Tweet
Avalution Consulting offers advice to businesses
Offer a free 20 minute webcast with a good overview for business planning.
Leveraging the pandemic threat to mature BCM
A growing number of organizations (in both the public and private sectors) are looking at the threat posed by the Avian Flu. Nearly every major publication and news outlet has covered the potential impact of a bird flu pandemic, and embedded in their coverage is the reality that most organizations have done little, if anything, to prepare. This news coverage has led executive managers to begin questioning their organization?s readiness to respond to such an event. Based on industry-wide surveys, and personal discussions, very little has been done at the corporate level to address this threat. HOWEVER, the growing awareness of this and other emerging threats should be seen as an opportunity to mature business continuity programs.
Why Don?t Existing Plans Work?
Why don?t most existing business continuity plans address a pandemic? Because an Avian Flu scenario impacts the most difficult resource to recover ? people. Most business continuity programs either assume that people will not be affected by an event, or outline assumptions regarding the quick return of people to work. Why do these flawed assumptions exist? It?s relatively simple to identify workplace recovery locations, but it?s a difficult and expensive proposition to develop and track redundant institutional knowledge ? as well as geographically separate this knowledge to protect it. Therefore, in a scenario like the Avian Flu, people will be affected, and they may be away for a prolonged period of time. Estimates range from 25% to 40% of the workforce being affected directly or indirectly, and the affect may last as long as four weeks to three months. Fear will drive people toward isolation, and an employee?s last concern will be to work ? their first concern being their safety, as well as their family.
Although a pandemic scenario has significant personal and business consequences, this situation offers business continuity professionals a unique opportunity to review the readiness of their programs in terms of ?people availability? in general. Planning for a pandemic may lead to risk reduction opportunities for other threats impacting an organization?s human capital. The remainder of this article will explore our recommended approach to planning for a pandemic event, but it?s important to understand that nearly the entire approach can be applied to general planning for employee availability.
How Are Organization?s Planning for a Pandemic ? or ?People Availability? in General?
It?s natural to be concerned about the effect of a pandemic on your business interests. Our recommended approach to planning for the loss of people can be summarized into four steps:
1. Develop assumptions specific to your organization and identify which key business functions would be most impacted by the absence of your employees.
Executive managers play a key role in analyzing the organization?s exposure to a pandemic event and establishing certain assumptions. Key considerations include:
? What does Avian Flu mean to the organization?
? What are the assumptions unique to your business both domestically and abroad?
? What are the critical elements of the business, particularly those heavily dependent on people and those that are potential single points of failure impacting critical value streams? What are the most critical products for the most critical customers?
? What may be impacted, for how long, and to what extent?
? Are business processes executed in a way that would contribute to significant business impact in the event of a pandemic event? For example, is product located in a single warehouse, can call centers route calls to one another, etc.?
? Who are the key stakeholders of the organization ? both internally and externally?
Developing answers to these questions provides a decision making framework for executives to effectively select strategy options and eventually manage through a pandemic crisis.
2. Identify mitigation and response options
Defining risk management options (risk reduction and business continuity strategies) begins with building or expanding the crisis management process, and continues through the definition of tactical strategies to manage or mitigate the risk of the loss of personnel.
First and most important, defining the crisis management and crisis communications processes enable formal decision-making mechanisms that are necessary to manage a pandemic event. Organizations with existing, well-defined crisis management processes are well on their way toward preparing to manage a global pandemic event, allowing the business continuity planner to build on the existing processes and to focus on educating the crisis management team about the risks and available options that are specific to a pandemic event. During this phase of planning, there must be significant consideration for the unique communication needs during such a crisis.
Additionally, a cross-functional planning team should be formed to identify specific methods and strategies to proactively mitigate or limit the impact of a pandemic event before it occurs, and ways to actively respond in order to reduce the severity of the crisis should it occur. These options include the design of monitoring processes and the definition of healthy workplace strategies.
3. Prioritize options based on risk as part of an escalation plan, with defined triggers
With assumptions established, and a variety of possible strategies identified, the business continuity planner should engage executive managers to assess risk and prioritize strategies based on a cost-benefit analysis. Once prioritized, appropriate triggers for strategy implementation should be identified and the escalation plan should be documented ? as a separate plan, or optimally, as an addendum to the crisis management plan.
