Why a pandemic-specific BCP matters
Many organisations still do not have scenario-specific business continuity plans, which are helpful when the situation requires a customised response, such as a pandemic, according to Forrester
When employees at an energy company in Asia had to work from home amid the Covid-19 outbreak, their IT team scrambled to find virtual private network (VPN) tokens that were needed to connect to the corporate network.
The IT team also had to prioritise access to the tokens, but that did not alleviate the strain on VPN resources that had disrupted some management meetings. The company’s collaboration tool was also spotty, leading some employees to use personal messaging tools to conduct meetings.
Meanwhile, public cloud providers were limiting the amount of cloud resources that the IT team could spin up at a time when the company was ramping up its services to support customers.
Although the company has a business continuity plan (BCP) to keep the business humming, it will assess its infrastructure to see what can be improved. Meanwhile, it is making do with what it has to support employees across the board.
According to Forrester, many organisations still do not have scenario-specific BCPs. Instead, they create BCPs that address the loss or impact, such as loss of facilities, loss of technology, or loss of people.
Impact-based BCPs are useful because response teams can invoke them regardless of the event (and it is impossible to predict every possible event that might disrupt a business), but they are far less helpful when the scenario requires a very customised response, such as a pandemic.
To adequately prepare for a pandemic, Forrester advised organisations to develop a pandemic response plan which should be exercised regularly.
Develop a response plan specific to a pandemic
If you have not already done so, your organisation should develop BCPs specific to a pandemic or epidemic. Most existing BCPs address business recovery and resumption after events such as extreme weather, terrorism and power outages, but do not adequately address the repercussions of a pandemic.
Unlike these other risks, disease outbreaks affect people more than they do datacentres and corporate facilities, and their duration is much longer. As already seen, disease outbreaks can flare up, subside, and then flare up again.
Forrester recommended a three-step process to ensure that a pandemic response plan is thorough and effective. That includes identifying an executive sponsor and building a pandemic planning team, assessing critical operations, supplier and customer relationships, as well as the impact on the workforce.
Exercise your new or existing pandemic plan
According to Forrester’s data and its own direct experience, organisations still fail to exercise their plans on a regular basis.
One large simulation per year is typical, and when they do conduct exercises, they are not selecting a pandemic as the scenario, it noted.
Scheduling exercises with enough business involvement and support is difficult, so when organisations do it, they opt for the most probable and high-impact scenarios, and extreme weather and IT failures usually top that list.
And unfortunately, both the emergence and the spread of pandemics are difficult to predict, so organisations have left them out of the scenarios they cycle through for their exercises. If you have an existing plan, Forrester recommended scheduling a plan walk-through to determine how current and complete your plan is.
The pandemic management phase
As countries enter phase three of the pandemic – the management phase – Forrester said it is crucial for governments, schools, businesses and society at large to establish and follow pandemic management protocols – how people work, travel, socially congregating and connect as a society.
If this phase is mismanaged, countries risk looping back to the infection phase. Unlike disruptions caused by IT failure or a weather incident, pandemic recovery planning requires carefully managing the health, safety, and well-being of employees, customers, partners and society.
“A general business recovery plan is only helpful in dealing with disruptions caused by an extreme weather event or an IT failure,” said Stephanie Balaouras, vice-president and group director at Forrester.
“A pandemic recovery, just as with pandemic planning, requires its own unique response because disease outbreaks can subside and then flare up again. Since this global pandemic is the first in 10 years, and only the second in 50 years, organisations need guidance on how to quickly close and reopen their operations if there is a new burst of infections or a second wave,” she added.
According to Forrester, the key pandemic recovery planning measures should include:
- Returning employees back to work in stages to minimise risk. Organisations will reduce the financial risk of reopening retail locations, plants, and other facilities before demand resumes as well as to reduce the risk of infection.
- Rethinking and reconfiguring physical spaces to safeguard employee well-being. Globally, regulatory bodies are publishing risk frameworks to guide employers on how to protect employees during Covid-19.
- Leveraging digital to pivot to new opportunities. Any merchant that does not already have a digital presence must invest in it now. Also, utilise digital to pivot to new revenue models.
- Aligning business priorities and working closely with the chief financial officer (CFO) to plan a full return to capacity. Key decisions about when, how and how many employees return to work will be based on the firm’s financial viability. A recovery plan will require CFOs to determine financial viability thresholds and balance cost-cutting countermeasures with operational requirements of the business.
- Maintaining continuous communication with all key audiences, especially employees. The communication strategy should clearly outline how the organisation will communicate before, during, and after the pandemic. It should dictate the actual channels, modes of communication, and the frequency of communication.
- Building business resiliency as a competitive advantage. Resilient companies – those that can deliver on their vision and mission no matter the crisis or disruption – will build a strategy that will enable them to mitigate risks, develop crisis and incident response capabilities and design resilient and reliable business systems and supply chains.
Read more about coronavirus and BCPs
- Larger Malaysian enterprises have BCP in place, but SMEs lag behind and will find it harder to weather the Covid-19 storm.
- This guide offers information on the effect of the coronavirus on enterprises and the need for pandemic and business continuity planning to keep businesses safe and in operation.
- Coronavirus business continuity calls for video to support remote work mandates. Learn the benefits of video conferencing and best practices for video meetings among remote employees.