Checklist to Develop Your Practical DOVID 19 Business Continuity Strategies

Checklist to Develop Your Practical COVID 19 Business Continuity Strategies

Guest Post by Patrick Ow (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Here are some practical considerations you need to make in developing and implementing your COVID-19 business continuity strategies for your organization or business, or even for yourself.

If you already have some form of business continuity plans already developed, execute them. Otherwise, you have to take a practical short-cut and use the information below to flexibly develop your next steps as you go.

In a time of crisis, trust is paramount

This simple formula emphasizes the key elements of trust for individuals and for organizations:

Trust = Transparency + Relationship + Experience

Identify members of your management response team for COVID-19

Apart from the CEO, select/nominate members from your senior management team to be part of the COVID-19 management response team. Then assign clear responsibilities.

Establish emergency response teams right away in order to assess the risks and formulate response strategies after conducting robust scenario planning, which significantly improved the epidemic response mechanisms and toolkits.

Stay on top of communications from the government and authorities

This may seem obvious, but it is imperative that you stay on top of alerts being issued by the Government, authorities, and even industry groups. News has been evolving on a daily basis. No doubt it will continue to do so indefinitely.

Seek advice or help in these unprecedented circumstances.

Protect your workforce

To protect your workforce and ensure its continued productivity. It is critical to:

Establish strategies that enable employees to continue to function without endangering them.
Have a plan to isolate employees should the threat of possible infection arise.

c Ensure employees can effectively work from home in the right working environment that is safe.

Verify that you have the appropriate tools, technology, capacity, and security measures in place to support a large remote workforce.
Review your HR policies and procedures to ensure that employees will not be personally impacted if they must be quarantined for an extended period, continuously modifying any policies as appropriate to give greater flexibility to normal working arrangements.
Determine your priorities and the minimum workforce requirements to support these ever-changing priorities, especially in case you need to function with a significantly reduced workforce.
Identify key employees and ensure other employee members have received appropriate training or on-the-job exposure to comprehensively cover their absence.
Create a communications plan that includes providing employees and other stakeholders with regular situation updates as well as actions taken.
Review workforce locations and travel.

Working from home legal issues

Employers have the ultimate responsibility for ensuring a safe work environment, wherever that work is carried out, even at home. This means that when employees are working from home doing your work, you have a duty of care for your employees’ health, safety, and wellbeing.

The most common issue to arise is when an employee is injured at home in the course of their employment. For example, when an employee falls down the steps answering the front door or slips over in their ‘home office’.

If the employee is working from home, check that your insurance will cover that employee.

Employers may provide employees with work equipment, including a work laptop. Then it is a question of whether employees have ergonomic chairs, how good are their screens, if they sit all day resulting in a repetitive stress injury, etc.

So, how will you know if your employees’ homes are safe?

Develop working at home policies that outline the method to verification of the safety of employees’ work environments.

Smaller businesses may develop a ‘self-check’ policy for employees to verify to them that they will be working in a safe environment.

Review your HR policies and communications

Constantly review your HR policies and clearly communicate updates to your workforce.

Businesses will need to be clear about their expectations as to when their employees should attend work. Be vigilant in relation to employees who are unwell.

In imposing restrictions on employees, you should be wary of your legal obligation to comply with regulatory provisions and relevant anti-discrimination laws. Ensure that any restrictions are lawful and reasonable and are required to keep workplaces safe.

Employees who are not able to work may or may not be entitled to paid leave. Some may be able to work productively from home, depending on the job role.

It may also be in your interest to expedite the identification or exclusion of COVID-19 cases by funding quicker tests offered at some private hospitals for a higher fee.

For employees working at workplaces, infection control policies should be reinforced and stringent protocols implemented. Personal protective equipment should be provided, where appropriate.

While masks have not generally been recommended for people who are well, some experts consider they provide a limited level of protection with the added benefit of preventing people from touching their face (which is thought to be a significant mechanism of self-transmission).

Work rosters might also be adjusted to limit potential transmission.

Employees (and wider stakeholders) will be looking for reassurance that they are being protected and that the business is prepared.

Areas of coverage when reviewing your HR policies include:

General advice for employers and employees

It is essential that employers and employees be as informed as they can be regarding COVID-19.

