encompasses Scotiabank's retail and commercial banking operations in more than 40 countries outside Canada. More than 46,000 employees provide a full range of financial services to more than five million customers through a network of 1,907 branches and offices, 3,509 ABMs, telephone and Internet banking, in-store banking kiosks and specialized sales forces. We operate in the following geographic regions: the Caribbean and Central America, Mexico, Latin America and Asia.

Scotia Capital

Scotia Capital is the wholesale banking arm of the Scotiabank Group. We offer a wide variety of products to corporate, government and institutional investor clients. Scotia Capital is a full-service lender and investment dealer in Canada and Mexico, and offers a wide range of products in the U.S. We also provide select products and services to niche markets in Europe and Asia.

-30-

For more information, contact:

Deborah Clark, Manager, Public Affairs, Scotiabank, 416-933-0646 or [email protected]

mailto:deborah%[email protected]


Initial Disclosure Statement Template (Statement to be used initially if contacted by the media or questioned by employees) Yes, we at Scotiabank are aware of the issue regarding ________________________________

This is what Scotiabank can confirm at this time ______________________________________

We hope to have this situation resolved as soon as possible and will keep the public advised through the

news media and through our website _________________ _____of any important developments.

That is all we can confirm at the present time. I am sure you understand we are very busy trying to deal

with this situation. We ask for your patience. As soon as we have more information confirmed, we will

be releasing it.

Thank you very much.

Drafted by: ________________________

Approved by: ______________________

Date: _____________________________

Time: _____________________________


Crisis Fact Gathering Sheet

Name/Position: ________________________________________

Date/Time of incident: __________________________________

Please provide as much information as possible from the list of questions below:

DESCRIBE WHAT HAPPENED

• What happened?

________________________________________________________________

________________________________________________________________

________________________________________________________________

• Where did the incident occur?

________________________________________________________________

• How did the incident occur?

________________________________________________________________

________________________________________________________________

• When did the incident occur?

_____________________________________________________________

• What danger does the incident pose for our organization?

_____________________________________________________________________________________

_____________________________________________________________________________________

Who is impacted?

_____________________________________________________________________________________


NOTIFICATION

• Who has been contacted so far?

________________________________________________________________

________________________________________________________________

• Who else needs to know?

________________________________________________________________

• Who is informing them?

________________________________________________________________

• What authorities have been contacted?

_____________________________________________________________

• Has there been any contact with local/provincial/federal government officials? If

yes, whom?

__________________________________________________________________

__________________________________________________________________

• Has the media called? If so, who? When? Where are they? Is someone managing the media?

_______________________________________________________________________

_______________________________________________________________________

________________________________________________________________________

________________________________________________________________________

What was the media told?

________________________________________________________________

________________________________________________________________

• Is a news release necessary?

________________________________________________________________

• Is a Dark Web Site activation necessary?

________________________________________________________________


CURRENT STATUS

• Who is the senior executive in charge? Phone #?

_____________________________________________________________

_____________________________________________________________

• Who can act as spokesperson? Phone #?

_____________________________________________________________

________________________________________________________________

__________________________________________________________

• When will more details be available?

_____________________________________________________________

ACTIONS

What actions have been taken so far?

___________________________________________________________________

___________________________________________________________________

_____________________________________________________________

• Describe what we are doing now and are about to do to regain control of the situation?

_________________________________________________________________

__________________________________________________________________

______________________________________________________________

• Going forward, what is the restoration plan?

______________________________________________________________


TELEPHONE MEDIA LOG SHEET (Use this form to record each phone call from the news media) • Call Returned By: ________________________________________________________ • Date: ______________________ Time: _______________________ • Name: ________________________________________________________________ • Organization: ________________________________________________________________ • Location: ________________________________________________________________ • Telephone Number: ________________________________________________________________ • Fax Number: ________________________________________________________________ • Message: ___________________________________________________________________ ___________________________________________________________________ __________________________________________________________________ • Other Information/Notes: ___________________________________________________________________ ___________________________________________________________________ ___________________________________________________________________ ___________________________________________________________________ ___________________________________________________________________ ___________________________________________________________________ ___________________________________________________________________ __________________________________________________________________


Key Messages – Top-3 Risks

TOP-3 RISKS MESSAGES – To be stressed in the order indicated Employee Fraud

We apologize if any customers have lost money due to fraud by one of

our employees.

