Monthly newsletter Weekly news roundup Breaking news notification    

Communicable diseases: business continuity issues

Get free weekly news by e-mailContinued concern over Avian flu and the threat of a global influenza pandemic make planning for such eventualities a high priority. Jeremy Haworth, MBCI, outlines the lessons he learned during the 2003 SARS crisis.

The 2003 Severe Acute Respiratory Syndrome (SARS) epidemic and its myriad effects upon businesses across all industry sectors showed that traditional planning assumptions used by many business continuity professionals need to be reviewed. It is wise to consider more carefully how to respond when the impacts of an event are directly associated with the health of your workforce, the wider community in which you live, and the effects which long-lasting mitigating response measures will have upon daily working efficiencies. When it is people who are the catalyst for initiating contingency activities, practical, open and flexible measures need to be implemented at the earliest opportunity.

Few organisations will have seriously considered the impact of such a prolonged insidious disease and planned or rehearsed accordingly. In fact it is true to say that even those in the healthcare sector were hard-pressed to react effectively with containment procedures for this unknown quantity. Since SARS the transport (particularly aviation), tourism, logistics, entertainment and catering sectors, to name but a few, will no doubt have reviewed their contingency arrangements in this regard. Where the banking industry was not so obviously affected as these sectors, serious measures were nonetheless required in order to adapt, and it is from this side of the house that I speak to share some thoughts on practical measures for future consideration.

The nature of SARS
Not being any form of expert I will not attempt to explain the medical effects and modes of transmission of SARS, these being subject to ongoing debate in circles way above my level of scientific understanding. It is sufficient to re-iterate, if this were necessary, that it was/is a dangerously virulent disease with wide-ranging effects upon daily routines, both personal and business. For those not caught in the middle of the outbreak it is hard to explain the extent of the dark, depressing effect this had on individuals and economies. Discouraging disease statistics on daily news bulletins, the inability to see faces through masks (which are uncomfortably hot), an accidental uncovered sneeze earning instant pariah status, parents understandably fearful for the health of their children, hotels at less than 10 percent occupancy, restaurants going out of business, staff lay-offs, unpaid leave and pay-cuts in many industries. In short, an unpleasant melting pot.

From a business perspective all of this required strong, visible measures to be taken to protect not only those to whom you have a duty of care (staff, customers, visitors, vendors, suppliers etc.) but also the interests of key stakeholders in your organisation (shareholders, institutional investors etc.).

The challenges of SARS
Outlined below are just some of the key issues that major organisations had to address in order to effectively exert control over the SARS crisis. These are by no means exhaustive but are worthy of further consideration when reviewing likely responses in the event of a further outbreak of any major epidemic.

Anticipation and trigger points
A bit like setting a ‘stop loss’ order on shareholdings, you should understand your risk appetite and the time at which you should activate contingency management functions to take steps to contain the incident. Of course it is not quite so easy to identify trigger points in the case of unknown diseases but it is important that all members of recovery functions or committees understand that their role as guardians of the overall recovery process is not just restricted to being reactive but is also anticipatory.

It costs little if anything to meet to consider evolving events, and for the solicitation of external experts to assist in the decision-making process. Many major businesses were slow off the mark in this regard and may consider requesting medical advisors/authorities to notify them of future disease threats as a matter of course; in many cases this may involve your human resources departments developing closer ties with company doctors and health authorities.

Knowledge, monitoring and adapting business continuity response structures
It was imperative from the outset to learn more about SARS, its virulence, physical effects, modes of transmission and appropriate mitigating measures. This is where early consultation with experts was critical, especially in light of the evolving views held by the medical community, and also because views differed from country to country. In the Asia-Pacific region this was particularly prevalent. It was also necessary to understand measures taken by governments to be enforced by law (e.g. quarantine measures), World Health Organization (WHO) directives and advice and how these might affect your business. All of these factors need to be accounted for, legal guidelines set by governments met, and ultimately assimilated into practical response measures to manage your business.

