Pandemic phase six: what do business continuity managers do next?
June 19: Updated with new entries John Sharp So now we are at level six and H1N1 is spreading quickly throughout populations. At this point in time those who contract the virus have symptoms similar to a normal bout of ‘winter flu’ and the numbers admitted to hospital and the level of deaths remains low. However we are in the early stages of a pandemic and WHO is watching to see how the virus will mutate over the coming months. There is time therefore for organizations to examine how well their BC plans are coping with the current situation and modify them accordingly. That is assuming they have plans in the first place. The recent Chartered Management Institute’s BCM awareness research, sponsored by the UK Cabinet Office, highlights the current level of planning for a Flu pandemic. Overall only 19 percent of the UK’s organizations have plans in place that they consider robust and there is a wide difference between public and private, large and SMEs. 32 percent of public bodies consider their plans to be robust as against 13 percent private. Only 10 percent SMEs have addressed flu pandemic in their BCPs. As already mentioned all planning assumptions have been based on rate of spread based on the six WHO stages and then on a further four stages in-country. The initial Mexican outbreak was detected in mid March this year and it has taken 3 months to reach the official pandemic stage with 74 countries affected as of the time of writing. What appears to have taken organizations by surprise is that we have reached the higher status levels in-country so quickly. Many organizations acknowledged early on that there was a need to look at their HR policies, to carry out skills analysis and to identify resources needed to maintain key products and services. But the possibility of a pandemic occurring was seen to be low and the economic crisis was a much more pressing issue and hence, if they exist at all, the robustness of flu plans leaves much to be desired. So what can organizations do now during the low level of infection rate we are experiencing? Firstly it is essential to complete continuity planning for key products and services, concentrating on the loss of staff as the major scenario. If plans already exist they should be re-examined to ensure that staff shortages have been considered. The level of staff absenteeism used in the planning assumptions must include those who are absent as they are caring for others, and the worried well. We have seen whole schools being closed when a case is confirmed in a teacher or pupil. Will this extend to shopping centres and other places of mass gathering? How will organizations cope with the highest levels of absenteeism expected? HR departments need to complete their assessment and adaptation of the policies relating to sickness, absenteeism, hygiene, remote or home working. IT departments must ensure that their ICT capabilities can meet the demands that the planned levels of home working will require. The snows early in the year will have provided evidence of how well systems will cope, and that was only for a period of 1 – 2 days. How will they stand up to several weeks of remote working? Will organizations have to establish shift working to ensure systems can cope? Maintenance of systems must be up-to-date, remote access to systems checked and the BCM capabilities of key suppliers investigated. All upgrades and system reconfigurations, unless absolutely critical, should be placed on hold once the pandemic reaches its peak and not re-commenced until it is over. Most ICT failures occur because of human intervention. Organizations need to invest in audio / video conferencing capabilities and ensure that they have access to on-line net meeting facilities. Where they exist they should be put into use at once to limit travel and achieve ‘social distancing’. The BC plans, suitably modified, must be fully exercised and any weaknesses identified and rectified quickly. Cleaning regimes need to be enhanced and staff required to follow hygiene rules. One organization that has struggled to achieve a clear desk policy is using the current situation to now embed the policy. If staff want the hard surfaces of their work area cleaned to reduce the likelihood of infection then they must present the cleaning staff with a ‘clear desk’. Finally now is the time to establish cross sector BCM forums so that best practice ideas can be shared, mutual aid arrangements agreed and support mechanisms established for those managers who have to deal with the continuity of operations for their organizations. If the pandemic lives up to the forecasts the BC manager will need a great deal of support in the coming months. William R. Lang, CBCP, MBCI, CBCV A phrase coined not too long ago described the H1N1 situation very well – ‘All disasters are local’. Meaning that all disasters are felt and addressed at the local level with little immediate help from outside the local area. I doubt that many people in Mexican emergency rooms when this all started cared much about the WHO levels or CDC stages. Triggering the