The unprecedented events of the last 4 months have put a spotlight on business continuity. The recent uncertainty and rapid shift in our work and daily lives are a strong reminder that all companies need to have a business continuity plan in place, tested and ready to be deployed at a moment’s notice. Business continuity plans tend to include contingency efforts in the event of a natural disaster such as flooding and fire that prevent staff from entering a place of business, cyber attacks, an infrastructure outage or for more extreme cases a pandemic like Covid-19.
As with any business continuity plan it needs to cover three critical elements: resilience, recovery and contingency.
Contingency is defined as the organization’s ability to establish a generalized capability and readiness to cope with whatever major incidents and disasters occur, including those that were not, and perhaps could not have been foreseen.
Every company hopes to never need to deploy their business continuity plan, but it’s critical to have a plan at the ready. Over the years, as technology has evolved, it has provided businesses with the flexibility and scalability to have employees successfully work from home, hire remote employees and in some cases eliminate the need for bricks and mortar entirely.
Technologies like artificial intelligence (AI) are providing organizations with the means to conduct business like never before by automating and streamlining what were once extremely manual, mind-numbing, time-intensive and repetitive tasks.
Here you are a few questions to answer at:
- What is the first real global pandemic teaching us about resilience and business continuity?
- What is working and what is failing in business emergency management plans?
- What has not been adequately considered?
- How should the pull be adjusted to increase corporate resilience during the COVID-19 period?
SAIL4.IT observatory tells us that nobody was really prepared to handle such an unpredictable scenario as that imposed by COVID-19. Even the most forward-looking companies, which moved some time ago on the issues of Business Continuity and Disaster Recovery, have often built their Plans following the indications of the sector regulations.
This resulted in plans prepared to manage known discontinuity scenarios, that is, based on observation of real cases and predictable situations. Never could we have imagined a scenario of complexity, extension and gravity similar to what we are facing in recent weeks.
This Insights, which introduces our first reflections on the maintenance of the Crisis Management Plans in Coronavirus times, will be followed by others dedicated to deepening some of the aspects relevant to the business and business continuity of companies.
What, of the emergency management plans prepared “in times of peace”, has not held up “in times of Coronavirus”?
There are several aspects that have not fully worked in the face of this crisis. Below, we comment on some of a more organizational nature, as observed in the field.
Governance of crisis units.
The governance of the crisis has often proved to be the weak link in the chain. The presence of “technical” crisis units, regulated by rigorous operating and composition procedures, immediately appeared inadequate to manage such a complex, fast, interconnected emergency capable of impacting all aspects of corporate life.
Specialist units have often been found:
(a) designed to manage crises, even significant ones, but limited and limited in duration and impacted processes;
(b) who have privileged external communication to Authorities and Stakeholders rather than the management of strategic, organizational, managerial and even psychological aspects;
(c) whose roles, responsibilities and powers have not allowed to tackle the critical node of the decision-making and command chain in the period of crisis. On the contrary, to be effectively addressed, a pandemic scenario requires lean and immediate governance, based on concentrated decision-making and operational levers, on essential and timely information flows, on a few clear and immediate interpretation rules.
Skills and managerial skills.
In some cases, the evaluation of the managerial skills of the subjects involved in crisis management also failed: there are no managers for all seasons. In extreme emergency situations such as the one in progress, the character attitude to the reaction, the propensity to work under stress with little information available, to the organizational skills and evaluation of the priorities compared to the classic technical evaluations, must be privileged.
Coordination in Groups.
In multinational companies, the global coordination of the crisis has shown criticalities similar to those observed at government level: late and uncoordinated reactions. This problem was registered above all in the groups with headquarters based in countries impacted only later by the Coronavirus emergency: in these cases, the lack of awareness of the real problem at Corporate level has poured the decision and management burden on local Management, not always prepared and equipped to face such a tzunami .
Why have emergency measures thought before the pandemic proved inadequate?
In our opinion, the main reason is due to the methodological approach followed in “normal” times in the construction of the Crisis Management Plans.
As suggested by literature and best practices in the matter of emergency management, most of the Plans tend to consider foreseeable scenarios usually connected to unavailability of processes, offices, suppliers and ICT systems critical for business continuity. The extreme scenario of the pandemic has never been explored as an emergency situation in its own right, in all its facets, interconnections and complexities; at most, it was traced back to the more traditional scenarios of “unavailability of essential personnel” (in the case of people directly affected by the pandemic) and “unavailability of the offices” (in the event of workers being unable to reach the workplace). The consequence is that the effects and response strategies have been analyzed and defined only on a local basis,
In essence, as the WHO has clarified in recent days, the plans currently prepared by companies are at best able to deal with epidemic situations localized in space and limited in time (reaching a few weeks at most), certainly not pandemic as extensive as the current one.