Employees exposed or at risk of exposure to coronavirus

Your policies should cover:

Employees exposed to coronavirus.
Employees returning from overseas travel.
Employees who have contracted COVID-19.
Where the employee is a carer for an affected family/household member.
Where the employee is required to self-isolate.
Where the employee wants to stay home because they are not feeling well.
Where the employee is otherwise required to be absent from work.
If there is no requirement by law or direction by the government or employer to self-isolate.
Casual or part-time employees.
Independent contractors.

Safe working practices

Employers and employees have mutual obligations to ensure that workplaces are safe and without risks to the health of employees and other people who may be in contact with your employees.

Personal Protective Equipment

Part of the employer’s responsibilities in minimizing risk is providing the appropriate personal protective equipment (PPE) such as gloves, masks and eye protection for employees who provide frontline services.

However, the provision of such equipment will be commensurate with the level of risk faced by an employee in terms of their duties and the direct environment in which those duties are performed. This is particularly relevant and important at this time as the nature of the public health threat posed and response required will place pressure on the availability and supply of these items worldwide.

Employee notification

Employees (including casual employees) and independent contractors should be required to notify the employer immediately if they:

(1) have traveled to an affected area;

(2) have been exposed to coronavirus, and/or

(3) are suffering, or have suffered, flu-like symptoms.

Other exclusions from the workplace

Employers should consider excluding other people from their workplaces including visitors, contractors, and volunteers.

Appropriate signage and other notices should be visible. Relevant information should be made available to those likely to be affected by such restrictions.

Minimizing unlawful discrimination and vilification

It is likely that COVID-19 could be characterized as a ‘disability’ for the purposes of anti-discrimination laws.

Employers have a responsibility to ensure that employees are not unlawfully discriminated against, knowingly or unknowingly, by their managers, their colleagues, and the organization.

Employers should remain aware of the potential for heightened unlawful discrimination in the workplace during a time of heightened public health concerns and possible pandemic.

Employers should be aware that if an infectious disease originates from a geographical region, employees from that region (or perceived to be from or connect to that region) may be at an increased risk of experiencing unlawful discrimination from others. They should monitor this and intervene where necessary to remind employees, customers, and suppliers of their obligations to behave respectfully towards others at work.

Any inappropriate workplace behavior by employees may be subject to a misconduct investigation.

Assigning and managing work

Employers might need to adopt policies and arrangements that allow dynamic responses to how, when and where work is to be performed and by whom.

Employee concerns over attending/performing work

Provided the workplace is safe, other than in the circumstances set out above, employees are expected to report for work as usual. Employees should discuss any concerns with their employer.

If employees request to work from home or to take some form of paid or unpaid leave, these requests are subject to the normal leave or flexible work application process in the workplace.

Maintenance of critical functions

In some circumstances, it may not be appropriate to provide employees with the opportunity to work from alternative work locations because employees are required to attend the workplace in order to maintain critical functions or services or implement the Government’s response to an outbreak of COVID-19. In such circumstances, employers must ensure that as far as is reasonably possible they have taken steps to minimize risks to employees and other people coming in contact with employees.

Consulting on workloads and overtime

While employers can ask their employees to work additional hours, those additional hours must be reasonable.

Employers have a practical — and in some cases, a legal — obligation to consult with their employees where there is likely to be a prolonged increase to employees’ working hours and/or workloads. Consulting in advance where higher workloads are expected is good practice.

Employers must continue to meet their industrial, legal, and contractual obligations.

Managing fatigue

Managing fatigue will be essential for a surge period that might last for a considerable period of time. Employers must comply with all legal obligations to provide a safe working environment and to avoid placing excessive or onerous workloads on their employees.

Employers should consider all available options to meet increased or changed service needs including offering additional hours to part-time and casual employees, offering paid overtime or time-off-in-lieu arrangements or engaging additional resources.

Managing leave requests

Where approval is discretionary for the type of leave requested, that discretion should be exercised cautiously and in consultation with the employee.

If employee leave is to be disallowed for operational reasons — such as employee shortages or higher workloads influenced by COVID-19 — this should be made clear and all alternatives to disallowing the requested period of leave be explored and discounted.

The employer might also seek to negotiate a different period of leave or for the leave to be taken at a different time.