entire pandemic plan off WHO or CDC can be too late if your pandemic starts locally. Staffer: Boss, all the schools are closed, church is canceled, and 20 percent of the people haven’t shown up for work, and the National Guard is blocking the roads out of town! Boss: So what, the WHO is still at level 4 and the CDC said its contained. I wonder what they meant by ‘contained’? Conversely, triggering off WHO or CDC can also be a problem if you’re in a relatively remote area like some places in Alaska where few travelers arrive to bring in disease. Staffer: Boss, the WHO is at level 6!! Boss: Let’s trigger the pandemic plan just in case that monthly supply flight due ‘28 days later’ gets here early, and that pilot who never leaves the plane has the flu. Triggering off the local Health and Human Services (HHS) organizations is the best way to go and has the added benefit of catching epidemics and also incidents like restaurants having health issues that can take out your staff during a well attended luncheon. Remember to compartmentalize your plan so each prevention or mitigation technique can be instituted on its own. For example, you may choose to initiate extra premises cleaning during incidents other than pandemics like an employee taking a sick day because of Norovirus. World monitoring organizations should be used to trigger selected parts of your pandemic plan such as quarantining staff coming back from places where the disease is more prevalent or helping staff avoid said same places when traveling for business or pleasure. Since the local HHS is going to govern what happens to you, local HHS is the one to watch. Be sure to get to know your local HHS to gauge their efficacy, just in case. www.pandemic.gov and other websites have all the planning details you could ever want from the knowledgeable ‘big guns’. But if the triggers don’t work the big guns are useless. John M. Stagl, CBCP This newest pandemic has brought a very important aspect of planning to our collective attentions. When creating a plan and identifying key ‘trigger factors’ you must still use judgment and common sense. WHO declared H1N1 a ‘pandemic’ for no other reason than the fact that there was human to human transmission around the world. We in the business community, and WHO as well, have always expected that a level six pandemic would be a serious life threatening situation. We are now confronted with a fast spreading flu with a relative low mortality factor. Under these circumstances should we initiate our pandemic plan? The answer is, “it depends”. But certainly it should not be initiated just because WHO declared a level six pandemic without further evaluation of all of the facts. One the day before the level six announcement the conditions around the world were identical to the day after. Yet now companies and communities are considering the initiation of their pandemic plans. This makes no sense. Alternatively, if we were confronted with a highly lethal virus with only limited distribution world-wide would we not initiate our pandemic plan because WHO did not declare a level six pandemic warning. There is no question that WHO and the CDC both play important roles in helping us deal with illnesses around the world. However, until they develop a warning system that incorporates both the transmission factor and a lethality factor, then the final decision of how to respond in our communities and businesses must rest with the people in charge, not some plan that was created to deal with a historical illnesses. Your pandemic plan may be invaluable when dealing with a virus that is localized to your country, and therefore is not a pandemic. Conversely, if H1N1 is spreading around the world and not creating a serious medical emergency, even though it may be a pandemic, should you go through the expense of turning on your pandemic plan. The fact that a plan exists does not relieve leaders from their responsibility to exercising good judgment. Only a novice planner would place absolute reliance on a plan; professional planners understand that plans are ‘guides’ to help with the decision making process. But the decision maker must still consider all of the facts that exist at the time the decision is made. The H1N1 (swine flu) is becoming a valuable learning exercise for all of us. Russell Price Dr Margaret Chan, director-general of the World Health Organization, has announced formally the arrival of the influenza pandemic, describing it as now “unstoppable”. By the time you read this note, in the UK we’ll have had around 1000 cases identified, with probably many more going undiagnosed. The novel A(H1N1) virus causing the pandemic is so far relatively mild, with much of the message coming from health professionals giving reassurance that the virulence is moderate and for us all not to be alarmed. Notably, the move to a pandemic level has been described as reflecting geographic spread only and not marking a specific increase in the danger of the virus. This all sounds not too bad; it’s not the H5N1 Bird Flu, which is far more deadly, the symptoms are pretty mild, and most get well without needing much medical