Customers will not be out of pocket.

Customers put their faith and trust in us, expecting us to take care of

their assets. We can assure you that we take this obligation extremely

seriously. We will protect your money.

In the event of employee fraud and the loss of money, Scotiabank’s first

priority is that customers/clients do not suffer financial loss.

Scotiabank has a policy of full reimbursement for such losses. We intend

to make this process as customer friendly as possible.

We are launching a full investigation to ensure we have taken every

possible step to help prevent this from happening again.

Scotiabank takes employer fraud very seriously, and we have stringent

hiring practices and numerous checks and balances to try to prevent this

crime.

Unfortunately, there are a few bad apples out there.

Employer fraud is not a victim-less crime: Scotiabank pays a price and

ultimately consumers do, too, since it costs us all to maintain high-

security measures to guard against it. Scotiabank would rather not have

to spend that money and hence offer customers lower fees.

Hacker Attack -- widespread

We apologize for any financial losses and any inconvenience or stress to

our customers.

Scotiabank’s first priority is that customers/clients do not suffer financial

loss.

Scotiabank has a policy of full reimbursement for such losses. We intend

to make this process as customer-friendly as possible.

Scotiabank spends about $100 million a year to safeguard the accounts

of customers and its banking systems, constantly investing in leading-

edge technology to combat this criminal activity. We also hire the best

and brightest in this field.

We are launching a full investigation to ensure we have taken every

possible step to help prevent this from happening again.

Hacker attacks are illegal. It’s not fun and games. These people are

criminals and are breaking the law. If anyone has information about such

criminals, please contact the police.


Successful class-action lawsuit over overtime

In the event of a victory in the class-action lawsuit over unpaid overtime

to some 5,000 employees, we will honour any decision of the court once

all the legal processes are complete.

Although we don’t agree with the court’s decision, we will honour it and

pay all monies ordered by the court as quickly as possible.

Scotiabank prides itself on being a good employer, providing a safe,

healthy and rewarding work environment where all hard-working

employees can advance their careers.

Scotiabank cares about its employees and we constantly review our pay

policies to ensure they are treated fairly. We pay competitive wages for

our industry.

We have reviewed our policies regarding employee overtime to ensure

there is clear communication between everyone regarding the rules.


Pre-Prepared Media Statements – Top-3 Risks

Major case of Employee Fraud

Canadians have entrusted their money with Scotiabank for more than 170 years. We take our

obligation of earning that trust very seriously.

Scotiabank takes it very seriously when one of its own defrauds the company. We assure you

that no customers will be left out of pocket by this criminal act of fraud. We apologize if any of our loyal

customers have been affected and we will do everything we can to alleviate any stress this unfortunate

incident has caused.

Scotiabank already has some of the toughest security measures in Canada and the world to

guard against employee fraud. We assure you that we are launching a full investigation to determine

how these stringent safeguards were bypassed in this rare occurrence. We will be reviewing our security

measures to ensure every possible safeguard is in place to help prevent this type of criminal act again.

Scotiabank also has strict hiring and screening practices in place; these are also being reviewed with an

eye to identifying if any additional measures are necessary.

We also assure you that we are co-operating fully with police and Canada’s banking regulators,

at the same time that we are launching our own investigation.



Major hacker attack

There has been a criminal attack by a hacker on Scotiabank’s computer system, shutting down

the system and resulting in financial losses to the bank.

We apologize if any customer has been harmed or inconvenienced by this criminal act. We

assure you that no customer will be out of pocket by this incident. We have a policy of fully reimbursing

losses to customers due to online fraud. We take this guarantee very seriously.

We are co-operating fully with police, including the RCMP’s Internet fraud task force. We are

hopeful that these criminals will be caught and prosecuted.

Meanwhile, we have launched our own investigation into this rare incident. Scotiabank spends

about $100 million a year to safeguard its complex computer systems. We have in place some of the

toughest security measures for banks in Canada and around the world. However, we will be reviewing

our various security measures to see if there are additional safeguards we can put in place.

As you can appreciate, we will not be discussing how these criminals got around our stringent

security measures, nor the financial loss. Suffice it to say that we will be leaving no stoned unturned to

get to the bottom of what happened and catch these criminals.

Again, we want to ensure all our customers that their money is safe with us. Unfortunately,

there are criminals out there who seek to steal from hard-working Canadians.

