Has pandemic complacency come home to roost?
Back in 1948 a toothpaste commercial went "You'll wonder where the yellow went when you brush your teeth with Pepsodent." Today, we have to wonder not where the yellow went but where the pandemic scare went. Probably, given the worldwide financial crisis and a new US administration, it's just as well that the pandemic panic is out of sight and out of mind. But the pandemic threat fell off the front pages a few months ago before such things hit the headlines. I am a member of a crisis management team for a very large organization. We recently had a meeting and, while munching on goodies before the start of the session - if you feed them, they will come, something every business continuity practitioner needs to remember - I casually asked "What happened with the Pandemic Push that had us all rushing around gathering information like madmen in search of sanity?" Well, I was told, we got a new CFO and New CFO decided the threat of a Yet, the H5N1 threat lingers. Combine migratory fowl, people who literally live with poultry, and modern travel patterns, and the threat remains very real. As business continuity practitioners, we know that are two components to the risk equations - probability and impact. The reason the H5N1 threat made headlines for so long was not so much the probability but the impact. Impact on organizations. Impact on the economy. (Can anyone imagine if H5N1 and the financial fiasco hit at the same time?) A long time ago I wrote that there were greater pandemic threats than H5N1. I believed it then and I continue to believe it. Small pox has come back like the Phoenix rising from the ashes. Tuberculosis, including a particularly resistant strain, is a very real As this is keyed, the ‘regular’ flu season is at hand and signs are going up throughout the corporate world urging personnel to get inoculations. I'm not denigrating the H5N1 threat. It, like Y2K, got people thinking about ‘continuity’ in one form or another - from "who can keep the computers working" to true enterprise risk management. The problem, for business continuity practitioners, is that like Y2K, the Pandemic Panic was a non-event. Y2K could have been an event if we had done nothing. But we scurried around and checked everything that had a microprocessor - from main frame computers to coffee pot timers. The pandemic threat had us developing contact lists - and duplicating efforts all over the place - and at least thinking about what we would do if it arrived. Who would assure the computers were working, and - occasionally - oh yes, who will be available to use the data entered into and pulled from computer programs and applications. But, the pandemic threat also is similar to hurricane season. As a storm bears down on us, we rush around at the last minute filling up jugs with water, boarding up windows, and checking batteries. If the storm bypasses us, or even if it brushes us and we escape the full brunt of an Andrew or Katrina, we are asked "Why did you try to scare us; nothing happened." The next time a storm heads our way, we think back to the one whose damage we escaped. Interestingly, the pandemic scenario has another similarity to a hurricane: you can see it coming; it doesn't just ‘happen’ like a HazMat spill or earthquake with little or no warning. If the pundits were - are - correct, a pandemic event will cross the longitudes in a wavelike manner - first New York, then Chicago, then Denver, and finally San Francisco. Actually, it's more likely to travel in the other direction since there seems a greater probability that H5N1 might morph into a human-to-human transmissible disease there than, say, Jerusalem or Amsterdam. As a business continuity practitioner, I am less disturbed about the fact that the pandemic has fallen off the map than the fact that all the effort that went into the Pandemic Panic will either sit on the shelf gathering dust or be confined to File 13. Understand, I AM disturbed that the pandemic effort apparently was unappreciated and that the ‘lessons learned’ at management level were lessons quickly forgotten. In truth I won't fault the new CFO for cancelling a continuation of a major pandemic effort. In the overall scheme of things - as they stand today - the probability of H5N1 Avian Influenza mutating into a human-transmittable disease is minimal; very low and, although its impact would be great, it just isn't worth throwing money at the threat. However, I do fault the CFO if all the effort that went into ‘Pandemic Prep’ goes to waste: Because of the headlines, extensive contact lists were developed. Because of the headlines, the organization dimly recognized the need for primary and alternate personnel in all critical positions; indeed, it re-examined what constituted ‘critical positions.’ Because of the headlines, we suddenly became focused on what functions could be assumed by other divisions within the organization, and remote access gained more attention. What a waste if all that effort and information quietly becomes out-of-date and irrelevant. How much more of a waste if business continuity planning in general is side-lined alongside ‘pandemic planning’ as yesterday's news. Author: John Glenn, MBCI, has been helping organizations of all types avoid or mitigate risks to their operations since 1994. http://JohnGlennMBCI.com/ Reader comment I totally agree with John Glenn. Pandemic flu became the hot topic and the hysteria (partially aided and abetted by the government and authorities) led to a mass of activity in businesses all across the country (if not the world). We were encouraged to have pandemic flu plans and procedures and store Tamiflu etc. Pressure was brought by clients, government, to have a pandemic flu plan. If nothing happens in the next few years, and I believe it won't, the effort this incurred totally undermines the fundamental problem we all have in business continuity... "It'll never happen". We will have the pandemic flu thrown back in our faces and be ignored as "the boy who cried wolf". What I tried to get over to people was that the important issue was the impact. The impact in this case for the vast majority of businesses was a significant lack of people in your business and some of your services would get disrupted from suppliers as they would no longer be able to supply them. This was all basic business continuity: one of the key parts of both the Good Practice Guide and BS25999 was looking at people and suppliers. By all means prepare for a pandemic flu but use it as a scenario. Concentrate on the impact... Rob Osborn, MBCI. Business Continuity & Information Security Manager
John is absolutely on target.
I can only echo the sentiments of John Glenn. I asked a similar question some time ago with regard to Y2K, whatever happened as a result of the monumental amount of planning, preparation, testing and exercising that was carried out prior to what the emergency services refer to as a “false alarm good intent”. I do see similarities with H5N1 preparations. All probability / risk equations unfortunately omit a third factor that should be considered when calculating the level of effort and commitment that will be allocated to the preservation a particular activity. Murphy’s law, if it can go wrong, it will go wrong, and when it does, there are generic issues that occur irrespective of the cause. There are any number of events that will cause some if not most of the effects envisaged as a result of a pandemic outbreak, loss or significant reduction of workforce availability, supply chain failure, systems failures, I could go on. The key point is, that these aspects should be planned for and exercised as a matter of good BC practice. The ability to effectively manage these events should be a minimum requirement of any organisation who believes their BC arrangements are adequate. Risk managers may be able to show statistical evidence as to why they have re-focused their efforts on other areas of risk, and left the pandemic threat in the bottom drawer, but that is no excuse for not planning for and exercising the same effects created by another cause. I have recently taken our organization through the process of achieving BS25999-2 accreditation, and whilst I agree that a H5N1 outbreak may not be in Monday morning’s calendar, something else might well be!! Bill Simpson, Emergency Preparedness Consultant, Sembcorp Protection Group.
•Date: 7th Nov 2008• Region:US/World •Type: Article •Topic: BC general |