intervention … so is it really something for us to be concerned about? Well, I’d say yes. From a medical perspective, the issue is that nature has created in the virus a very adaptive thing. It is constantly evolving, changing and merging its structures to try and survive and spread. So far there have been 30,000 cases globally; this is a tiny percentage of those likely to be infected, and in a person infected with a tricky virus like A(H1N1), the possibility of the virus mutating still further not just exists, but is reasonably likely. What this means is we really don’t know just what the longer-term impact of the virus is going to be. It may stay as a mild seasonal ‘flu type strain or it may increase in its severity. Crossing ones fingers and hoping, though, is a poor risk management tactic despite its frequent use. One thing is certain, people infected will be too ill to come to work and if the spread of the virus does scale up dramatically in the Autumn then a lot of offices, shops and factories are going to have to function with fewer people for a while. There could well be further impact should schools continue to close (and parents need to stay at home), or if the transport networks were affected through staff loss. The Continuity Forum [the organization that this author is part of] and the UK Government have been campaigning for BCM to be more widely adopted by organizations, and today around half our ‘corporates’ do have plans to some degree. However, many of these (>65 percent) do not cover the people issues the threat of pandemic raises. In smaller organizations, as you may expect, the level of planning is much less. Scaling this up and taking a national (UK) view means more than 90 percent of organizations, covering something like 80 percent of the UK workforce, have not developed proper plans. This raises an important organizational issue. It is rare for those working in the continuity field to get any significant notice of one specific event, but that is the case with the current pandemic. Most of you reading this will be ‘believers’ in the value of BCM to an organization, but you’ll also know that there are real difficulties in gaining the necessary support of develop effective plans. It should come as no surprise you that 8 out of 10 of those with BCM plans in the corporate area (our best prepared) have not considered at all the financial impact of a pandemic, and fewer than 30 percent have looked at their supply chain at all. Against this backdrop, I have reservations about how people will now act, particularly in the SME community, where pressures are intense just now. They may feel it is too late or hard, and choose to do little or nothing, putting their faith in luck. Understanding how your organization will be affected by a period of sustained staff absence is vital to coping well with any disruption - and maybe even averting a crisis. There is a lot of advice now available that people can follow, mostly practical and easily implemented. The first steps, though, are a real critical examination of the likely impact on the foundations of the organization. Look at areas like cash flow and production difficulties, consider how you would cope if you lost critical skills. This is often overlooked, not just in areas such as IT or production, but in terms of people authorised under regulation to do certain tasks. The first task has to be to choose to act and act now or lose the window of opportunity we have. There is a lot to consider and space is limited, but you are not alone and we can help. The Continuity Forum is holding its third Pandemic Summit on 26th June : see http://www.continuityforum.org/events/0604/specialsummit for more details. Jeremy Morris All the contributors present excellent analysis and advice. But how does the poor BC manager now address the exceptional inertia and disinterest from his managers and staff regarding this particular pandemic? H1N1 is widely perceived as being hardly more than a bad cold, and in the current economic situation there is little or no enthusiasm for implementing unnecessarily disruptive level six plans (and incurring associated costs) for "something trivial" (a response from a manager at one of my clients when asked if the Emergency Management Committee should be invoked yesterday). Be honest, fellow Continuity Central readers, how many of your clients/companies have actually and formally gone to DefCon1 as a result of the level six announcement? Jay n. Rosenblatt The comments by the different contributors are valuable. This is a time when businesses and all their stakeholders have to re-evaluate their risks; their business risks of course, but also their LEGAL risks As a business lawyer with a focus on legal risk management and mitigation, I am aware that there is risk to businesses and all their stakeholders, including lawsuits, fines, loss of operating licenses and even, under serious circumstances, jail. The good news is that there are IMMEDIATE actions businesses, directors and sr. managers can take to manage and mitigate those risks. Being proactive, following industry standards and other accepted standards