We encourage anyone with information about hackers to contact the police.



Successful Class-Action Lawsuit over Unpaid Overtime

Canada’s courts have spoken and we respect their decision.

Scotiabank has been a good corporate citizen and a good employer for more than 170 years.

Our corporate values stress the importance of our employees, who make us the well-respected and

successful company that we are. Our success depends on our employees.

This has been a difficult issue.

While we may not agree with the court’s decision, we will respond quickly to make the

payments the courts have ordered. Employees will not have to wait long to receive their compensation.

Since this court action was commenced a number of years ago, Scotiabank has carefully

reviewed its policies, procedures and guidelines regarding overtime. We have improved those policies to

open up the channels of communication regarding overtime to ensure they are clearly understood.

Banking is an exciting business to be in, and Scotiabank offers many rewarding careers for a

diverse workforce. We take pride in our employees. We take pride in being considered a good place to

work. Our goal is to reward that pride.


New Release

FOR IMMEDIATE RELEASE Headline goes here . . .

TORONTO (XXxx) . . . Xxxxxx

Scotiabank (www.scotiabank.com) is one of North America's premier financial institutions and Canada's

most international bank. With close to 68,000 employees, Scotiabank Group and its affiliates serve

approximately 14.6 million customers in some 50 countries around the world. Scotiabank offers a diverse

range of products and services including personal, commercial, corporate and investment banking. With

more than $507 billion in assets (as at January 31, 2010), Scotiabank trades on the Toronto (BNS) and

New York Exchanges (BNS).

-30-

For more information, contact:

Deborah Clark, Manager, Public Affairs, Scotiabank, 416-933-0646 or [email protected]

http://www.scotiabank.com/


Dark website

Scotiabank has put in place a so-called Dark Website which can be switched on to go live in a

time of crisis. Because Scotiabank is a large organization facing a multiple vulnerabilities and risks, we

have invested time and resources to develop several dark websites for different scenarios. All websites

will be in French as well as English. Although these will be set up in advance, communications teams will

have to include bilingual representatives to add French content during a crisis.

1. Scotiabanksecure.ca

This website can go live in the several situations. It will be hosted on its own secure servers, with

an alternative server on an external device:

Hacking attack that affects or compromises the security of a large portion of our system;

Widespread computer crash that largely shuts down our ability to do business;

Widespread Internet banking crash, also largely shutting down that side of our business;

2. Scotiabankhealth.ca

This website can go live in the event of a pandemic. Such a pandemic could hit our Toronto head

office and GTA-based branches, or it could hit head offices in other countries we do business.

3. Scotiabankbusiness.ca

This website can go live in the case of severe financial crises. Although these may be considered

unlikely due to the close regulation that Canadian Tier I banks fall under, we must have a plan

for one of these eventualities.

Stock market crash: A stock market crash such as the one of September 2008, where

many of our customers saw 40-50% of their retirement or investment accounts

disappear in a short period of time has the potential to create panic and hurt our

business.

Widespread banking crisis: Similarly a widespread crisis that hits financial markets and

Canadian banking, or a drastic shift in government or Bank of Canada policies, could

have a major impact on our operation and again create panic among clients and

employees.


These websites will contain our corporate logo and name but will remain simple in design. It will

be laid out simply and logically with sparse amounts of information. One or two members of our crisis

communications team in the Emergency Operations Centre should be able to quickly add information to

get our messages out to the intended audiences.

The websites should contain:

General background information on Scotiabank, history of company, list of top

corporate managers, list of board of directors, our list of services, our global reach,

along with basic up-to-date business facts;

Our corporate vision, mission statement and mandate;

Information on the issue at hand;

Our key messages regarding the issue at hand;

Media area containing photos of key executives or spokespeople, along with space to

post up-to-date news releases, photos, videos and podcasts;

Pre-prepared draft news releases/statements for different scenarios;

Frequently asked questions;

Press contact area;

Links to Twitter, YouTube and Flickr so that we can get our message out when necessary

across multiple platforms and quickly.

RSS feed capability so that users, including the media, can sign up for update alerts

instead of having to go back frequently to check for updates on their own.

scotiabank crisis communications plan

Education

widespread crisis

reputation business

assets of customers

enviable reputation

telephone system crashes

system discrimination

computer system crashes30

assets ofcustomers