What to Consider in a Pandemic Business Continuity Plan

We are facing a time of unprecedented disruption to daily life and business. In the current pandemic, many countries have introduced severe restrictions to the movement of people for the protection of public health. How can businesses and shareholders think about ensuring their survival in a situation that is constantly escalating and could protract for a long period of time?

By definition, in risk management, it is difficult to anticipate something that has not yet happened. Current Business Continuity Plans (BCPs) tend to focus mostly on physical disasters, cyberattacks, and supply chain disruptions. The companies’ current BCPs are unlikely to hold water in the present time.

So what goes into a solid BCP and who is in charge of implementing it? We created a practical guide to Business Continuity planning for pandemics.

We focus primarily on Business Continuity planning that covers the procedures and arrangements necessary for the successful continuation of business operations when they cannot continue as normal. Disaster Recovery (DR) plans, on the other hand, focus on the aftermath of a destructive one-time event, either natural or human, such as an earthquake or a terrorist attack.

What Happens When Current Plans Have Gone Out the Window?

What lessons can be learned in a pandemic? What happens when the current plan does not match reality? BCPs are not a static set of rules, but rather living documents within an organization. They should continually be adapted to reflect new information on the state of the world. They are most effective when they are seen as such and are the product of a continuous, data-driven, open flow of information.

It is obvious that now, for most companies, pre-COVID-19 plans are insufficient. Business Continuity has gone from being a contingency plan to being the main order of action, truly part of a company’s core business. This does not, however, mean that all work that has been done before is worthless—a good understanding of the process and its importance can make the difference in whether a business can survive a prolonged period of distress. The key priority will be a reassessment of business impact and redrawing the possible scenarios. This is best done through reliance on best practices, integrated risk management, and efficient communication at every level, starting from management and staff and including board members, shareholders, and creditors.

In this uncharted territory, what are the next steps to take?

The first order of priority should naturally be reexamining business assumptions and discussing them in depth with area leaders to see whether they still hold true in the current pandemic. The output will be a set of new scenarios that include the pandemic risks and potential economic costs. Second, mitigants and contingency plans need to become part of daily business planning and management (and board) reporting.

Understanding the Business Impact of a Pandemic

The starting point for a sustainable strategy is understanding the business risks, mapping out key processes, and involving all key internal stakeholders in forming the most accurate picture possible of the impact of any identified risk, as well as discovering ramifications of risks that may have not been fully considered in the planning stage and then comparing them to the existing business plan.

This process is iterative and collaborative and relies heavily on open and clear communication.

Business Impact Analysis Template

The ultimate goal of the business impact analysis is threefold:

1. Understanding, and thus prioritizing risks
2. Analyzing the impact on employees and what could disrupt their ability to work and their productivity
3. Estimating the potential financial damage

This output is then the critical input in the planning for the mitigation of these risks:

1. What are the key steps to take?
2. Who is responsible for the implementation?
3. How do we ensure that our staff feels safe, useful, and can stay productive within their personal circumstances?
4. How much will this cost?
5. What resources are needed?

How Can the Impact of a Pandemic on My Business Be Mitigated?

In this section, we give some practical guidance on how to practically implement a new strategy by suggesting questions (unfortunately incomplete by definition) and a business continuity framework for thinking that may be relevant when identifying pandemic risks for each of the mitigation steps.

1. What Are the Key Steps to Take for Pandemic Preparedness?

The key question here is to think of all (foreseeable) implications and to try and anticipate them:

• How many of the company’s employees should be working from home to sustain a minimum viable level of business and support? What are the restrictions that are currently in force?
• How does this affect our supply chain and can it be influenced and why?
• Do the current limitations affect customer satisfaction? Can this effect be mitigated?
• How can management ensure that employees are able to carry out their duties?
• How does the company ensure the protection of its IT and intellectual assets and cyber resilience even when most employees are working outside of the office?
• Who needs to be alerted outside the company?
• Can we renegotiate liabilities?
• Can we engage shareholders?
• What communication strategy is in place internally and externally? Is it effective?