What external factors have contributed to making the Crisis Management Plans developed before Coronavirus ineffective?
A few weeks after the start of the emergency, we observe some external dynamics that were certainly difficult to predict, but which put a strain on companies’ response capabilities.
Globality of the phenomenon.
Coronavirus is the first truly global pandemic in modern times: no geography has remained immune to infection. The strong interconnections between markets and supply chains have done the rest: they range from business sectors that have immediately recorded a drastic drop in turnover (such as air transport, tourism, sport, the organization of events, retail stores, infrastructures), to those that have had to face huge peaks in demand with consequent operational difficulties in the production, supply and distribution (such as the production of medical equipment, large-scale distribution, telephone companies and service providers of connectivity), to those, finally, who will see the effects of the crisis a little further on in time.
Reactions by governments and local, national and supranational authorities.
Each sovereign body reacted with different and uncoordinated methods and times, producing effects that are difficult to predict and control, in particular on the movement of goods and people at local, national and international level. The legislative uncertainty that has ensued has made (and still is) making it difficult to identify cross-country remediation actions , creating tensions, in particular, in international companies and groups.
Lack of devices for people’s health and safety.
The difficulty in finding masks, disposable gloves and other devices suitable to contain the spread of the virus has fueled the risk of operational discontinuity, in particular for those activities that cannot be carried out in remote working or that cannot guarantee the safety standards imposed in the Coronavirus period (like the ” droplet “).
Reactions of people at work and in private life.
A sense of fear, panic and anxiety is spreading everywhere in the population, which feeds over-reaction situations . For example, many workers no longer feel protected in the workplace and are clamoring for termination of non-essential work. In the same way, daily life habits are changed, displacements are significantly reduced, volumes and types of consumption change (eg fuel consumption, public transport, meals in bars and restaurants are reduced, etc. in favor of others consumption, such as private utilities and home deliveries). All with inevitable impact on national GDP and the global economy.
Availability of essential staff.
Even the staff considered “essential” from a business continuity point of view is represented by men and women who, before being workers, are parents or children with family members to look after, as well as citizens with essential needs to be satisfied, who can become priority over to work needs. This aspect has certainly influenced the feasibility of some intervention options envisaged in the Crisis Management Plans.
Uncertainties about the duration of the pandemic and its effects.
Lastly, nobody knows exactly how long this situation will last, how many and what resources will be needed to face the emergency and return to normal. This uncertainty makes it even more difficult to identify ex ante ante crisis management options, and to assess their effectiveness and feasibility.
How to respond, therefore, to the new emergency from Coronavirus? What are, according to Protiviti, the critical success factors of a pandemic crisis management plan?
- MAKE SURE YOU HAVE THE MOST COMPLETE AND UP-TO-DATE POSSIBLE MAPPING OF PANDEMIC RISKS,
which includes both those with direct impacts on the business (such as framework evolutionsregulations, production blocks, delays or extra-costs related to logistics, slowdowns in receiving orders from customers, etc.), both those with indirect impacts deriving from organizational interventions or other measures adopted to contain the spread of the virus (such as delays in the production of data and critical information for making decisions due to an overload of work of the functions in charge, worsening of the business climate, worsening of the performance levels of some organizational units under stress due to the crisis). Involve all businesses, all geographic areas and all processes in the analysis. Do not focus only on the supply chain, on production sites or on information systems, as happens in traditional Business Continuity and Disaster Recovery Plans, but consider all aspects of corporate life, from strategic to commercial, from financial to legal and contractual, from HR to those related to relations with all stakeholders in the company, etc. More than ever, an integrated and multidisciplinary approach is needed to face this challenge.
- ACKNOWLEDGE THAT KNOWING HOW TO REACT IN THESE SITUATIONS IS MORE IMPORTANT THAN KNOWING HOW TO FORESEE.
Don’t waste too much time elaborating more or less sophisticated forecasting models, which could be denied already after a few hours from their elaboration. When the scenarios are so fast, interconnected, uncertain in duration and extent, and highly dependent on variables never observed before, we recommend diverting resources and efforts towards the development of suitable tools to promptly intercept risk situations for the continuity of the business. In fact, the important thing is to implement a set of indicators that allow you to keep under control the most critical areas for business continuity (such as the absenteeism rate of essential staff, the availability of remote working tools, the availability of personal protective equipment, stock levels of raw materials, packaging, finished products, shipping times for inbound and outbound , the level of liquidity, contracts to be renegotiated, etc.), in order to activate quickly the necessary decisional escalations in relation to the risk levels detected.
