concern over Avian flu and the threat of a global influenza pandemic
make planning for such eventualities a high priority. Jeremy Haworth,
MBCI, outlines the lessons he learned during the 2003 SARS crisis.
The 2003 Severe Acute Respiratory Syndrome (SARS) epidemic
and its myriad effects upon businesses across all industry sectors
showed that traditional planning assumptions used by many business
continuity professionals need to be reviewed. It is wise to consider
more carefully how to respond when the impacts of an event are directly
associated with the health of your workforce, the wider community
in which you live, and the effects which long-lasting mitigating
response measures will have upon daily working efficiencies. When
it is people who are the catalyst for initiating contingency activities,
practical, open and flexible measures need to be implemented at
the earliest opportunity.
Few organisations will have seriously considered the impact of
such a prolonged insidious disease and planned or rehearsed accordingly.
In fact it is true to say that even those in the healthcare sector
were hard-pressed to react effectively with containment procedures
for this unknown quantity. Since SARS the transport (particularly
aviation), tourism, logistics, entertainment and catering sectors,
to name but a few, will no doubt have reviewed their contingency
arrangements in this regard. Where the banking industry was not
so obviously affected as these sectors, serious measures were nonetheless
required in order to adapt, and it is from this side of the house
that I speak to share some thoughts on practical measures for future
The nature of SARS
Not being any form of expert I will not attempt to explain the medical
effects and modes of transmission of SARS, these being subject to
ongoing debate in circles way above my level of scientific understanding.
It is sufficient to re-iterate, if this were necessary, that it
was/is a dangerously virulent disease with wide-ranging effects
upon daily routines, both personal and business. For those not caught
in the middle of the outbreak it is hard to explain the extent of
the dark, depressing effect this had on individuals and economies.
Discouraging disease statistics on daily news bulletins, the inability
to see faces through masks (which are uncomfortably hot), an accidental
uncovered sneeze earning instant pariah status, parents understandably
fearful for the health of their children, hotels at less than 10
percent occupancy, restaurants going out of business, staff lay-offs,
unpaid leave and pay-cuts in many industries. In short, an unpleasant
From a business perspective all of this required strong, visible
measures to be taken to protect not only those to whom you have
a duty of care (staff, customers, visitors, vendors, suppliers etc.)
but also the interests of key stakeholders in your organisation
(shareholders, institutional investors etc.).
The challenges of SARS
Outlined below are just some of the key issues that major organisations
had to address in order to effectively exert control over the SARS
crisis. These are by no means exhaustive but are worthy of further
consideration when reviewing likely responses in the event of a
further outbreak of any major epidemic.
Anticipation and trigger points
A bit like setting a ‘stop loss’ order on shareholdings,
you should understand your risk appetite and the time at which you
should activate contingency management functions to take steps to
contain the incident. Of course it is not quite so easy to identify
trigger points in the case of unknown diseases but it is important
that all members of recovery functions or committees understand
that their role as guardians of the overall recovery process is
not just restricted to being reactive but is also anticipatory.
It costs little if anything to meet to consider evolving events,
and for the solicitation of external experts to assist in the decision-making
process. Many major businesses were slow off the mark in this regard
and may consider requesting medical advisors/authorities to notify
them of future disease threats as a matter of course; in many cases
this may involve your human resources departments developing closer
ties with company doctors and health authorities.
Knowledge, monitoring and adapting business continuity
It was imperative from the outset to learn more about SARS, its
virulence, physical effects, modes of transmission and appropriate
mitigating measures. This is where early consultation with experts
was critical, especially in light of the evolving views held by
the medical community, and also because views differed from country
to country. In the Asia-Pacific region this was particularly prevalent.
It was also necessary to understand measures taken by governments
to be enforced by law (e.g. quarantine measures), World Health Organization
(WHO) directives and advice and how these might affect your business.
All of these factors need to be accounted for, legal guidelines
set by governments met, and ultimately assimilated into practical
response measures to manage your business.