Guidance should not just be restricted to that from the medical profession, and should also be sought for example from facilities management professionals (how does the ventilation system in our building work? Are our filtration systems adequate?), legal professionals (Duty of care? What categories of work can acceptably be performed from home?), public relations professionals (what is the best way to communicate key issues? Who should we be communicating with?).

Mechanisms should be developed, and parties identified, to monitor all of these issues centrally and regional head offices also need to be able to efficiently share guidelines within their areas of responsibility. This is effectively done through adapting your normal communication and response structures for major incidents. It assumes however that the structure is regularly practised in its responsibilities. Adaptation of well-understood decision-making structures, rather than re-inventing the wheel with ad-hoc committees at the time, minimises reaction time and confusion and allows the business to more effectively focus on its rapidly changing needs and those of its customers. Showing resourceful and dedicated management of unpredictability in this manner, allowing you to get on with the business of running a bank, indicates one of the great values of having a practised business continuity function in place. Structure, and flexibility within that structure, is everything.

It is for this reason that HSBC’s senior management team responsible for managing these eventualities in Hong Kong regularly uses scenario-based exercises designed to test the crisis management and business continuity functions. This team, crucially, consists of experienced banking professionals, and professionals from other disciplines, all of whom provide a wide variety of support services across the bank. Many organisations will have similar committees but the key for HSBC is that these representatives are experienced enough to be able to think creatively and practically against a backdrop of an intimate understanding of what is important to an international bank with a local focus. The team is also senior enough to be empowered to act as appropriate without overbearing approvals processes. This experience, creative thought and freedom to act allowed for the flexibility that responding to SARS called for.

Open communication
Having developed as detailed an understanding as possible, and with a monitoring mechanism in place, those responsible for managing an organisation’s response must develop fair and practical policies for a wide range of issues and, crucially, communicate these to staff and other parties openly. The correct response, without doubt, is to be as transparent as possible and to give sufficient credence to the professionalism of your staff to understand why these policies are important to the business.

This approach elicits a very positive response from staff and is instrumental in developing a ‘can do’ attitude. Openness is an act of leadership and confidence, not just management, the two ‘disciplines’ often being confused. Those organisations that decided to prevaricate and obfuscate in their communication invariably found that confusion and fear was the result. The key concern of some of these organisations was that they might be either intruding upon privacy issues or divulging too much about their lack of preparedness. Buy-in from staff, through being honest and open, can overcome both of these issues.

The means of communication to staff will vary amongst organisations but with most will be done via the staff intranet. Working closely with decision-making bodies, those responsible for the management of the intranet are easily able to provide updates to the widest readership. A question that begs asking of this sort of arrangement is whether or not the resiliency of your intranet has been reviewed. It is a crucial communication tool locally and regionally and should therefore be protected as a critical system.

Establishing appropriate policies
Some policies that may need to be developed for future responses are likely to include those for:

* Leave - special leave to look after children not at school, for pregnant employees, paid/unpaid, do you encourage staff to take normal leave where operationally feasible?

* Travel - reduce levels of business travel and increase video-conferencing / tele-conferencing; identify restricted countries and understand/communicate local measures to adhere to; precautionary quarantine measures required to/from countries; review how travel is monitored including that for personal travel and improve tracking if necessary.

* Off-site activities - review sales and promotional activities, openings etc.

* Training and meetings - for prolonged events some training may be essential and this needs to be identified and managed, make maximum use of tele-conferencing inter-departmentally.

* The reporting of suspected and confirmed cases of the disease - identify the focal point of contact and what information is required; consider data privacy issues; identify guidelines for arranging advised medical procedures (these may change over time as more is learned about the disease); ongoing support to those affected and their families; re-integration into the workplace once recovered.

* Dress codes – only if the nature of a future disease calls for frequent washing of clothes especially in uniformed organisations.

