By Stephen McGrady
Principal
Last year if a customer sent you a Business Continuity Plan questionnaire asking what your plans were for responding to a pandemic, your response might have been, “Why are we even being asked about this? What difference does it make?” Your disaster planning was most likely focused on events that appeared to have a reasonable probability of taking place: earthquakes, fires, floods, key suppliers going out of business, labor strikes, etc.
This year, however, the outbreak of the coronavirus known as COVID-19 has changed all this. Between wide-spread quarantines and shut-downs in China, supply chain disruptions, trade show cancellations, stock market swoons and panicked calls from your elderly parents, it’s painfully obvious that you also need to have a plan for addressing pandemics.
As of this writing the outbreak of COVID-19 is far from contained. How might it impact your business?
A pandemic can impact both business continuity and disaster recovery
As I explained in my previous article, “Business Continuity Planning vs. Disaster Recovery Planning: What's the Difference?" Business Community Planning focuses on business operations while Disaster Recovery focuses on IT operations. Although some of the biggest risks of a pandemic are on your business’ operations, it can pose a risk to IT as well.
The first step in planning is to assess the risks
COVID-19 is not like the bubonic plague. Most people who are affected only get mildly ill. Good news—it’s not a death sentence. Bad news—those with mild or no symptoms are more likely to pass on the virus.
Still more bad news: From the business continuity point of view, the coronavirus outbreak can be horribly disruptive. Since the first step in planning is always to assess the risks (see “A 4-Step Approach to Business Continuity Planning”), let’s take a look at the most obvious potential impacts of a pandemic on your business:
- Your business facility is temporarily shut down by the government. While we’re not yet seeing this in the U.S., you only need to look at China, Korea and Japan to see that governments are acting to protect their citizenry.
Breaking news: Universities and school districts are starting to close, including schools in San Francisco and Elk Grove.
- Your suppliers cannot produce and ship goods. This can make it impossible for you to operate. Depending on your business and inventory requirements (e.g. supermarket), this could be a critical problem within days.
- Your cost of goods skyrockets. Worldwide shortages can cause huge price increases.
- Your employees cannot come to work. Even if they are not ill, they might be under mandatory home quarantine, affected by disruptions to public transportation or staying at home with their school-aged children if local schools shut down.
- You cannot produce or ship goods. Because of any or all of the above.
- Your IT systems stop functioning. If critical members of your IT team are hospitalized with the virus, who will keep things running?
- You cannot meet with your customers and prospects. Many major companies are already taking action to limit who is allowed into their facilities, and trade shows are being cancelled or postponed at a rapid clip.
- Much of your business cannot be operated remotely. If, for whatever reason, your employees cannot come to work, some may be able to get their work done from home. But there are many things that cannot be done remotely, such as running your manufacturing plant, receiving or sending out goods at your shipping docks, or operating your bricks and mortar retail store.
Of course, it’s not enough to simply make a list of risks. Part of the risk assessment process is to complete a business impact assessment to quantify each risk. How big a risk is the particular item? What exactly is at risk? How might this affect your business’ profitability?
For example…
- If your industry’s major trade show gets cancelled, how will this affect your sales?
- If it is deemed safest to ask employees to work from home, how much of their jobs can be done remotely and what would be the costs of supporting this?
- If supply chain problems idle your factory, when will you run out of goods?
- If you cannot sell product, what will it cost to borrow funds when your cash flow dries up?
- If widespread quarantines shut down your main claims processing facility, what will it cost you (lost sales, lost contacts, fines, etc.) if you don’t have a backup facility in an unaffected area that’s ready and able to get the work done?
The next step is to develop plans to mitigate the risks
Your goal should be to develop a specific set of recovery plans for every scenario that is of significant concern for your business. Come up with a strategy. Test it in a simulation. Provide training and documentation. And, if it makes sense to do so, run an actual test of the plan as well.
What might some of these strategies look like? You can…
- Create an emergency notification system to let employees know where and when to report to work.
- Develop a strong telework capability so that employees who can theoretically work remotely are actually able to do so. Be sure that your IT systems are up to the task.
- Line up alternate suppliers and distribution so that you can continue to manufacture, sell and move goods.
- Create shadow operations so that if one facility is shut down, the other can quickly ramp up to get the work done.
- Hire subcontractors and rely on their business continuity and disaster recovery abilities to get you through.
- Run the numbers to see if you can simply plan to do nothing and ride it out for a month while your business is temporarily shut down.
Conclusion
What might the coronavirus outbreak mean for your operations? From a business point of view the risks are primarily about the following three issues:
- Can your workforce work?
- Can you receive the resources you need from your suppliers?
- Can you deliver your products to your customers so that you can make money and stay in business?
All in all, a pandemic is a scenario you probably never imagined you’d have to worry about—but it’s here, and it’s wreaking havoc for businesses around the globe.
Need help reassessing and revamping your Business Continuity Plan and Disaster Recovery Plan to address a pandemic? Give us a call. This is one of our areas of expertise.
About Stephen McGrady
Stephen McGrady has served in technology vision and leadership roles, including Vice President of Services, Chief Information Officer (CIO), and General Manager, for over 20 years. Since 2006, he has focused on executive management consulting that enables business clients to improve performance through intelligent use of information technologies.
About CIO Professional Services
Based in the San Francisco Bay area, CIO Professional Services LLC is a top-rated Information Technology (IT) consulting firm focused on integrating Business and Information Technology. Our consultants are all hands-on executives who are veteran CIOs and Partners of Big 4 consulting firms. Companies come to us seeking assistance with their information technology strategy as well as for interim or fractional CIO / CTOs, and negotiation and program management/project rescue assistance.