All organisations must be prepared to respond to an emergency, disaster or crisis and have pre-planned strategies in place that enable them to recover from the effects of such situations in as timely a manner as possible. Business Continuity Management (BCM) helps increase organisational resilience by identifying priority activities, developing suitable strategies and solutions for continuity following disruption and allocating necessary resources to minimise the impact of disruption.
The outbreak of the global COVID-19 pandemic in late 2019 led to many organisations referring to their Business Continuity Plans (BCPs) for guidance. Many found that the analysis carried out to develop and document BCPs was extremely useful, even if specific continuity strategies for responding to a pandemic had not been considered.
Even organisations that have invested heavily in BCM need to ensure arrangements have been put in place for responding to a pandemic, in particular recognising that many restrictions on normal life could be imposed by local and national governments.
BCM process
In order to develop BCM arrangements consistent with good practice, organisations should follow a standard process.
Business Continuity Lifecycle1
Policy and Programme Management
- Establishment of the organisation’s BCM policy
- Alignment with the organisation’s strategic objectives
- Defines how the BCM system will be implemented
Analysis
- Business Impact Analysis
- Risk Assessment
Design
- Identification and selection of business continuity strategies and solutions
Implementation
- Development of business continuity plans (BCPs)
- Includes response framework and structure
Validation
- Testing and exercising BCM arrangements
- Maintenance and updating
- Management reviews and audits
Embedding
- Integration of BCM into ‘business as usual’ culture of the organisation
- Inclusion of BCM considerations in any organisational change
Particular key aspects of this process that require additional effort when planning for a potential pandemic are the analysis and design stages. The following ten-point plan should be incorporated into any previous BCM thinking2.
- Ensure you are clear on the organisation’s priority activities (time-critical) in the event of loss of resources.
- Prepare for unexpected absences, particularly in priority roles (i.e. identify cross-trained staff, succession plan where possible).
- Modify policies to give greater flexibility to normal working arrangements.
- Establish and confirm welfare policies.
- Reinforce internal peer support or other welfare mechanisms such as employee assistance programmes and occupational health support.
- Implement a clear and regular communication strategy across the organisation.
- Ensure the workplace has adequate supplies of cleaning and hygiene products.
- Communicate the pandemic continuity strategy across the organisation.
- Assign someone in, or close to, the leadership team to monitor official information sources, advice and assistance from government, health and other relevant agencies.
- Avoid use of social media as a source of trustworthy information, and reinforce this to employees.
Pandemic planning considerations
In developing strategies and solutions for handling a pandemic, most organisations have to use a combination of more traditional BCM arrangements including those developed for denial of access to facilities, unavailability of personnel, failure of or limitations on technology and failures in the supply chain. Particular points of note in the COVID-19 outbreak included:
- Implementation of more remote working than had ever been tried before.
- Remote access capacity tests carried out, and greater capacity obtained where necessary, as well as purchase of hardware for employees who were usually office-based.
- Implementation of shiftwork in organisations that normally operate in core hours.
- HR policy changes necessary to cater for such operational change.
- Increasing use of video and tele-conferencing.
- Ensuring applications used are available to staff and third parties, and information security requirements are met.
- Identification of wider supply chains, accessing supplies from various regions of the world.
- Normal quality checks may need to be accelerated.
- Plans need to consider issues around global travel disruption.
- Border closures, airport / port closures, effects on both imports and exports.
- Widening of customer base to try to limit impact of any customer closing and not requiring supply.
- In some cases, altering product mix to cater for a wider range of customer sectors.
-
Continuous assessment and revision of BCM arrangements.
- Unlike many other types of business disruption, there was a need for different arrangements as the situation changed.
-
Preparing risk assessments and return to work plans for post-pandemic.
- Interim arrangements for a phased return to opening business premises, focus on health & safety.
Changes for the future
The ways in which organisations have had to adapt due to COVID-19 have led to changes in the way they think about risk management in general, and BCM specifically. It is likely that the implications from this situation will lead to:
- Much wider importance given to BCM by boards and senior management
- A greater focus on building organisational resilience
- Further integration of BCM with the organisation’s wider risk management programme
- Greater focus on risk management and BCM from regulators, investors, insurers and customers
- A need for organisations of all sizes to develop BCPs for their operations, including those that have not done so historically.
Ensuring an organisation is as resilient as possible, whilst understanding operational priorities in recovering from severe disruption, would have helped many businesses transition more effectively during the pandemic. Harnessing lessons learned from this situation, together with ensuring normal business risks are managed, means that business continuity is as important as ever.
How can Gallagher help?
- Reviews and gap analyses of existing arrangements
- Business continuity and pandemic plan development
- Testing and exercising of current plans and teams
- Bespoke training in all BCM subject areas
Sources:
- Adapted from the Business Continuity Institute - Good Practice Guidelines
- Adapted from Business Continuity Institute - Pandemic Resilience – A Continuity Perspective February 2020