Evidentiary requirements

Many employees will require leave during a time of heightened threats to public health for a variety of reasons.

In a pandemic or other emergency that affects public health, employees may find that access to medical practitioners is limited. Employers should establish local procedures for recording and approving applications for leave during this period, which are, at a minimum, consistent with the documentary evidence requirements.

Employers may wish to consider a more flexible approach to the evidentiary requirements, given access to medical practitioners may be limited or visiting a medical practitioner may otherwise not be advisable.

It is important that processes are established, in advance, to protect vulnerable employees and to ensure sick employees do not report for work. Employers need to consider how best to manage employees once they have exhausted their personal/carers leave entitlements.

Employees undertaking overseas travel

In all cases where employees might be traveling overseas, employers should ensure those employees receive broad advice on minimizing the risk of exposure to coronavirus. This includes good hand hygiene and cough etiquette.

Employees should monitor their health closely whilst away and seek urgent assessment for any symptoms of coronavirus. If unwell, the employee should isolate them to self from others whilst awaiting assessment.

International work-related travel

Employers should defer any work-related travel at this time.

Where work-related travel is proposed, employers should undertake a risk assessment for any work-related travel by employees and should consult openly and directly with those employees.

Personal travel

Where an employee has booked, is booking or is otherwise planning overseas travel to a ‘risk’ country for personal purposes — whether that be for a holiday or for family purposes — employers should ensure that the employee understands the implications this might have for them on their return from that travel. This includes any periods of self-isolation.

Employees must inform their employers if they are intending to travel to a ‘risk’ country. Where employees choose to go ahead with their travel arrangements, any period of self-isolation.

Employee assistance program and debriefing

Employers who run employee assistance programs or similar should ensure that all employees are aware of these programs and that they can access them if they have concerns about how COVID-19 is affecting them, their family or their colleagues.

Employers should ensure that appropriate peer-support and debriefing is available for employees directly involved in the testing and treatment of patients suspected to have and who have contracted the coronavirus.

Compile a list of your key customers

Establish a plan to serve your key customers for the duration.

Since it is impossible at this time to know how long that will be, plan for at least four to six months and identify priorities for each.

Determine the Maximum Tolerable Outage (MTO) for all services.

Maximum Tolerable Outage refers to the maximum period of time that the business can tolerate the disruption of the service.

Your MTO for a service could be NIL, in hours, in days, or in months. Be honest and practical about your service MTO.

Prioritize all services based on the MTO.

Using the MTO determined for each identified service, categorize them into:

Essential services (i.e., services that must be performed).
Services that could be delayed for a period of time.
Services that could be stopped.

Use other categories that suit your requirements.

The key objective is to find a way to prioritize your services so that you can dedicate your limited resources in keeping your essential or critical services running.

Identify all potential single points of failure

A single point of failure (SPOF) is a part of a system or process that, if it fails, will stop the entire system or process from working. SPOFs are undesirable in any system or process with a goal of high availability or reliability, be it a business practice, software application, or other systems.

By identifying your single points of failure for each essential service, you are able to ensure that all uncertainties throughout the value chain could be identified and managed. The results will feed into the high-level risk assessment process (see below).

Conduct a high-level risk assessment across these services

Understand contractual obligations, evaluate financial impacts and liquidity requirements, formulate debt restructuring plans, and optimize assets to help restore financial viability.

Another core focus was to understand financial impacts across the entire value chain.

The high-level risk assessment could include the following considerations:

Impact of service reduction on your key stakeholders and on your financial sustainability.
Health, safety, and wellbeing of employees and clients.

Don’t lose sight of other risks

COVID-19 isn’t the only threat on the horizon — and often organizations are at their most vulnerable when dealing with a crisis that dominates their attention.

There will be many other risks that your business faces aren’t diminished by an epidemic. Cybersecurity, for example, should always be top of mind.

Review any existing business continuity plans and standard operating procedures

Good time to dust off any existing plans and procedures.

It is too late to write any business continuity plans down. At this point in time, develop high-level intuitive strategies to respond to your current situation.

Determine whether the service is a full service or can be scale-down

Identify which part of the service can be delivered by employees working remotely from home (or off-site) and what tools, equipment, and resources are needed for doing so.

Identify any process changes or manual workarounds required to enable parts or the entire service to be delivered by employees working from home.