Guidance should not just be restricted to that from the medical
profession, and should also be sought for example from facilities
management professionals (how does the ventilation system in our
building work? Are our filtration systems adequate?), legal professionals
(Duty of care? What categories of work can acceptably be performed
from home?), public relations professionals (what is the best way
to communicate key issues? Who should we be communicating with?).
Mechanisms should be developed, and parties identified, to monitor
all of these issues centrally and regional head offices also need
to be able to efficiently share guidelines within their areas of
responsibility. This is effectively done through adapting your normal
communication and response structures for major incidents. It assumes
however that the structure is regularly practised in its responsibilities.
Adaptation of well-understood decision-making structures, rather
than re-inventing the wheel with ad-hoc committees at the time,
minimises reaction time and confusion and allows the business to
more effectively focus on its rapidly changing needs and those of
its customers. Showing resourceful and dedicated management of unpredictability
in this manner, allowing you to get on with the business of running
a bank, indicates one of the great values of having a practised
business continuity function in place. Structure, and flexibility
within that structure, is everything.
It is for this reason that HSBC’s senior management team
responsible for managing these eventualities in Hong Kong regularly
uses scenario-based exercises designed to test the crisis management
and business continuity functions. This team, crucially, consists
of experienced banking professionals, and professionals from other
disciplines, all of whom provide a wide variety of support services
across the bank. Many organisations will have similar committees
but the key for HSBC is that these representatives are experienced
enough to be able to think creatively and practically against a
backdrop of an intimate understanding of what is important to an
international bank with a local focus. The team is also senior enough
to be empowered to act as appropriate without overbearing approvals
processes. This experience, creative thought and freedom to act
allowed for the flexibility that responding to SARS called for.
Having developed as detailed an understanding as possible, and with
a monitoring mechanism in place, those responsible for managing
an organisation’s response must develop fair and practical
policies for a wide range of issues and, crucially, communicate
these to staff and other parties openly. The correct response, without
doubt, is to be as transparent as possible and to give sufficient
credence to the professionalism of your staff to understand why
these policies are important to the business.
This approach elicits a very positive response from staff and is
instrumental in developing a ‘can do’ attitude. Openness
is an act of leadership and confidence, not just management, the
two ‘disciplines’ often being confused. Those organisations
that decided to prevaricate and obfuscate in their communication
invariably found that confusion and fear was the result. The key
concern of some of these organisations was that they might be either
intruding upon privacy issues or divulging too much about their
lack of preparedness. Buy-in from staff, through being honest and
open, can overcome both of these issues.
The means of communication to staff will vary amongst organisations
but with most will be done via the staff intranet. Working closely
with decision-making bodies, those responsible for the management
of the intranet are easily able to provide updates to the widest
readership. A question that begs asking of this sort of arrangement
is whether or not the resiliency of your intranet has been reviewed.
It is a crucial communication tool locally and regionally and should
therefore be protected as a critical system.
Establishing appropriate policies
Some policies that may need to be developed for future responses
are likely to include those for:
* Leave - special leave to look after children not at school, for
pregnant employees, paid/unpaid, do you encourage staff to take
normal leave where operationally feasible?
* Travel - reduce levels of business travel and increase video-conferencing
/ tele-conferencing; identify restricted countries and understand/communicate
local measures to adhere to; precautionary quarantine measures required
to/from countries; review how travel is monitored including that
for personal travel and improve tracking if necessary.
* Off-site activities - review sales and promotional activities,
* Training and meetings - for prolonged events some training may
be essential and this needs to be identified and managed, make maximum
use of tele-conferencing inter-departmentally.
* The reporting of suspected and confirmed cases of the disease
- identify the focal point of contact and what information is required;
consider data privacy issues; identify guidelines for arranging
advised medical procedures (these may change over time as more is
learned about the disease); ongoing support to those affected and
their families; re-integration into the workplace once recovered.
* Dress codes – only if the nature of a future disease calls
for frequent washing of clothes especially in uniformed organisations.
* The management of ‘split-site’ moves - identify who
should authorise the split of high priority or high risk departments
between two locations and how this will be administered, do you
perform split-site moves for critical headcounts only, or more?
