Business Continuity in Times of the Plague

Our Insights
Business Continuity in Times of the Plague
Posted on

Over the past days and hours we have been witnessing, in Poland as well as globally, a rapid increase in the number of persons infected with the SARS-CoV-2 virus, which causes the disease called COVID-19. Just as rapidly, numbers of people who are quarantined are increasing, and these numbers are far greater.

To calculate the number of people affected by the virus we need to remember about those whose daily schedules were forcibly changed, completely or in part, owing to the necessity to provide care and/or provisions for family and friends who are ill or quarantined and their children and seniors, etc.

Bearing in mind that the increase is exponential rather than linear, as is unfortunately typically the case with epidemics, we need to react post haste and answer this question:

How can this situation and its future development impact a company’s capability to continue doing business?

In case the company has not engaged in this kind of exercise as part of its business continuity process, now is high time to do so. It is worth considering what effect can the current situation have on the day-to-day activities of the company, and what can be done — and what must — to minimize, if not altogether eliminate, the impact of negative scenarios coming true. And if your company has taken steps to prepare for such an unlikely scenario in the past, you definitely should not rest on your laurels, but rather use this opportunity to review these plans against the specific crisis scenarios related to this epidemic.

These will naturally be different for different industries, and in their specifics also for different companies within one industry, but there is a common denominator they all share. Faced with an epidemic, any company may need to contend with (among others) the following scenarios:

Scenario 1: Personnel shortages

This seemingly cliched scenario taken straight from a catastrophic B-film has several aspects:

Unavailability of key personnel

In any company there exist persons whose level of authorisation (to make decisions, sign documents etc.), knowledge, skills, and/or other qualities make them difficult to replace/substitute. Their unavailability may be due not only to the above-mentioned reasons (becoming ill, quarantined, etc.), but also be caused by external factors, like the legal obligation to abide by decisions of various authorities (we’ve just had a special-purpose act passed by the Parliament on this special time!) or, for instance, due to being drafted into the military. One cannot disregard the possibility of such a turn of events where — however exaggerated it may sound at the moment — reservists of certain specialties (medics, drivers, MPs), or with certain military assignments (e.g. hospitals), are called up.

Unavailability of a significant proportion of personnel of all levels

It is trite to say that a company cannot operate without its personnel, and thus one does not need a vivid imagination to see that if, for reasons mentioned in the introduction, a large proportion of said personnel is absent, the impact on production processes (whatever they may be, from steelmaking to software development) will be immediate and severely negative.

Scenario 2: Inaccessibility of the workplace

Quarantining your office block, or closing it down for disinfection or any other reason, may mean that even with sufficient personnel ready and able to work, the company operations will grind to a halt. In addition, such a situation may render the tools of the trade (say, computers) inaccessible for prolonged periods.

Scenario 3: Interruptions and irregularities in services provided by third parties

Crisis scenarios we are envisaging for ourselves may equally easily come true for our suppliers, service providers, and subcontractors. In fact, they may be even more likely there, the smaller and less expensive their companies are.

Scenario 4: Feasibility of other fallback plans

Experience (especially the last few days) teaches us that attempts to purchase specific types of equipment offhand, e.g. to replace faulty units, may be unsuccessful even if the company has operated with minimal or non-existent spare stock for decades.

So, what now?
In the light of the above, a question needs to be answered: how can I prepare for such situations, and what is best to focus on, especially if we never prioritised operational continuity? Based on the practically universal disruption scenarios outlined above, it seems that the following are best undertaken first:

First, prevention

While we are unable to stop the epidemic, we are more than capable to minimize the risk of it affecting our business:

  • Actively draw your personnel’s attention to the recommendations issued by authorities (health and sanitary, as well as others), and support them in their application, from basic hygiene to advising employees to reconsider and hopefully cancel private travel.
  • Clearly articulate your expectations regarding personnel who feel unwell, and strictly enforce them both with regard to said personnel and their superiors.
  • Limit or cancel business trips as much as possible.

Second, don’t panic

Whatever your company decides to do must be well-informed, thoroughly thought through and consistent, so that employees feel safe and supported. This may be of key importance for their ability to carry out work in unfavourable conditions of stress and — often unrealised consciously –
fear for their family and friends. It will also help to limit irrational behaviours, like coming to the office feverish and with a cough, because “it’s likely just the common cold, and I must meet those deadlines…”.

