What assumptions will guide your continuity planning going forward?
We've all learned some difficult lessons about continuity and resilience over the past two or three months of this pandemic, all of which should inform our ongoing planning. It's clear we have to rethink our business continuity planning assumptions in the light of those lessons and think beyond hurricanes, fires, cyber-attacks, and others and figure out what else might challenge our resilience in the future. For one thing, I'll bet none of us assumed we needed to include preparations for a pandemic that would keep us all at home for weeks nor did we choose a pandemic for one of our testing scenarios, even though H1N1 and SARS both occurred not too long ago.
On what assumptions did you base your current business continuity planning? You assumed that the plan would allow (1) the business to continue to operate even if there were a short disruption, (2) employees to return to work after a crisis (a few days at most), and (3) that your plan would be tested as often as needed (once a year? Twice?) to keep it up to date and effective. You made your best guess about what conditions or crises could disrupt your operations and made plans on how to mitigate, prevent, and/or recover from them. So, you were ready for power outages, transportation shutdowns, chemical spills on the next block, a fire in your facility, and other disasters that could likely occur. How many actually made any plan to deal with the pandemic we are still experiencing?
More to the point, are you now making the right business continuity planning assumptions for the future and the next crisis? Public health experts, including Dr. Anthony Fauci, are warning about the second wave of this COVID-19 pandemic (assuming we ever get out of the first wave). More than 100 years ago, there was a terrible second wave of Spanish Flu because everything went "back to normal" too quickly. The closures were not as sweeping as in the first wave. "The political and economic will didn't exist. It just evaporated," says Dr. J. Alex Navarro of the University of Michigan's Center for the History of Medicine, who studied the Spanish Flu outbreak extensively. "It became the forgotten pandemic very quickly." Today's experts are warning against that happening now with COVID-19.
Scientists believe that in the future we face unique risks brought about and exacerbated by climate change - the increased frequency of pandemics as temperatures rise and habitats are lost, resulting in humans and animals living closer together and transmitting disease. According to a Smithsonian Magazine article, even the black plague may have been driven by climate change and not by the rats who only carried it. Experts today predict that viral outbreaks will be more common going forward; others say that the melting permafrost could cause ancient diseases to reemerge. Recent research predicts that more pollution could cause viruses to become airborne and thus spread faster. This is all pretty scary and have should have us challenging our assumptions about the continuity of our operations.
It certainly seems, therefore, that we need to adapt our plans to include assumptions that will work for the next crisis. What will the ideal plan look like now? Have we made the right assumptions for what is likely to happen next? We can only make our best guess about whatever conditions might realistically exist for six months, a year, or five years from now. These assumptions should guide our planning and help define the boundaries of what we need to do and have in place before we meet the next challenge.
There are assumptions that can (and maybe even did recently) make our plans less effective. For example, we pretty much assumed that employees would be in the office rather than working (or not working) at home for months. Because of that, many of us were taken completely off guard when businesses had to shut down. A lot of scrambling resulted in order to provide the equipment, bandwidth, and supervision that was required. What must we assume going forward as we review and refine our business continuity plans for whatever might happen next? This is where the lessons already learned will come in handy.
Going forward, you will need to challenge many of your assumptions and make alternate plans. Don't assume that your communication plan is complete. Or that you've tested your plan enough. Or that all the people you need will be available. What happens when the key person for a specific area is ill? Don't assume that contact lists are updated. What happens when a manager who's needed actually quit two weeks ago, but the plan wasn't updated? Don't assume that everyone knows about the plan, how to access it, and what their role might be. The assumptions you make and have made, based on a risk assessment, may need to be expanded or updated to reflect what's happening today and any massive change that might occur in the future to keep the plan effective.
Here are some questions you might want to ask yourself and your Business Continuity Planning team that will best guide what your plan should look like now and in the future:
- When's the last time the employee contact and Business Continuity Planning team lists were updated?
- Do you have a solid communications plan that will allow you to communicate will all employees in a timely manner?
- Are all your component plans completed and up-to-date?
- Is everyone aware that there is a plan and how to access it? Have you trained people on it?
- When's the last time you actually took the plan out and tested it? Has it been more than six months?
- Have the component plans been tested as well? How often?
- What changes might have to be made to reflect your core values and any changes to be made to the employee social contract?
- If another pandemic wave occurs, what changes need to be made to benefits, etc., to maintain employee wellbeing?
- Does the plan consider what constitutes long-term success as well as short-term survival?
- What weaknesses in the plan were uncovered in response to the pandemic? What can you do to repair them?
- How long did it take to trigger the plan? How long SHOULD it take to trigger the plan when it's needed again?
- Have you gotten feedback from employees and the BCP team that could help refine the plan and the response?
- Challenge your assumptions as you prepare the revised plan. Does it reflect what's needed? Is it flexible? Is it realistic?
As you plan for the next wave of the pandemic or a ransomware attack, you will also need to determine how to manage expectations about when life will return to "normal" and what "normal" might look like. Will it be different if there's a vaccine developed? If testing is increased? Many of us have dealt with issues we could never have predicted and met the challenge. What's especially important now is to make new assumptions and plan changes to ensure those assumptions are fulfilled.
Copyright (C) Attainium Corp - All rights reserved.