4. Prepare the organization to implement strategies should a pandemic event occur
Finally, the business continuity planner should lead the effort to prepare the organization to implement the crisis management and pandemic plans, should the need arise. This will include acquiring the necessary resources, creating and executing training programs, developing awareness plans, and facilitating exercises of the new plans and strategies.
A Solution to Address the ?People Availability? Issue
With such a huge potential impact, and with constant reminders of the growing likelihood of a pandemic event, businesses worldwide are now searching for the best solution to mitigate the risk to their organizations. Regardless of the specific industry, a pandemic strategy should be a part of any organization?s crisis management framework. Similar to the recommended approach outlined in the previous section, the solution should include four key components.
1. A crisis management plan and process includes a well-educated crisis management team. This team must be positioned to make decisions on behalf of the organization and implement risk management and risk reduction strategies on an as needed basis. The crisis management team takes an active leadership role in analyzing the organization?s potential exposure to the Avian Flu and defining and implementing potential pandemic response strategies to manage the event. Crisis management is a critical process that is used to:
? Continually analyze the ongoing situation,
? Make decisions based on defined triggers,
? Implement risk management solutions,
? Consistently react to the changing threat, and
? Reassure stakeholders as events unfold.
A key element of the crisis management process is a well-thought out crisis communications strategy ? a strategy that stays in close contact with all of the organization?s stakeholders. In the face of a large scale pandemic, employees and other stakeholders may become dependent on employers for guidance. Businesses will quickly be faced with massive communication and coordination issues. It is essential that special consideration be given to knowing the key audiences, and developing and implementing communications methods as part of crisis management.
? Define and implement Emergency Notification Processes through the Use of Call Trees, Automated Notification, Toll-free Numbers and Emergency Websites
? Initiating Coordination and Communication with Public Authorities
? Activating External Communication Teams Located at Each Domestic and International Location
? Communicating Defined, Targeted Stakeholder Communications Content ? focused on threat assessment results, current business impact and response decisions
? Initiating Cross functional Customer Response Center - critical product requirements and allocations, customer assistance and response updates
2. Related to the crisis management plan is an escalation plan with defined triggers to implement risk management and risk reduction strategies is a key element of a pandemic preparedness strategy. Triggers are external events that lead an organization to take action with specified strategies. A key component of the pandemic plan is identifying the triggers, associating a trigger with specific strategies, and clearly training the crisis management team to implement the strategies. As an example, some organizations may define a key trigger as a government confirmed case of human to human transmission of H5N1. A logical escalation plan related to this trigger might be to implement an employee travel tracking process, or a communication regarding travel to affected countries. Another element of the escalation plan may be to review product and materials safety stock, and make adjustments as required based on analysis. Identifying triggers and escalation plans is a key component of the pandemic preparedness solution.
3. A series of risk management strategies created and resourced before an event occurs must be available to the crisis management team. Risk management strategies are foundational elements of preparing the organization to react should the threat of a pandemic occur. The primary purpose of these strategies is to prepare to reduce the impact of the event and provide stakeholders with comfort that the organization is looking out for their interests.
Risk management strategies should include processes to monitor the situation and position the organization to react. This includes developing answers to the following questions:
? Is a process in place to monitor global health alerts based on the location of your international interests, specifically suppliers, outsourcers, and customers?
? Is a process in place to track employees that travel both domestically and internationally?
? Are there technology limitations that will impact the organization?s ability to enable employees to work from home?
? Is there a succession plan in place, and how should all elements of the business handle decision making?
? What and where are the critical staffing needs?
? How are critical products sourced, both domestically and from overseas locations? How are they shipped? Are there supply chain single points of failure?
In addition to processes to monitor the situation and prepare to react in a timely manner, healthy workplace strategies should be in place to minimize the spread of the disease.
