Coronavirus; the Business Continuity implications and advice

• by Ellie Hurst
• Advent IM Blog

COVID-19 or the Coronavirus, is at the forefront of everyone’s minds, whether that be for personal or business reasons. It is recommended that all organisations review their Business Continuity (BC) and Disaster Recovery (DR) plans to ensure it covers a large-scale pandemic. BC plans should include DR, so an organisation with a well-constructed BC Plan will naturally be in a great position for recovery. The Business Continuity Institute (BCI) noted in their Horizon Scan for 2020 that this virus appeared very quickly, so quickly in fact, that it doesn’t feature highly in their report (the relevant threat category “Non-occupational disease” is ranked at second from last in the list of Future Threats). This shows two things, 1. The threat landscape is volatile; things change very quickly so a BC plan that is ‘shelf-ware’ is of little use to anyone, and 2. Horizon scanning is a vital part of the health of any BC Plan and it should be a living document with a team supporting it to ensure new threats are considered and risks properly evaluated. If you haven’t already then now is the time to dust off your organisational BC plan, brief your teams and think about some key points to ensure your business and its people are fully prepared:

• Ensure the BC plan (and therefore the DR Plan) is up to date and staff are fully aware of its procedures, including their roles if they are part of the BC Team or Department heads (or similar)
• Circulate relevant developments surrounding Coronavirus and provide senior management oversight to employees
• Manage the impact on employees, introduce a Coronavirus policy so employees know what to do should the virus affect them
• Manage third parties, suppliers and contractors. Understand what they are doing to ensure services continue.

A good BC plan should already cover the main risks which run alongside a potential pandemic. These include the impact on business as usual operations, supplier issues and people risk. It is vital to ensure business critical activities are captured, documented, owned and to then test the controls subsequently put in place. This can be done via a tabletop exercise and this will enable a number of scenarios to be tested, including but not limited to, office closures, quarantines, public transportation disruption and critical supplier disruption.

The true impact of COVID-19 is unknown, so no BC Plan or risk assessment and mitigation can guarantee full and immediate safeguards of business operations. Ensuring the following points are risk assessed and have appropriate controls and processes in place, can aid in handling and managing against significant disruption. We can use experience from certain historical virus outbreaks (Swine Flu, Avian Flu etc.), but changes in the way we work will also affect BC; such as greater agility, more flexible working arrangements, making self-isolation far less damaging than in previous outbreaks, for instance. So we should be careful when using historical impacts as models for mitigation and recovery and consider the organisation realistically and holistically.

• Keep Staff Informed
  • Communicate the Business Continuity and Disaster Recovery plan
  • Have line managers conduct a meeting to discuss and ensure roles and responsibilities are understood
• Test and Secure access to enable working from home
  • Provide remote access or laptops and any other devices to aid employees to work from home – remind staff of reasonable use policies if this is equipment that don’t usually access
  • Ensure equipment is taken home at the end of each day as the situation surrounding the virus changes daily and quickly
  • Consider rotating office staff to work remotely to enable to identify remote working issues
• Ensure staff contact details are up to date
  • Ensure telephone numbers and next of kin details are fully completed and up to date for all staff
  • Ensure the employee communication plan works by proactively testing
• Coordinate with outside parties
  • Agree and open communication and coordination with key vendors including clients, suppliers’ contractors and media platforms
  • Consider alternative suppliers/service providers
• Identify Key personnel
  • Identify key functional employees and their responsibilities
  • Ensure back up personnel are aligned or a response in place should key employees be unable to execute their responsibilities.

Business Continuity has its own intentional standard, ISO 22301 and this standard offers great guidance and a framework on which to build your BC Plan. Whether your supply chain partners are asking for evidence of you BC posture or you are seeking the best guidance to comply with, you should consider this standard. Certifications continue to rise for ISO22301 and in an unpredictable world and a constantly evolving threat landscape, it is easy to see why. Businesses who report¹ being certified to ISO22301 also reported fewer incidents over the past 12 months.

Looking ahead, looking back

Despite occupying a top five ‘frequency of incidents’ position in the preceding 12 months  for the category (in the BCI Horizon Scan) that would include Coronavirus, businesses have still projected a relatively low likelihood for 2020 – although the impact predicted is more aligned with the actual impact felt over the preceding 12 months, it is still lower. The 2021 report will make very interesting reading…

For help with Business Continuity, including Covid-19 policy creation, talk to the team.

0121 559 6699  |   bestpractice@advent-im.co.uk

__________________________________________________________________________________

1. BCI Horizon Scan Report 2020 – Benchmarking business continuity