is the first step to instilling a culture of due diligence establish a defence to these risks. Dan Dorman As the novel H1N1 flu variant rapidly charges out upon the globe with a ‘mild to moderate’ severity, we’ve been given an opportunity to check our overall pandemic readiness and the functionality of our business pandemic plans. Many pandemic planners, who had been diligently preparing for the emergence of H5N1 as the next pandemic, were surprised at the sudden appearance of this virus in the Americas, its moderate virulence, and its alternately fast, then slow development in meeting pandemic transmissibility criteria. Many noticed that the response actions built into their plans which were connected directly to the WHO pandemic alert stages were not always appropriate to the emerging characteristics of this novel H1N1 virus. But in fact, this virus has emerged just as we should have expected given what we know historically about pandemics. If our pandemic plans are too closely aligned with the WHO pandemic alert phases, which by design, only look at transmissibility criteria, the problem is not with the WHO stages, or with what we know or don’t know about the virus, but in the assumptions we have made when crafting our plans. Clearly, a narrowly conceived plan based on only the transmissibility of a novel virus misses the mark for guiding our response activities. To avoid this pitfall, we can adjust our pandemic action plans using a matrix of condition factors which uses the WHO stages as only one dimension. And now that we have arrived at WHO phase six, there are no further stage demarcations to guide our response actions. What is needed is a response matrix which takes into account a number of observed and expected on-the-ground conditions. Ideally, a multi-dimension matrix would address: These factors could be linked to specific actions and mitigations. But even then, these should be assessed and applied to the appropriate geographies (political and physical). This is especially important (and delicate) for organizations with an international footprint. Malcolm Cornish FBCI FCA Most pandemic response plans have triggers that align with the WHO pandemic alert phases. However, when WHO raised the pandemic alert phase to four and then rapidly to five, it became apparent that these triggers were not that helpful to business. It had commonly been assumed that there would be weeks rather than hours between the two announcements and so for most organizations, there was no time at all to undertake the actions allocated to phase four. It is obvious now that the pandemic levels have everything to do with the medical situation and little to do with the impacts that will be felt by the majority of organizations. So what happens now that WHO has raised the pandemic alert level to six? Most response plans break level six down further in recognition that whilst a pandemic may have been declared, it will have a different impact depending on its hold in a specific country. The triggers chosen have generally aligned with the UK alert levels: With hindsight, this breakdown is again not that helpful for business and those BC managers who need to mount an effective response. What businesses need to do is focus on the key issue of ‘critical functions’ being affected as a result of the potentially high levels of absenteeism that may arise and do what they can to reduce the peaks. If organizations have not already clearly identified their critical activities, they need to do so now and estimate the staffing levels needed to ensure that they can be carried on at least at minimum levels of performance. They then need to monitor their own situation closely and consider what if anything needs to be done to manage or mitigate the impacts caused by the increasing levels of absenteeism. Dr. Jim Kennedy, MRP, MBCI, CBRM, CHS-IV The World Health Organization has told its member nations that it was declaring the ‘Swine Flu’ H1N1 virus as a Pandemic by raising it to pandemic alert level six. Alert level six is the highest WHO pandemic alert level. Based on this I am sure that many business continuity planners and managers are asking themselves what to do now that their pandemic BC plans which have built in escalation steps have reach the level six. BC managers should absolutely activate their level six plans! However, they should, given the relatively low virulence of the virus and the current status of infection levels, be in communication with senior executives to give them the latest guidance from WHO, the CDC, and other healthcare organizations. Then the senior management should decide on the prudent actions to allow for appropriate levels of the plan to be activated and to what extent. Then those actions should be communicated to the workers, third party suppliers and customers. All should be reviewed on a frequent and periodic basis to revise actions as necessary until the pandemic level six is reduced. The actions to be reviewed by senior management and which are part of the pandemic level six of the typical business continuity pandemic plan usually include: 1) A trigger to activate the level six stage of the plan – this usually comes automatically from the WHO and/or CDC announcement of the pandemic stage progressing to level six. 2) Review of the state of the pandemic and confirmation of the required response level – here the senior staff review the current state of the pandemic in their operating areas and review recommendations from WHO and the CDC if operating in the US. 3) Activation of an emergency communication plan – here the business organization begins regular communication of the organization’s activities and special activities as it relates to operation under a stage six pandemic. 