How to prepare better?

Parallel to taking preventive measures you should also consider the possibility of the crisis scenarios outlined above actually unfolding, and try to prepare in the following ways:

Identify key processes, which may be disrupted in case one of these scenarios comes true.
You must consider how the unfolding of each scenario actually impacts your particular business in this area, and answer a few key questions:

  1. What is the period of time your company can tolerate of each key process being severely limited? Or completely inoperable?
  2. If the acceptable period of limited operability is shorter than that of potential inaccessibility of its regular location, can the process be moved to a different location? And if so, are you actually capable of doing so (you have the know-how, there is sufficient space, you’ve tested this before)?
  3. Can any or all key processes be performed remotely, off-site, via work from home? If so, are you capable, technology-wise and organization-wise (equipment, procedures, trained personnel), of operating in this mode for prolonged periods?

Naturally, the next step is to plan both immediate and long-term strategies to change any unsatisfactory answers to the above questions, and other activities that will limit the negative impact of crisis scenarios unfolding in your particular situation.

  • Identify key personnel. Within the key processes you must find all activities that can only be performed by particular persons or small groups of persons, and make sure that other employees can perform these tasks, by delegating authorisations, mandates and powers of proxy, knowledge transfer etc.
  • Verify your purchase plans. Review your planned investments focusing on the availability of goods, as well as the potentially weaker financial situation of your company, and modify/prioritise them accordingly. While doing so, assess how this modification will affect further processes within the company.
  • Verify measures taken by your service providers, suppliers and subcontractors. You must find out if, and to what degree, your providers, suppliers and subcontractors are aware of the crisis and prepared to operate in uncertain conditions riddled with disruptions, and accordingly plan strategies for the long term (in the immediate timeframe, find alternative providers and suppliers; long-term, consider amending your service contracts) based on your newly-acquired knowledge

Communicate. Information shortage and uncertainty can only make a bad situation worse. Build awareness and trust through:

– clearly communicating to your personnel everything the company is doing and plans to do, and making sure communication channels remain open in crisis situations: can you (if need be) communicate to each and every employee that they must work from home, or remain quarantined? Communication channels with personnel must be tested.
– clearly communicating to your providers, suppliers and subcontractors your actions and expectations. This can only bring benefits, from building problem awareness, to saving your favourite supplier from bankruptcy, or your company from paying for uncollected deliveries.
– clearly and proactively inform your customers and clients about the current situation at your company and the mitigating steps you are taking. In crisis, such actions can have significant effect in building your company’s image as a responsible, stable and trustworthy partner in difficult times.

Naturally, the crisis scenarios and preventive and coping mechanisms outlined above are very general and schematic, but this is so that they can be applied to a wide array of situations and industries. Their fundamental purpose is to build in the reader a situational awareness, as it were, to help them acquire knowledge of the current state their business is in and of its readiness to cope with problems in general, because you cannot hope to solve a problem if you don’t even know it exists.

Regardless of the scenario you are analysing, and of the steps you are taking, bear in mind that stress-induced knee-jerk reactions very often result in not following procedures and cutting corners, also in security, including information security. While some compromise in following procedures is inevitable in crisis situations, any leniency, any dialling back, must be made with full awareness of what is sacrificed for what gain, and — as much as possible — compensating measures must be implemented.

Remember also that all activities you engage in and all measures you implement must not only be aimed at helping your organization survive the crisis, but at ensuring maximally smooth and minimally expensive transition to “business as usual” mode once the crisis passes. Finally, it would be wise to make use of this situation to ensure all necessary deliberation, strategizing and changes happen, because hopefully the next time circumstances force managements to focus on business continuity is in distant future.

"Regardless of the scenario you are analysing, and of the steps you are taking, bear in mind that stress-induced knee-jerk reactions very often result in not following procedures and cutting corners, also in security, including information security. While some compromise in following procedures is inevitable in crisis situations, any leniency, any dialling back, must be made with full awareness of what is sacrificed for what gain. "

Konrad Trubas Information Security Officer
Go to Expert Spotlight