- GET READY TO RESPOND TO THE CONTAGIOUS RISKS THROUGH TIMELY ACTIONS WHICH, IN THE ORDER, MUST INCLUDE:
(i) prompt intervention actions , to resolve the effects deriving from an infection, even alleged;
(ii) mitigation actions , to contain the spread of the virus; finally, on the basis of what has been observed and learned,
(iii) prevention actions, aimed at avoiding contagion situations and to be modulated from time to time in relation to the specific risk situations encountered. The intervention plans must be detailed, easy to interpret and with clear pre-assigned responsibilities. Also be prepared to decide in conditions of scarcity of information, but always respecting the legislative constraints that could condition the intervention options. For aspects related to the Supply Chain and Health and Safety in the workplace, we will provide further food for thought in dedicated Insights.
- EVALUATE THAT THE GOVERNANCE FOR THE SPECIFIC MANAGEMENT OF THIS EMERGENCY IS DISCUSSED,
continuously monitoring the level of effectiveness of the structure and evaluating the necessary adjustments. Prefer the presence of lean crisis teams, able to adequately cover the various geographical levels and business lines, which are equipped with suitable tools to quickly intercept risk situations and who have the levers to intervene with the rapidity that the situation requires . Give preference to the attitude to reaction and to the ability to manage immediately under stress, compared to technical skills. Given lean but effective guidelines and guidelines, avoid too complex procedures that slow down the agility of action, at this moment more necessary than ever.
- IN REMOTE WORKING OVERLOAD PERIODS, DO NOT LOWER THE DATA SECURITY GUARD.
The priority is certainly to put as many collaborators as possible into working conditions. But the need to adopt remote working methods in a very short time must not lead to derogation from IT security rules: the risk of undergoing cyber attacks and of losing confidential data is always at the door and, indeed, increases in periods of confusion and instability and of greater use of technology. Just think of the significant increase in reports, in recent weeks, of websites and e-mail campaigns which, claiming news and information related to the Coronavirus, actually spread malicious codes. Therefore, keep the security guard high and strengthen the monitoring and detection of illegal conduct.
- BALANCE OPERATIONAL NEEDS WITH COMPLIANCE BONDS.
During a pandemic period, companies may need to acquire and process sensitive personal data necessary both to evaluate the effectiveness of measures to contain contagion in the workplace and to monitor productivity and safety of those who practice remote working . As is known, the data privacy regulations place a series of constraints on the processing of personal data, designed by lawmakers to regulate situations valid in “peacetime”. In a pandemic scenario, where the priority is to preserve collective health and – when possible – work, these regulations may appear partially inappropriate. While waiting for regulators to clarify the contradictory aspects of Privacy in Coronavirus times, companies will have to find the righttrade-off between the need to protect its collaborators and its business and exposure to risks of non-compliance with the aforementioned legislation.
- REMEMBER THAT, EVEN IN AN EMERGENCY PERIOD, THE INTERNAL CONTROL AND RISK MANAGEMENT FUNCTIONS
they can make a significant contribution to strengthening the crisis control chain. With this in mind, Internal Audit can, for example, put itself at the service of the organization, converting scheduled activities with specific checks on the timeliness of the decision-making chain and the effectiveness of the defined response actions, giving feedback on the adequacy of the crisis management systems and providing Management with useful ideas for any reorientations.
- FINALLY, KEEP THE ORGANIZATION ALIVE AND MAINTAIN A POSITIVE COMPANY CLIMATE.
Businesses are made up of people, and people need to continue to feel part of the organization, even when forced to go home. Communications are essential in times of crisis; they must convey empathy to employees, they must inform about what is happening in the company, they must be forward-looking, giving everyone an idea of what to expect. Offering something different to focus on with the constant negativity of the virus can be invaluable in these difficult times and can help maintain the morale of employees and collaborators. Given the relevance of the impact of the crisis on people and work, we will share our further reflections in a dedicated Insight.
To conclude.
The crisis caused by COVID-19 presents itself as the first real global test of resilience of the business system. The “triage” needed to detect risks, prioritize and distribute tasks will be a necessary art for most organizations in the coming weeks.
My hope, and the hope of SAIL4.IT Team, is that this hard experience will help the overall system to strengthen its survival capacity and to think of new ways of doing business.
The good news is that we will make it with the help of AI!
