By Kim Lafevor
During the COVID 19 event, it seems we are all drinking from a fire hydrant with the volume of information and advice we are receiving from our organization’s internal and external stakeholders, as well as a variety of others, well-intended of course, as to how best to handle this national emergency and pandemic. Hurricanes Katrina, Andrew, and Rita, Virginia Tech Massacre, Y2K bug, Terrorism in London, Madrid, Middle East, and U.S. with the 9/11 attacks, Asian Tsunami, SARS, Earthquakes in Christchurch, Chile, Haiti, and Japan, H1N1, and now COVID 19, the common trend is that crises are inevitable and far reaching and affecting all types of organizations with broadly different missions, cultures, and organizational aims (Adkins, Thornton, & Blake, 2009). Based on our experiences and exposure to such events, both globally and domestically, we know that crises are inevitable, yet many organizations find themselves at minimum with a disaster response continuity plans (DRCP) or without tangible, well thought out and tested business continuity plans (BCP) to optimize the organization’s ability to deal with the risks. So, based upon any crisis event, such as the COVID 19 pandemic, how can organizations respond? How do we deploy existing disaster contingency response or business continuity plans, and in the absence of them, what are the options? And most importantly, in addition to concern for protecting organizational brand, financial health, and sustainability, how do we keep the ‘human’ embedded in our business continuity management (BCM) response strategies?
Framing an organizational response: What is the difference between crisis response approaches?
Every organization should have some form of a crisis response plan. While both are helpful in providing guidance to organizational actions, a BCP is a blueprint to avoid or mitigate risks, while a DCRP is designed to respond to disasters as they occur.
A DCRP is a prepared response to a disaster for which the organization has planned and includes six important components: 1) specific procedures to enact when a disaster occurs, 2) identification of primary and alternate team members and their specific duties, 3) notification procedures and alternate meeting site locations, 4) workaround processes to keep the function operational while impacted resources are being restored to business as usual, 5) contact list of all personnel and the functions they are qualified to perform, and 6) identification of all internal and external vendors and each vendor primary and alternate contacts. By comparison, a BCP expands beyond the aims of the DCRP and shares three primary, yet broad and comprehensive elements: 1) identification of major risks of business interruption, 2) development of a comprehensive plan to mitigate or reduce the impact of the identified risk, and 3) training employees and testing the plan to ensure that it is effective(Cerullo & Cerullo, 2004). Whether a DCRP or BCP, these facets in a crisis response is mission critical.
What if my organization does not have a business continuity plan for a crisis response?
The stark reality is that a significant number of organizations do not have a crisis response plan. Although they present the most effective response, BCPs have been adopted on a limited basis and approach varies based on type of industry. Organizations that do employ BCP tend to prepare for three primary types of events: 1) natural disasters (31%), 2) electronic disasters (41%), and 3) terrorism/warfare (34%). However, there remains a dearth in organizational preparedness of other events, such as pandemic/employee health (11%), manufacturing disaster (7%), transportation disaster (3%), public relations crisis (7%), corruption/scandal (6%), economic disaster/market collapse (7%), workplace violence (4%), industrial espionage (14%), and financial ruin/bankruptcy (9%) (Adkins, Thornton & Blake, 2009). The current state presents an opportunity for organizations to bridge crisis response plan gaps.
Employing a Business Continuity Management System (BCMS)
A Datapro study concluded that without robust planning as much as 43% of companies hit by severe crisis never reopen, and 29% fail within two years (Cerullo & Cerullo, 2004). Therefore, having a comprehensive business continuity management plan can best ensure organizational sustainability.
There are three key disciplines related to business continuity management: 1) emergency response, 2) IT disaster recovery, and 3) a business continuity plan. A sound continuity plan takes a holistic view of the business enterprise. It should be preventative, repressive, and corrective. Organizational leaders must keep in mind that a strong business continuity management system:
- ensures continuity of the organization with processes which are key to the core of the business are controlled for risks
- focuses on critical business processes
- addresses the full period of time of any crisis: before, during, and after a disaster
- employs a permanent and interactive management process (Jedynak, 2013)
Effective BCM planning begins with an analysis phase that includes conducting a business impact analysis and risk analysis, creating impact scenarios and then comparing the results against the aggregate crisis preparedness of the organization. Organizations should arm themselves amidst the panoply of risks in today’s global environment with a risk-resilient business continuity management system and enriched solid crisis response capabilities.
Organizational brand, financial health, sustainability, and keeping the ‘human’ embedded in response strategies?
Most BCPs are designed at operational effectiveness post-crisis, but do not generally assess and address people-related challenges (Malinen, Hatton, Naswall, & Kuntz, 2018). As organizational leaders, we have to remember that crises, such as the COVID 19 pandemic, are not just national events, but they also affect individuals and groups who experience them. When crisis occurs, it is a defining moment for an organization to showcase its brand, its business acumen, its financial health, its resiliency, but also reflective of its culture.
Communication is key as it presents an opportunity for organizational leaders to convey their commitment to duty of care during a crisis to employees, their families, contractors, and customers.
Key questions to answer:
- In the short-term, in the absence of a crisis response plan, which employees have the expertise to quickly assist in the development of an organizational response?
- Where there are DCRP or BCP’s in place, do employees know the crisis response plan?
- For long-term sustainability, have we audited our existing business continuity management system and made needed changes?
- Does the adopted crisis response plan clearly define stakeholder responsibilities? What considerations have been made to mitigate and control risks for both internal and external stakeholders? Does the plan balance the welfare of employees with business necessity?
- Are there robust communication mediums and processes in place to keep stakeholders updated throughout the crisis?
Answers to these questions can serve to better prepare organizations for crisis management. According to Samson (2013), “Preparedness is the first step in response, but response is the critical test of preparedness” (p. 57). In a crisis event, such as the present pandemic of COVID 19, organizational leaders need to convincingly articulate to employees, customers, regulators, and other stakeholders the impact on its operations and controls, as well as staunch assurances of how the organization is enabled to capably respond.
In Conclusion
Everything in our economy is interconnected: corporations, small businesses, the housing market, the stock market, unemployment rate, federal government, personal finances, and healthcare (Adkins, Thornton & Blake, 2009). Crises can and will happen that will affect them. As organizational leaders, we must also come to terms that while past losses can serve as helpful indicators, the greatest organizational risk exposure stems from events that management has not yet envisioned (Melton & Trahan, 2009). It is important to remember, a crisis becomes a defining moment that poses a unique opportunity to elevate organizational brand, draw upon business acumen, demonstrate financial health and organizational resiliency with a central focus on both sustaining future business operations, but also duty of care in assuring the well-being of its people.