? Implementing healthy workplace actions and awareness campaigns, to include reminding people to wash their hands and mandating sick employees stay home
? Moving people so they are less concentrated, or handing out masks to help slow the spread of the disease
? Opening a ?sick room? where ill employees can go before leaving from home
? Propping open doors so door knobs don?t contribute to the spread of a disease
? Changing the culture of the business for the duration of the event, to include closing conference rooms and the cafeteria, as well as other places where employees congregate
Operational and tactical strategies should be developed to minimize the impact of a disruption. Although each organization?s overall risk mitigation strategy is unique, and organizations are approaching this issue differently, some commonly considered concepts under development include:
? Dispersing critical inventory
? Deploy work at home IT assets
? Freeze non-critical operations
? Re-deploy critical personnel to critical tasks that directly impact critical customers
? Adding safety stock for critical product
? Prepare for special needs of employee family members
? Pre-qualify alternative domestic or local suppliers
? Develop joint crisis management/recovery plans with key suppliers
This is a short introductory list of response strategies. Creativity and brainstorming are key to identifying and developing the right response strategies with predefined triggers for each unique business.
4. Beyond developing and documenting strategies and plans, exercising these new threat-specific plans is important, as is rolling out awareness activities. Fear is most likely the variable that will impact your organization, and knowledge is the best risk mitigation technique against fear. Training and awareness processes should focus on the crisis management team, and all internal and external stakeholders. This can take the form of live presentations, newsletters, and even online training
However, exercises are the most important element in providing comfort and confidence to managers and employees alike. Exercising will enable managers to develop experience and knowledge in a low threat environment, as well as identify plan weaknesses and areas for improvement. They will understand how to make decisions, and become familiar with the strategies and tools available to them, which includes the methods to communicate with stakeholders. Employees will also understand what the organization has done to prepare, and they will develop an understanding of what?s expected of them should a pandemic event take place.
Conclusions
Planning for the short, medium or long-term loss of employees is the most difficult issue facing business continuity professionals. Developing an understanding of where the organization has personnel single points of failure and how these ?weaknesses? intersect with the most critical elements of the organization is a critical element of planning for the loss of employees. This understanding, when combined with a tested crisis management process and risk reduction strategies, is an effective method to respond to and recover from a pandemic event. But most importantly, planning for a loss of people due to a pandemic will enable the organization to embark on planning for the loss of employees due to other threats. The process remains the same, although the risk reduction strategies to affect the likelihood of the loss will differ.
A growing number of organizations (in both the public and private sectors) are looking at the threat posed by the Avian Flu. Nearly every major publication and news outlet has covered the potential impact of a bird flu pandemic, and embedded in their coverage is the reality that most organizations have done little, if anything, to prepare. This news coverage has led executive managers to begin questioning their organization?s readiness to respond to such an event. Based on industry-wide surveys, and personal discussions, very little has been done at the corporate level to address this threat. HOWEVER, the growing awareness of this and other emerging threats should be seen as an opportunity to mature business continuity programs.
Why Don?t Existing Plans Work?
Why don?t most existing business continuity plans address a pandemic? Because an Avian Flu scenario impacts the most difficult resource to recover ? people. Most business continuity programs either assume that people will not be affected by an event, or outline assumptions regarding the quick return of people to work. Why do these flawed assumptions exist? It?s relatively simple to identify workplace recovery locations, but it?s a difficult and expensive proposition to develop and track redundant institutional knowledge ? as well as geographically separate this knowledge to protect it. Therefore, in a scenario like the Avian Flu, people will be affected, and they may be away for a prolonged period of time. Estimates range from 25% to 40% of the workforce being affected directly or indirectly, and the affect may last as long as four weeks to three months. Fear will drive people toward isolation, and an employee?s last concern will be to work ? their first concern being their safety, as well as their family.
Although a pandemic scenario has significant personal and business consequences, this situation offers business continuity professionals a unique opportunity to review the readiness of their programs in terms of ?people availability? in general. Planning for a pandemic may lead to risk reduction opportunities for other threats impacting an organization?s human capital. The remainder of this article will explore our recommended approach to planning for a pandemic event, but it?s important to understand that nearly the entire approach can be applied to general planning for employee availability.
How Are Organization?s Planning for a Pandemic ? or ?People Availability? in General?
It?s natural to be concerned about the effect of a pandemic on your business interests. Our recommended approach to planning for the loss of people can be summarized into four steps:
1. Develop assumptions specific to your organization and identify which key business functions would be most impacted by the absence of your employees.