Do you really want to use canteen areas and training rooms set aside
as backup locations for ‘normal’ disasters? Do you retain
monthly reports of vacant space?
* The use of remote means of working - who can work from home effectively
and who authorises this? How will the sudden increase in remote
access to computer networks be managed? Do you need to prepare CD-Roms
with instructions for self-installation at home?
* The ordering, authorisation and distribution of health and safety
consumables - who is the focal point for ordering and do they have
access to a wide variety of sources worldwide when demand is high?
How are stocks replenished? Who pays for them? Is the priority for
customer facing staff?
* Cleaning and facilities management - facilities management to
increase levels of cleaning in washrooms/lifts/work areas/banking
halls, when is special cleaning required for work areas of suspected
or confirmed cases of the disease and what does this cleaning involve?
Can ventilation within the building be increased while maintaining
good levels of security?
* The use of a single cost centre - is everything placed through
one cost centre for re-charging at a later date? Can the cost centre
be quickly activated and funded?
* Data centre management – do you split more staff between
main data centres and backup data centres? Are hygiene procedures
rigorously enforced in these critical areas?
* Managing alternative banking channels – the desire to avoid
public banking halls may lead to an increase in the use of internet
banking which may in turn lead to the need to review the resilience
of this service.
These policies are only the tip of the iceberg when it comes to
managing an incident such as SARS. There are significantly more
day-to-day issues that need to be covered including the morale of
your staff, more stressful working environments, increased regulatory
liaison, the role of your organisation in your community’s
response to the disease, counselling where necessary and so on.
Lessons learned from SARS should be incorporated into business
continuity planning documentation, procedures and training. With
more and more emphasis nowadays being placed upon scenario-based
exercises it would certainly be a worthwhile option to consider
and, if done properly, is certain to challenge those presented with
the task of maintaining business as usual.
Being prepared for the unexpected is one of the key tasks facing
business continuity professionals although it is fair to say that
SARS was significantly more unexpected than many had even conceived.
Faced with such a prolonged disruptive event, with implications
worldwide, it is essential therefore to have a suitably experienced
and dedicated crisis management and business continuity function.
The structure within which this function operates must be understood
throughout the length and breadth of your organisation and must,
crucially, be frequently exercised in a scenario-based manner that
challenges thought processes and is flexible enough to adapt. So
long as the overall structure of response is in place many other
factors fall into place as you are able to exert control over the
Information gathering from a wide variety of sources and monitoring
of the same is critical throughout any response to a virulent disease
affecting your business. On the basis of this, fair policies can
be developed (and amended over time) to protect your staff, customers
and stakeholders while mitigating the risk of there being any loss
of business and reputation. Understanding community-wide governmental
policies is also important as this allows you to shape the response
of your business to meet the needs of your customers (e.g. how do
you satisfy the needs of your customers in quarantined areas?).
The nature of many of these policies will depend upon what sort
of organisation you belong to, and the advice received at the time,
but it is important for everyone to know what these are in as open
a manner as possible.
The mantra of communication, communication, communication is therefore
crucial to allow you to effectively and honestly convey your messages
and requirements to staff, customers and key external parties. The
role of the intranet, e-mail and web-based business channels as
critical tools in this regard should not be underestimated and their
resilience should be high on the agenda in the early stages of any
On the basis of lessons learned from the SARS epidemic, serious
consideration should now be given to incorporating specific guidelines
for the management of communicable diseases. This may even come
in the form of a special contingency plan which is generic enough
to adapt to a future outbreak of a different but equally virulent
disease. Communicable diseases of this nature are fortunately low
frequency/high impact events but with a little bit of application
you can ensure that your organisation is better prepared than many
were in 2003.
Jeremy Haworth MBCI is the regional business continuity planning
manager, Asia-Pacific for HSBC. He is also the Hong Kong representative
for the Business Continuity Institute and can be contacted at [email protected]
PRINT FRIENDLY VERSION
4th Jan 2005 •Region: World •Type:
Article •Topic: BC
this article or make a comment - click