2. Who Is Responsible for the Implementation?

What is crucial is that internal responsibilities are distributed and understood:

• Who is in charge of what aspect?
• How do we stay up to date and flexible in case of changes in government guidance?
• Is this the right person, and will this person be able to both communicate and enforce?
• Do the employees understand what their critical tasks are and what implementation is required of them?
• Is the staff sufficiently empowered?
• Are they clear about their responsibilities?
• Who is in charge if the suggested system fails?
• Are important communications getting to everyone and back to management?
• Does management have a clear list of priorities?
• Is there a clearly communicated list of priorities?

3. How Do We Ensure That Staff Feels Safe, Useful, and Can Stay Productive During a Pandemic?

Employees are human capital. A business without human capital is not viable, not even in AI or robotics. How can they be protected?

• What are the main questions and concerns of my employees?
• Can I address these concerns?
• Are expectations being communicated to them clearly?
• Have they been given the resources to continue with their daily tasks?
• Is management aware of any impediments to their daily tasks?
• Is assistance being offered to employees who may be struggling with their tasks?
• Are employees up to date with internal policies?
• Is management communication reaching employees and assisting them?
• Are communication channels flowing in all directions?
• Are employees valued, supported, and given all the necessary information?

4. How Much Will This Cost?

The key here is planning several scenarios and being prudent and accurate in estimating each:

• How much cash do I need to survive in this period?
• How much is available in short-term liquidity?
• How much is available in contingency?
• How will my cost structure change?
• How will my revenues change?
• What are the possible scenarios?
• Supply issues?
• Demand issues?
• Productivity issues?
• Cash flow issues?
• Have all risks been accounted for and are they accurately modeled?

5. What Resources Are Needed?

What resources are available to the company, have they been exhausted? Have we sufficiently prepared when calling upon them?

• Is there a clear view of cash requirements?
• Are these impacted by operational measures taken?
• Are there additional sources of cash that can be called upon?
• What are the projected cash outlays?
• May liabilities be renegotiated?
• Have all the creditors been contacted?
• Have the shareholders been contacted?
• How can emergency aid from governmental organizations be accessed?
• What documentation is necessary to access any government assistance?
• How does all of this change cash flow forecasts?

Whose Responsibility Is Business Continuity?

Strictly speaking, Business Continuity planning falls under the remit of the risk management function within a company. This is, however, a static and partially incomplete view as BC involves every aspect of a business, therefore:

1. All decision-makers need to be part of the planning process, particularly when it comes to the Business Impact Analysis (BIA).
2. All employees need to be made aware of their role within the plan and prepared for its implementation.
3. Ensure alignment and communication with the key stakeholders of the company.

Business Continuity Management Within the Corporate Governance Framework

The presence of a strong Business Continuity plan and its correct communication and implementation is key to the company’s survival and is thus in the interest of shareholders. Adequate Business Continuity planning and management is also the responsibility of the board. It falls under their remit and should be seen as part of the fiduciary duties that they hold toward shareholders. After all, appropriate planning for the future of a business in a time of distress is the responsibility of those who have a duty toward employees and shareholders. To ensure that all are aware of their role and responsibilities, constant communication is crucial, particularly when those plans need to be acted upon.

Investors such as private equity and venture capital funds have a vested interest in protecting their shareholder rights. As such, they can—and do—take an active role in supporting their portfolio companies toward ensuring business continuity, providing advice, and influencing the board through their appointed board members. There is both empirical and academic evidence that solid DR/BC planning reduces company and societal costs of such an event. Finally, creditors, particularly those that hold short-term liabilities, can, and should, be part of discussions to maintain business operations. While they enjoy more protection, they are also better off if business operations continue. Having strong lines of communication with them can make the difference between life and death.

Anglo-American Model of Corporate Governance

What Now? How Do I Pivot?

Anecdotally, most creditors and (active) investors are well aware of the pain that management is currently enduring because of the pandemic and would be willing to work together to find solutions. For private equity, this means assisting portfolio companies in implementing and designing new Business Continuity plans. For venture capital, time may be spent optimizing burn rates and determining alternative funding sources. Business operations experts can help those businesses that do not have such investors.

Ultimately, the key to the success of a pandemic Business Continuity plan—as far as possible when everything else is unpredictable—will be having clear communications and shared expectations with all who have a stake in the business: shareholders, management, creditors, and employees.