Business Continuity: Planning for pandemic

International movements of people and goods have halted in the wake of COVID-19. With economic consequences of the outbreak presenting a potentially devastating ‘secondary infection’, business continuity specialist Laura Toplis has some timely advice.

COVID-19 is an infectious disease caused by the most recently discovered coronavirus. As of 10 March 2020, there were 113,603 confirmed cases of COVID-19 globally, with a death-rate of 3.5 percent. The border controls and drop in customer confidence have contributed to major downturns in the aviation and tourism industries.

The impacts of a global pandemic, however, are unlikely to stop at these industries. It is essential that all businesses look closely at their operations, organisational culture and planning to ensure their business survives this outbreak.

The New Zealand government has recently approved a ‘Business Continuity Package’ in response to COVID-19, which includes a variety of forms of financial help. This financial assistance will come as a relief to many businesses, but this package should work in conjunction with a comprehensive business continuity plan prepared by business operators.

Business threats

The biggest threats a pandemic presents to businesses include:

• Loss of staff – staff who are sick or required to self-isolate will need to remain at home. You will need to consider if it is possible for them to work from home (if they are well enough).

• Loss of supply chain – You may no longer be able to procure essential items to your supply chain, or your suppliers could go out of business.

• Loss of customers – travel restrictions and risk averse buying behaviour could result in a significant downturn for your business.

Why a Business Continuity Plan (BCP)?

There are many reasons that an organisation should have a Business Continuity Plan. The pressure to produce a plan may come internally or externally from the organisation, including such drivers as:

• External threats such as COVID-19

• Desire to improve Organisational Resilience – this is likely to come from a manager who identifies gaps that need to be filled. These resilience gaps will be highlighted with a Business Continuity Plan and a process can begin to allocate the appropriate resources to the problem/s.

• Client request – more and more clients are being advised to check the resilience of their supply chain, which means that your larger clients may be asking you to produce a Business Continuity Plan.

• Audit – whether your organisation is being audited or a client is being audited (see above) it is very likely you will be asked to produce your Business Continuity Plan.

When it comes to Business Continuity it’s important to focus on the effect of any disruption rather than the cause. The goal is to effectively deal with any negative incidents that could impact your business.

How to prepare a BCP

One has two options in preparing a BCP: you can either take a do-ityourself approach or hire a consultant. If you choose to write your own plan, then it makes sense to base it on one of the many freely available BCP templates. Identifying the right one is important because Business Continuity Management has its own ISO Standard – ISO 22301 Business Continuity Management Systems (BCMS).

There are therefore specific elements (plans and processes) required to produce a comprehensive BCP and these are easily confused or overlooked:

• People (skills and knowledge) – their safety should be your top priority.

• Infrastructure – could damaged infrastructure restrict access to your premises?

• Premises (buildings and facilities) - is all maintenance up to date?

• Supply Chain (third party products and services) - do you have any single-source suppliers? This means you choose to use a single supplier, even though you could spread your risk by using more than one.

• Reputation - how much damage would an extended disruption cause to your organisation’s reputation?

• Resources (IT, information, equipment, materials) - consider the age and maintenance of your resources.

• Finances (payroll and organisational funds) - do you have sufficient finances and cash reserves to carry you through a business disruption?

• Business Impact Analysis - list the products, services and activities undertaken by your organisation in order of priority.

• Threat Analysis - are there any highlikelihood threats that are specific to your business or location?

• Incident Response Team - who would be the best people in your organisation to respond to a crisis?

• IT Backup – Is your information backed up off-premises/in the cloud on OneDrive or something similar? Have you tested its availability?

• Fallback Site – do you have an alternative location to work from?

One of my most recent clients was an ICT company who supplied services to law firms. These firms asked to see their BCP and my client was concerned about how long it was going to take to produce one.

My advice was that if they used BCP Builder’s online business continuity plan template, which draws from the Business Continuity Institute Good Practice Guidelines and ISO requirements, and sat down with the top management in their organisation, they could produce a BCP within a week. They signed up, completed their plan and forwarded it to their clients with a cover letter stating that their plan was compliant with ISO 22301.

Why it’s important

Having a robust Business Continuity Plan can be considered insurance for the uninsurable parts of your business. Things that you can’t insure against are market-share, customer confidence and reputation.

Having a plan in place means you will recover faster following a disruption, because the event will have less impact on your business. If your business wasn’t badly impacted (particularly if others were), you will gain increased customer confidence.