Executive managers play a key role in analyzing the organization?s exposure to a pandemic event and establishing certain assumptions. Key considerations include:
? What does Avian Flu mean to the organization?
? What are the assumptions unique to your business both domestically and abroad?
? What are the critical elements of the business, particularly those heavily dependent on people and those that are potential single points of failure impacting critical value streams? What are the most critical products for the most critical customers?
? What may be impacted, for how long, and to what extent?
? Are business processes executed in a way that would contribute to significant business impact in the event of a pandemic event? For example, is product located in a single warehouse, can call centers route calls to one another, etc.?
? Who are the key stakeholders of the organization ? both internally and externally?
Developing answers to these questions provides a decision making framework for executives to effectively select strategy options and eventually manage through a pandemic crisis.
2. Identify mitigation and response options
Defining risk management options (risk reduction and business continuity strategies) begins with building or expanding the crisis management process, and continues through the definition of tactical strategies to manage or mitigate the risk of the loss of personnel.
First and most important, defining the crisis management and crisis communications processes enable formal decision-making mechanisms that are necessary to manage a pandemic event. Organizations with existing, well-defined crisis management processes are well on their way toward preparing to manage a global pandemic event, allowing the business continuity planner to build on the existing processes and to focus on educating the crisis management team about the risks and available options that are specific to a pandemic event. During this phase of planning, there must be significant consideration for the unique communication needs during such a crisis.
Additionally, a cross-functional planning team should be formed to identify specific methods and strategies to proactively mitigate or limit the impact of a pandemic event before it occurs, and ways to actively respond in order to reduce the severity of the crisis should it occur. These options include the design of monitoring processes and the definition of healthy workplace strategies.
3. Prioritize options based on risk as part of an escalation plan, with defined triggers
With assumptions established, and a variety of possible strategies identified, the business continuity planner should engage executive managers to assess risk and prioritize strategies based on a cost-benefit analysis. Once prioritized, appropriate triggers for strategy implementation should be identified and the escalation plan should be documented ? as a separate plan, or optimally, as an addendum to the crisis management plan.
4. Prepare the organization to implement strategies should a pandemic event occur
Finally, the business continuity planner should lead the effort to prepare the organization to implement the crisis management and pandemic plans, should the need arise. This will include acquiring the necessary resources, creating and executing training programs, developing awareness plans, and facilitating exercises of the new plans and strategies.
A Solution to Address the ?People Availability? Issue
With such a huge potential impact, and with constant reminders of the growing likelihood of a pandemic event, businesses worldwide are now searching for the best solution to mitigate the risk to their organizations. Regardless of the specific industry, a pandemic strategy should be a part of any organization?s crisis management framework. Similar to the recommended approach outlined in the previous section, the solution should include four key components.
1. A crisis management plan and process includes a well-educated crisis management team. This team must be positioned to make decisions on behalf of the organization and implement risk management and risk reduction strategies on an as needed basis. The crisis management team takes an active leadership role in analyzing the organization?s potential exposure to the Avian Flu and defining and implementing potential pandemic response strategies to manage the event. Crisis management is a critical process that is used to:
? Continually analyze the ongoing situation,
? Make decisions based on defined triggers,
? Implement risk management solutions,
? Consistently react to the changing threat, and
? Reassure stakeholders as events unfold.
A key element of the crisis management process is a well-thought out crisis communications strategy ? a strategy that stays in close contact with all of the organization?s stakeholders. In the face of a large scale pandemic, employees and other stakeholders may become dependent on employers for guidance. Businesses will quickly be faced with massive communication and coordination issues. It is essential that special consideration be given to knowing the key audiences, and developing and implementing communications methods as part of crisis management.
