How can businesses prepare for unexpected crises such as the spread of the COVID-19 coronavirus? To find out, GLG recently met with Steve Waken, an expert on crisis preparedness and business continuity. Recently retired from running the business continuity management program at AT&T – which was recognized by the U.S. Department of Homeland Security as the first and only communication company to earn its private sector preparedness certification – Mr. Waken now works with clients in the development of operational strategies, plans, tools, and training with the goal of reducing costs and maximizing organizational resilience. His edited comments follow.
First, what is business continuity planning and where does it typically sit within the organization?
Steve Waken: Business continuity planning involves creating the capability to identify an organization’s most critical business functions and how any unplanned disaster could disrupt those functions. Having a plan allows the organization to take steps to mitigate a disaster’s impact when people, systems, facilities, suppliers, and partners may not be available for an extended period. Business continuity also includes crisis management and crisis communications.
A business continuity plan usually calls for a crisis management team whose members come from operations, technology, human resources, finance, and other departments. Team members receive annual training and participate in simulation exercises to become skilled in responding to a disaster. If a disaster were to occur, the team convenes at its outset and then coordinates recovery activities across the organization. These include activities that affect employees, the community, and the business, and involve resource allocation, issues resolution, executive reporting, and communications. Crisis communications are the documented procedures that are used to ensure that a consistent message is presented to internal and external stakeholders.
Experience has shown that organizations with the most effective business continuity teams have a C-level champion who supports the goal of operational resiliency. The team is often within the operations division but can also be part of risk management or other departments and has an enterprise-wide scope
How has the response to COVID-19 differed from the plans for H1N1 or Ebola or even the flu?
Steve Waken: In business continuity, we like to use what’s called an “all-hazards” plan. This means we don’t create a unique set of procedures for every possible type of disaster, but rather a basic plan that can be applied to any unexpected event. We’ll then develop procedures that apply to specific event types such as hurricanes or technology failures. COVID-19, H1N1, and Ebola, of course, are all infectious diseases. Although the viruses causing the diseases are quite different, companies can plan for them in the same way. Since infectious diseases affect people, not technology, there should be a focus on absenteeism, supply chains, and effective communication with employees, customers, and partners. For retail businesses and organizations working in public venues, the focus also should include looking at how to respond when customers are unwilling or unable to physically visit a facility.
As far as the flu is concerned, if your company is taking the usual precautions – telling your employees to stay home if sick, get a flu shot, wash their hands, etc. – and conducting an annual flu awareness program, you already have 80% of the pandemic response plan. Most of the differences between seasonal flu and COVID-19 is that researchers just don’t have the same familiarity with it.
What has changed in the workplace since the last major pandemic?
Steve Waken: I started working on pandemic planning in 2007, when the avian flu was the big concern. That disease never caused much harm, but by the time H1N1, or the swine flu, hit in 2009, and the U.S. Department of Health and Human Services declared a national emergency, we had an updated plan in place and activated our crisis management team.
The big change since H1N1 has been smartphones. Now, almost everyone has one, as well as high-speed internet. Most organizations have implemented secure networks that allow you to operate from anywhere. A lot of students now can attend classes and do coursework from home. These capabilities make it a lot easier to accomplish social distancing, which has the effect of reducing the total number of people exposed to a disease.
Another difference today, and one that concerns me, is the pervasiveness of social media. Today we’re seeing a lot of information that is misleading or even outright false, which makes our responsibility to keep employees, customers, and partners well informed even more important. Effective communication is key.
What are the risks of acting too soon on your plan or not acting soon enough?
Steve Waken: Timing is critical. The World Health Organization (WHO) and the Centers for Disease Control and Prevention (CDC) are our best sources of information regarding the current state of COVID-19. The WHO uses a six-level alert system to communicate the pervasiveness of any disease. When the alert reaches level four, which indicates sustained human-to-human transmission, that’s when to start looking at an issue seriously. The WHO has raised COVID-19 to level five, which means that there’s transmission in two or more countries, making for the possibility of a global pandemic. They can and will raise their alert to level six as transmission grows.
Business continuity professionals monitor guidance from the WHO and CDC and try to understand the possible impact on our organizations as the threat develops. By the time the WHO gets to level four, companies should have activated their core response team to review the pandemic plan and begin messaging management employees so that everyone is aware of the company’s plan and is ready to act. That’s also the time to prepare signage, hold local team meetings, and ship extra hand sanitizer and surface wipes.
There is no harm in getting a plan in place too soon. That way, if threats start to come in, your company may need only some minor updates to the plan and refresher training for response teams.
Probably the biggest risk in not acting soon enough is that people assume the company is doing nothing. They then tend to make the worst-case assumptions and take steps to protect themselves and their families. So, having and executing a plan allows you to time execution of specific response tasks such as activating the pandemic management team and sending targeted messages to employees, customers, and suppliers. Another risk is not adequately preparing employees to work from home or not having critical supplies, such as hand sanitizers and surface wipes, on hand. Ask anyone who’s been to a Walmart or Target lately to get those items and you’ll know why it’s better to stock up early.
Other than the WHO and the CDC, who else can companies turn to?
Steve Waken: State and local health departments can be valuable sources of guidance and information.
About Steve Waken
Steve retired from AT&T as Assistant Vice President for its world-class Business Continuity Management Program. He was responsible for working across the global footprint to prepare for and respond to all types of disasters, including hurricanes, earthquakes, technology failures, pandemics, terrorism, and workplace violence. The AT&T team was recognized in 2012 by the U.S. Department of Homeland Security as the first, and only, communications company to earn its Private Sector Preparedness™ certification.
This article is adapted from the GLG teleconference Business Continuity Planning Amid COVID-19. If you would like access to this teleconference or would like to speak with Steve or any of our more than 700,000 experts, contact us.
GLG is supporting nonprofits on the frontline of COVID-19 relief, pro bono. If you represent or know of an organization that could use our help, let us know here. If you are a GLG network member whose expertise might be valuable to a relief organization, please get in touch here.