BUSINESS CONTINUITY PLANNING FROM THE PERSPECTIVE OF THE PANDEMIC

greater than we could have imagined, so we need to think bigger as we plan for the future. Scientists believe that unique risks will result from climate change as well as the frequency of pandemics as temperatures rise and lost habitats result in humans and animals living closer together and transmitting disease. Others warn that the melting permafrost could cause ancient diseases to reemerge. Air pollution also could cause viruses to become airborne and spread faster. All of this should give us a lot to think about as we begin to plan or update our plans. The recent freezing and flooding in Texas should be a lesson also, because of the consequences that affected so many people and businesses.

We now know that we should plan for extended periods out of the office if necessary, shutdowns ordered by the government, as well as the need to maintain (and obtain if necessary) additional equipment to allow people to work from home. And what about ensuring that people working from home have access to broadband and digital communication equipment. The challenge for all of us is to try to identify what additional risks could impact us in the next couple of years, how probable they are and how much of an impact they might have.

Reputation damage, litigation, and other factors increase the odds against business continuity; there is significant potential for loss of income if you are not prepared. An organization should be prepared for anything that could happen—ready to protect its employees, clients/ customers, members, and, to the greatest degree possible, its reputation and financial viability. It's entirely possible that one ruined or badly handled incident might result in extensive revenue losses and require years of rebuilding reputation and attendance.

Mitigation—The Art of Helping Prevent Disruption

Mitigation is everything you do to prevent a disruption from occurring or to minimize its impact—activities aimed at reducing vulnerability, activities performed in advance to decrease impact, loss or damage. There are any number of potential disruptions that you might be able to mitigate, And what about this pandemic you might ask? That’s a good question, since it’s unlikely we would have been able to prevent it. If we had considered in the planning stage that we might have to deal with a pandemic, we might have been able to do something to make it easier on everyone. Now that we know that such a risk is possible and even inevitable, we need to think about how to plan for the next such crisis. For example, instead of scrambling to come up with sufficient equipment for everyone to work at home, what can we do now to prevent all that scrambling? How can we plan for virtual events and meetings? As you think about mitigation, you also need to prioritize which risks might cause the greatest disruptions and plan for those first. It’s important to keep things in perspective. Any consequence that might involve potential critical injury or loss of life must take precedence over less critical outcomes.

Where Do You Begin to Plan?

Business continuity planning is a time-consuming, ongoing process. After you have been through the tasks of identifying your risks and determining any possible mitigation steps, the steps below can help get you from no plan or outdated plan to workable plan. Wherever you are in the process, your efforts will benefit from implementing or rethinking these steps.

Identify your key business functions. You need to assess the criticality of your organization’s business processes and determine the impact and consequences of loss of service or a reduction in normal service levels. Your key business functions are those that, under no circumstances, could be subbed out to a contractor/ vendor and must remain viable to the organization to continue to function. I’m sure you already see a problem here: during this pandemic, did your key business functions change? In what way? How are they likely to remain in their current state and how does that affect your planning?

Determine your recovery time objectives. Once you have identified the key business functions, your next step should be to determine your recovery time objectives (RTO) for each function. How long can you be without each function before the situation goes critical? This will help you determine what you should concentrate on first. Again, however, how did/do your RTOs change during this pandemic? What will they be going forward?

Ensure the safety and security of your people. In any disruption or disaster situation, the safety of your employees should be your main consideration. Start by making sure you have a complete employee roster and contact information for everyone. Have a complete

evacuation plan and practice it; every employee should be familiar with it and know what to do. What will you need in a shelter-in-place situation? As people return to the workplace, this will still hold true. But what will be unique about sheltering out of place when the office is off limits?

Protect your network, data and records. This is critical to ensuring the future viability of your firm. You have a secure network, but do you have a backup network—at some distance from your primary location—in the event your primary network is compromised? Maintaining your important records in the cloud is perhaps the best option and can make data available to employees working from home.

With what you have seen this year, you need to consider what you would add or change to strengthen your plan if a similar situation were to occur again. How will you build resilience into your organizational DNA? Is this really a good time to update your plan? Absolutely, with the knowledge of what worked, what didn’t and what wasn’t even considered, this is the best time. Act while the results are fresh, so you won’t get caught again without the strongest plan possible.

Bob Mellinger is the president and CEO of Phoenix, AZ-based Attainium Corp. For more information about the Plan-A-ware™ service, tabletop exercises, drills, and The Disaster Experience, contact Attainium Corp. at (571) 248-8200 or ContactUs@attainium.net, or visit the Attainium web site at www.attainium.net.