* The management of ‘split-site’ moves - identify who should authorise the split of high priority or high risk departments between two locations and how this will be administered, do you perform split-site moves for critical headcounts only, or more? Do you really want to use canteen areas and training rooms set aside as backup locations for ‘normal’ disasters? Do you retain monthly reports of vacant space?

* The use of remote means of working - who can work from home effectively and who authorises this? How will the sudden increase in remote access to computer networks be managed? Do you need to prepare CD-Roms with instructions for self-installation at home?

* The ordering, authorisation and distribution of health and safety consumables - who is the focal point for ordering and do they have access to a wide variety of sources worldwide when demand is high? How are stocks replenished? Who pays for them? Is the priority for customer facing staff?

* Cleaning and facilities management - facilities management to increase levels of cleaning in washrooms/lifts/work areas/banking halls, when is special cleaning required for work areas of suspected or confirmed cases of the disease and what does this cleaning involve? Can ventilation within the building be increased while maintaining good levels of security?

* The use of a single cost centre - is everything placed through one cost centre for re-charging at a later date? Can the cost centre be quickly activated and funded?

* Data centre management – do you split more staff between main data centres and backup data centres? Are hygiene procedures rigorously enforced in these critical areas?

* Managing alternative banking channels – the desire to avoid public banking halls may lead to an increase in the use of internet banking which may in turn lead to the need to review the resilience of this service.

These policies are only the tip of the iceberg when it comes to managing an incident such as SARS. There are significantly more day-to-day issues that need to be covered including the morale of your staff, more stressful working environments, increased regulatory liaison, the role of your organisation in your community’s response to the disease, counselling where necessary and so on.

Lessons learned from SARS should be incorporated into business continuity planning documentation, procedures and training. With more and more emphasis nowadays being placed upon scenario-based exercises it would certainly be a worthwhile option to consider and, if done properly, is certain to challenge those presented with the task of maintaining business as usual.

Being prepared for the unexpected is one of the key tasks facing business continuity professionals although it is fair to say that SARS was significantly more unexpected than many had even conceived. Faced with such a prolonged disruptive event, with implications worldwide, it is essential therefore to have a suitably experienced and dedicated crisis management and business continuity function. The structure within which this function operates must be understood throughout the length and breadth of your organisation and must, crucially, be frequently exercised in a scenario-based manner that challenges thought processes and is flexible enough to adapt. So long as the overall structure of response is in place many other factors fall into place as you are able to exert control over the incident swiftly.

Information gathering from a wide variety of sources and monitoring of the same is critical throughout any response to a virulent disease affecting your business. On the basis of this, fair policies can be developed (and amended over time) to protect your staff, customers and stakeholders while mitigating the risk of there being any loss of business and reputation. Understanding community-wide governmental policies is also important as this allows you to shape the response of your business to meet the needs of your customers (e.g. how do you satisfy the needs of your customers in quarantined areas?). The nature of many of these policies will depend upon what sort of organisation you belong to, and the advice received at the time, but it is important for everyone to know what these are in as open a manner as possible.

The mantra of communication, communication, communication is therefore crucial to allow you to effectively and honestly convey your messages and requirements to staff, customers and key external parties. The role of the intranet, e-mail and web-based business channels as critical tools in this regard should not be underestimated and their resilience should be high on the agenda in the early stages of any response.

On the basis of lessons learned from the SARS epidemic, serious consideration should now be given to incorporating specific guidelines for the management of communicable diseases. This may even come in the form of a special contingency plan which is generic enough to adapt to a future outbreak of a different but equally virulent disease. Communicable diseases of this nature are fortunately low frequency/high impact events but with a little bit of application you can ensure that your organisation is better prepared than many were in 2003.

Jeremy Haworth MBCI is the regional business continuity planning manager, Asia-Pacific for HSBC. He is also the Hong Kong representative for the Business Continuity Institute and can be contacted at


Date: 4th Jan 2005 •Region: World •Type: Article •Topic: BC general
Rate this article or make a comment - click here

Copyright 2005 Portal Publishing LtdPrivacy policyContact usSite mapNavigation help