Some of your essential services may not be able to be delivered remotely by employees working from home. Alternative processes and workarounds are required to achieve the same outcomes.

Develop mitigation strategies for the essential service using scenario planning.

Possible workforce outage scenarios that could be used in your scenario planning:

10 percent workforce outage
25 percent workforce outage
40 percent workforce outage
60 percent workforce outage (worse case).

Scenario planning is a critical tool for you to test your preparedness.

Consider the worst-case scenario in your planning and preparation. Factor in the closure of schools, universities, etc. and the shut-down of public transport, etc.

Develop manual or paper-based workaround strategies and processes if employees cannot remotely access the organization’s digital information or IT systems

There is an assumption that employees working remotely from home will have Internet access or remote access to the organization’s digital information or IT systems. When more people work from home, these networks may not cope with increased usage.

There is also an assumption that public mobile and telephone services will still run during peak loads, which may not be the case. So, plan for the worse case and don’t assume.

Consider the worst-case scenario in your planning and preparation including developing manual-workaround processes without IT or system access.

A manual workaround process can be defined as a temporary method used to provide the continuation of a critical service activity when normal systems, technology or personnel are unavailable for a period of time. Once a problem is fixed, a workaround is usually abandoned.

Manual workarounds require manual labor, so you may need to reassign employees or bring in temporary assistance to continue the business process concerned. It also requires paper-based processes where information has to be processed and documented on paper and transposed later into the system when it is up and running.

There will be a number of manual forms and documents to be created if this occurs. Pre-determine which forms need to be created and get them printed for emergency use.

List names of employees — primary and secondary — who are capable of performing the essential services under different workforce outage scenarios.

Key actions include:

Develop a succession plan for leaders and managers. This includes delegate decision making/authority.
Develop call-tree contact lists for all employees. They may object to the collection of personal information on the grounds of privacy. However, employers have a duty of care for their employees to keep them safe.
Perform a skills gaps analysis to identify all potential employees who can perform the essential service with some training. It is not too late for upskilling your employees to provide the essential service.
Determine whether your secondary employees are able and willing to be redeployed to perform the essential service. Not everyone is flexible to be redeployed to do other roles not documented in their employment contracts.
Ensure that all critical employees can remotely access the organization’s IT network and systems from home.
For client-facing services, consider employee health and wellbeing.
Ensure that employees can conduct online meetings to minimize face-to-face contact.

List all in-bound critical numbers that must be redirected to designated mobile phones.

All critical inbound phone numbers related to a critical or essential service should be identified and redirected where practical.

Protocols and processes must be in place to receive these inbound calls via mobile phones by trained employees.

Information received may be processed electronically, if there is remote access to core applications, or using paper-based or manual methods if the remote access to the organization’s IT network is unavailable.

List all in-bound fax numbers that must be redirected to alternate locations.

Faxes received may contain personal information.

Exercise caution when redirecting faxes to alternate locations, ensuring that processes are in place to ensure confidentiality and security of the information received.

Identify key information or records — hardcopy or digital — that are required to perform the service

Employees working remotely will require access to information or records, either digitally or in hardcopy.

Develop manual workarounds when employees cannot access any of the organization’s digital information remotely.

If your business relies on hard-copy information, develop processes for accessing this information. Courier companies may be stretched during this time.

Inform your postal service to redirect all mail and courier deliveries at an alternate location

If your services are relying on mail or postal services, inform your postal service to redirect any documents.

Identify key suppliers required to provide the service — total reliance and dependency on third-party providers

The sustainability and availability of key suppliers in delivering your services will be vital during this period. If the service requires third party assistance (i.e., courier, tradesperson, etc.), determine whether they have business continuity plans and what service levels they can provide to you if there is a total shut-down.

Work out the extent and likely duration of any potential exposure or disruption to key third-party providers and supply chain. Any disruption to their supply chain may impact the delivery of your services.

Review key agreements and negotiate temporary arrangements for the continued delivery of services especially when there are resource constraints.

Continued payments to providers and suppliers should be monitored closely. This is to ensure that key suppliers remain committed to providing services to you.

Accelerate investment in digital trading solutions to combat supply chain interruptions, overcome logistics and labor shortages, and get better visibility into local access limitations in order to ensure product supply for the domestic market. Focus on operational agility and data quality.