? Define and implement Emergency Notification Processes through the Use of Call Trees, Automated Notification, Toll-free Numbers and Emergency Websites
? Initiating Coordination and Communication with Public Authorities
? Activating External Communication Teams Located at Each Domestic and International Location
? Communicating Defined, Targeted Stakeholder Communications Content ? focused on threat assessment results, current business impact and response decisions
? Initiating Cross functional Customer Response Center - critical product requirements and allocations, customer assistance and response updates
2. Related to the crisis management plan is an escalation plan with defined triggers to implement risk management and risk reduction strategies is a key element of a pandemic preparedness strategy. Triggers are external events that lead an organization to take action with specified strategies. A key component of the pandemic plan is identifying the triggers, associating a trigger with specific strategies, and clearly training the crisis management team to implement the strategies. As an example, some organizations may define a key trigger as a government confirmed case of human to human transmission of H5N1. A logical escalation plan related to this trigger might be to implement an employee travel tracking process, or a communication regarding travel to affected countries. Another element of the escalation plan may be to review product and materials safety stock, and make adjustments as required based on analysis. Identifying triggers and escalation plans is a key component of the pandemic preparedness solution.
3. A series of risk management strategies created and resourced before an event occurs must be available to the crisis management team. Risk management strategies are foundational elements of preparing the organization to react should the threat of a pandemic occur. The primary purpose of these strategies is to prepare to reduce the impact of the event and provide stakeholders with comfort that the organization is looking out for their interests.
Risk management strategies should include processes to monitor the situation and position the organization to react. This includes developing answers to the following questions:
? Is a process in place to monitor global health alerts based on the location of your international interests, specifically suppliers, outsourcers, and customers?
? Is a process in place to track employees that travel both domestically and internationally?
? Are there technology limitations that will impact the organization?s ability to enable employees to work from home?
? Is there a succession plan in place, and how should all elements of the business handle decision making?
? What and where are the critical staffing needs?
? How are critical products sourced, both domestically and from overseas locations? How are they shipped? Are there supply chain single points of failure?
In addition to processes to monitor the situation and prepare to react in a timely manner, healthy workplace strategies should be in place to minimize the spread of the disease.
? Implementing healthy workplace actions and awareness campaigns, to include reminding people to wash their hands and mandating sick employees stay home
? Moving people so they are less concentrated, or handing out masks to help slow the spread of the disease
? Opening a ?sick room? where ill employees can go before leaving from home
? Propping open doors so door knobs don?t contribute to the spread of a disease
? Changing the culture of the business for the duration of the event, to include closing conference rooms and the cafeteria, as well as other places where employees congregate
Operational and tactical strategies should be developed to minimize the impact of a disruption. Although each organization?s overall risk mitigation strategy is unique, and organizations are approaching this issue differently, some commonly considered concepts under development include:
? Dispersing critical inventory
? Deploy work at home IT assets
? Freeze non-critical operations
? Re-deploy critical personnel to critical tasks that directly impact critical customers
? Adding safety stock for critical product
? Prepare for special needs of employee family members
? Pre-qualify alternative domestic or local suppliers
? Develop joint crisis management/recovery plans with key suppliers
This is a short introductory list of response strategies. Creativity and brainstorming are key to identifying and developing the right response strategies with predefined triggers for each unique business.
4. Beyond developing and documenting strategies and plans, exercising these new threat-specific plans is important, as is rolling out awareness activities. Fear is most likely the variable that will impact your organization, and knowledge is the best risk mitigation technique against fear. Training and awareness processes should focus on the crisis management team, and all internal and external stakeholders. This can take the form of live presentations, newsletters, and even online training
However, exercises are the most important element in providing comfort and confidence to managers and employees alike. Exercising will enable managers to develop experience and knowledge in a low threat environment, as well as identify plan weaknesses and areas for improvement. They will understand how to make decisions, and become familiar with the strategies and tools available to them, which includes the methods to communicate with stakeholders. Employees will also understand what the organization has done to prepare, and they will develop an understanding of what?s expected of them should a pandemic event take place.
Conclusions
Planning for the short, medium or long-term loss of employees is the most difficult issue facing business continuity professionals. Developing an understanding of where the organization has personnel single points of failure and how these ?weaknesses? intersect with the most critical elements of the organization is a critical element of planning for the loss of employees. This understanding, when combined with a tested crisis management process and risk reduction strategies, is an effective method to respond to and recover from a pandemic event. But most importantly, planning for a loss of people due to a pandemic will enable the organization to embark on planning for the loss of employees due to other threats. The process remains the same, although the risk reduction strategies to affect the likelihood of the loss will differ.
Comment