4) Activation of control measures – based on WHO, CDC and other recommending health organizations the business should begin to take prudent steps to address current needs of the business to control business activities. 5) Travel restrictions enacted – here if senior management agrees then travel restrictions within the home country and around the globe should be prudently restricted and those restrictions reviewed and revised on a frequently and regular periodic basis. The restrictions should also be communicated to the workforce as indicated in the emergency communications plan. 6) Workplace entry restrictions and increased social distancing – again should be prudently placed into effect as agreed upon by senior management based on recommendations of the WHO, CDC and other healthcare organizations in the business’ regions of operation. Those restrictions reviewed and revised on a frequent and regular periodic basis. The restrictions should also be communicated to the workforce as indicated in the emergency communications plan. 7) Workplace cleaning – should be based on recommendations of the WHO, CDC and other healthcare organizations in the business’ regions of operation and should be undertaken as appropriate. In addition ‘personal protection materials’ should be deployed as appropriate. 8) Workplace illness monitoring and control implementation - should be implemented as appropriate and actions as agreed upon by senior management should be undertaken and communicated through the emergency communication plan. Adjustments of the work force should be made as necessary to maintain the necessary level of operation. Plans should be flexible, but they were developed for a purpose and a reason and that reason has been reached today. Geary Sikich The World Health Organization declared a Pandemic Level 6 today (11 June 2009) for swine flu (large world-wide outbreak). The World Health Organization told its member nations it was declaring a swine flu pandemic Thursday — the first global flu epidemic in 41 years — as infections climbed in the United States, Europe, Australia, South America and elsewhere. There is no vaccine for this strain yet, there are anti-viral drugs available (e.g. Tamiflu) to lessen the impact of infection. * Avoid medical treatment facilities unless absolutely necessary. For necessary medical treatment, make medical appointments instead of visiting emergency rooms and avoid waiting rooms if possible. * Implement more stringent cleaning measures (i.e. keep contact surfaces touched by others, like desktops, key boards, counters, and telephones, sanitized) * Wash hands with soap and water or sanitizer BEFORE touching your nose, eyes, or mouth. Carry hand sanitizer for use after touching unavoidable un-sanitized common surfaces like door handles, grocery carts, etc. * If you begin experiencing flu-like symptoms, STAY HOME, SEEK MEDICAL TREATMENT, and then STAY HOME until you feel better. Don’t come in to work to tell someone face-to-face that you may have a communicable disease. If a member of your household is ill with the flu, odds are, you are too. Even if you are not showing symptoms, you can spread a virus. There is nothing more important than your health and the overall health of the community; STAY HOME, SEEK MEDICAL TREATMENT, and then STAY HOME until you or they are better. * If caring for an ill family member, consider wearing a paper contaminant mask and eye protection to avoid being sneezed on by, especially, children, and using medical or food handler’s gloves to handle contaminated articles. So the good news is that you now have an opportunity to take a couple of deep breaths and think through how you and your organization might manage the challenge of a deadly pandemic. Ensure that you have good community outreach efforts and coordination with local government authorities. Managers should also practice ‘active analysis’—constantly assessing facts and questioning assumptions—to better monitor the situation. In short, be proactive and build bridges, policies, and procedures before you find yourself in the midst of a crisis. Whatever you do, keep an even keel. Be concerned, but not worried. Concern means that you feel you can do something about the situation. Worry, instead, can lead to decision paralysis and an inability to accomplish anything. Do not panic. Do not become reactive. Do not become indecisive. Geary Sikich is author of ‘Protecting Your Business in a Pandemic’.
•Date:12th June 2009• Region:UK/US/World •Type: Article •Topic: Pandemic planning |