Manage supplies and be prepared for shortage

Consider the terms of your supply contracts. Make contingency plans for any interruption to supply.

Suppliers who are unable to fulfill their contractual obligations may argue they are not liable as the contract has been frustrated. You may need to seek other sources of supplies required to provide care and services and document their efforts in doing so.

If you suspect there may be disruptions to your supply chain:

Contact your suppliers, carriers, forwarders, and brokers immediately to confirm.
If possible, build inventories of your short raw materials and secure production and transport capacity from your supply chain partners.
Start sourcing alternative suppliers as needed.
Identify a resource to monitor the crisis and potential impacts to your supply chain.

Review key contracts

Your business may not be able to fulfill its contractual obligations to your own customers because of supply chain complications, risking severe penalties. If this occurs, businesses throughout the supply chain have options for protecting themselves or recovering from lost business.

Steps to take include:

Review key contracts to determine what, if any, rights and remedies you have as a result of the delayed performance of contracts are due to force majeure.
Provide timely notice of a force majeure event.
Prepare for potential litigation concerning failure-to-supply issues and the application of force majeure clauses, including by taking (and documenting) reasonable steps to mitigate any impacts of COVID-19.
Update force majeure clauses in contracts to take into account, to the extent possible, modern risks to contractual performance, including diseases, epidemics or quarantines.

Check your insurance

Review your organization’s insurance policies to ascertain coverage (e.g., business interruption insurance, the extent of public liability insurance, etc.).

It’s also important that you check your obligations to notify your insurer in the event that something goes wrong.

Identify key stakeholders impacted by non-provision of services — service reliance by third parties

If your service has a downstream impact on third parties, make contact and inform them of any potential limitation of your service.

Proactively manage their expectations and communicate clearly.

List all IT systems and applications — internal and external — that the provision of the service is dependent on.

Software and systems rely on other software and systems in order to be functional. Identify all possible single points of failure.

If the system you are using is totally dependent on another system to be fully functional, then evaluate the extent and likely duration of any potential exposure or disruption of these other dependent systems.

Part of this exercise is to list all critical and non-critical IT systems — internal and external — used in your essential services, whether upstream or downstream.

Contact all system owners to determine the level of redundancies and limitations especially for remote access by employees working off-site. Understand their business continuity and disaster recovery plans and how that would impact on the provision of your service.

Identify any communication messaging — internal or external — required in the event that the service cannot be provided.

Digital notification via email or text message — how can the message be sent and who is responsible for sending the message. Messages can be pre-drafted and approved.

Hard-copy notification to be displayed on location — who is responsible for putting out the display (i.e., at reception or front of the office).

Ensure proper building management

Determine who will be in charge of the premises in the event that your business needs to close suddenly.

Consider the ways in which people, products, supplies and other things get into and leave your building or facility. Make sure that all building entrances and exits are secure.

Identify machinery, computers, custom parts or other essential equipment needed to keep the business up and running — and what (if anything) needs to be moved (or removed) in the event the building will be closed for any length of time.

If any of your employees are identified as having even casual contact with anyone known to have coronavirus, your facility may be involuntarily shut down. Plan what you will do if your building, plant or office is not accessible.

Test all plans and processes.

It is vital that all COVID-19 strategies and business continuity plans are tested with employees working from home. Where possible, test any related disaster recovery plans for IT systems. These tests need not be extensive.

In performing the test, teams should establish some conventions around ways of working — when do they touch base, using what tools, what hours are people working, how are they going to let others know when they are available, etc.

Document key lessons learned from these tests for future debriefs and improvement in the way the department approaches business continuity and disaster recovery especially from a pandemic perspective.

Call-to-action

I am especially interested in people sharing their ideas and practices so others can benefit.

Professional bio

Patrick Ow is a Chartered Accountant with over 25 years of international risk management experience. He has experience in a diverse range of large multinational and small organizations and in various industries including hospitality and public sector.

He is an author of several eBooks including When Strategy Execution Marries Risk Management — A Practical Guide to Manage Strategy-to-Execution Risk (available in Amazon).

In addition to his professional work, he has a personal passion for preparing individuals for the future of work. Check out his blog at https://allmoneymakingideas.com or contact him at patrickow@gmail.com.