Business Continuity Checklist for Future Pandemic Preparedness [Article]

• Review the notes, minutes and records of responses to COVID-19 and speak with those involved to gather learnings
• Celebrate successes, where planned responses were executed and where innovation occurred, understand what worked, what happened, when and why
• Identify the root causes of failures, where the organisation was not sufficiently prepared, or not prepared to invest in planning
• Take a look at any red tape that got cut during pandemic responses and consider whether it necessarily needs to be reinstated and whether the original reasons for its implementation are no longer relevant
• Take a look at the processes and strategies:
  • Were they too prescriptive or did they have the necessary flexibility?
  • Do plans include single or multiple solutions for certain types of event at time of need?

A thorough assessment of both big and little pictures will generate significant learnings and capture new processes, strategies and tools that might be needed in the next pandemic event (and potentially useful in a wider range of events). These are the improvement opportunities.

As a practical starter for ten, a review of documents should allow you to identify new guidance notes or checklists for your plans that didn’t exist pre-pandemic. For example, do you have a checklist or guidance for the following:

• Emergency closure of workspaces
• Post-event staff needs assessment
• Planning to return to workspaces – operations assessment
• Planning to return to workspaces – IT risk assessment
• Planning to return to workspaces – risk assessment
• Safe homeworking during a pandemic or other emergency
• Guidance for homeworkers and line managers during remote/homeworking
• Workspace hygiene
• Building floor plans, workspace and desk floor plans
• Exceptional operations policy guidance

Please note that this list is not exhaustive, the nature and make-up of your business and the industry you work in, will lead to alternative or additional checklists.

Continuous evaluation of market demands, competitors and the effectiveness of the evolving operational strategy will be essential to business growth. You need to make sure business continuity professionals have a seat at that table.Consider the known threats, especially the black swan, green swan and grey rhino events and how they could have been more impactful. For example, how would the organisation respond if the next pandemic had a higher mortality rate, targeted a healthy workforce, caused more strict global restrictions or constrained more operations than previously anticipated?

Educate yourself in understanding new risks, deliverables, customer demands, and the threats they present. Use this knowledge to shape the business into one which is resilient and futureproofed. By applying business continuity practices to each transition and sharing your findings, you can evaluate the organisation’s ability to adapt to change and help shape the resilience agenda to meet those market expectations. You can ensure that your organisation comes to you to find out what to expect and the steps it needs to take to remain resilient at every stage. BCM needs to be at the heart of strategy so have a plan to make business continuity an enabler for business evolution. Find out how you can utilise business continuity practices and services to respond to the rapid demands of new markets or workloads.

Assess whether the organisation recognised ‘the danger’ quickly enough, moved fast enough, and performed as well as (if not better than) competitors. The need for your organisation to maintain operational agility will be a significant driver for your need to develop an ever-changing set of recovery and resilience plans. As changes to the operating model transform your business, you need to continually evaluate and quantify your risks to allow continuity of service at any time, anywhere. This will help shape the agreements with third parties as suppliers will need to rethink how services are contracted in these new markets.

COVID-19 forced many organisations to increase their digital capabilities at speed to meet immediate needs. When the business changed its operating model and working practices, it also needed to develop new mechanisms to assess whether the changes were delivering expected outcomes. Whether immediate needs have been met or not, it pays to take time to review the organisation’s digital strategy, ensure security risks are fully addressed, and that digital tools and resources are cleverly leveraged to support fast and effective response in the future.

Although rising in prominence, supply chain continuity is still a neglected area of continuity planning. Commit to doing more – know your supply chains and its vulnerabilities. Commit to investing in the success of key suppliers for mutual benefit both now and in the longer-term. And make sure you include forecasting for changes in supply and demand, and lack of access to alternate suppliers in the scope of your business continuity planning.

Review the use of the command and control mechanisms – these are often designed to bring order and structure to initially chaotic events. For many organisations, the pandemic was more of a ‘slow-burn’ where exceptional mechanisms were not invoked. Would they have added value if they had been? If they weren’t – what happened instead, and what were the learnings from that? Can anything be added or removed from he command and control process to improve it? If these mechanisms were followed, did the processes fall short and necessitate (or even block) innovation, or did they provide an expedient springboard from which innovation was able to flourish? Asking these questions will often find opportunities for improvement.How useful did you find your crisis communications plan in such a protracted event? Perhaps you had to rewrite the “rule book” to meet the communications requirements for COVID-19 and can use this for similar events in the future? Either way, it is a great opportunity to check the quality of your crisis communications capability – don’t neglect it. It takes skill to communicate effectively in times of stress, so spend some time building capability, training key staff, and rehearsing for increased competence.

Don’t give up on specialist recovery centres. You may have originally contracted for them as a mitigation for the loss of a building and you may have successfully adopted homeworking during COVID-19. That’s great, but as a strategy, homeworking has its own vulnerabilities, does not suit all teams, and won’t serve if your network is compromised. Work area recovey (WAR) providers have done their own innovating during COVID-19 and services are evolving to meet the new market requirements. Talk to your risk professionals and centre provider about how recovery centres can supplement and back up your post-COVID operating model in new and different ways, to counter existing and emerging threats.

Some COVID-19 responses placed a significant burden on people who found themselves overworked, working under challenging conditions, or taking on extra responsibilities. Review whether your organisation sufficiently recognised and accommodated this by use of exceptional policies designed to support and enable staff to do what needed to be done and show that the organisation appreciates the loyalty and service of its people. Review whether your organisation recognised and made sufficient provision for the importance of social interactions and the difficulty in establishing a new work-life balance brought about by operational changes. Assess whether mechanisms were and are sufficient enough to allow people and teams time for reflection to learn from their own experiences and to find opportunities for improvement. Recent experience has shown me that individual and team reflection is a vital source of innovation, so make sure that is captured in your business continuity planning, throughout the business.Impacts of future events are likely to be more far-reaching and unexpected in nature and scale than we anticipate. Organisations that are able to flex and change will be reliant on a workforce that is equally comfortable with flexibility and change, so invest in building a culture of belonging where staff feel invested and that their contribution is valuable. The importance of leaders as role models should not be underestimated. If an organisation wants its staff to be agile, innovative and collaborative, these qualities need to be demonstrated by leaders, in the context of a clear sense of mission. Empower staff to feel competent and responsible, able to make decisions and to take action, and to be supported in those decisions and actions.

For business continuity practitioners, collaboration throughout the business is key. You can become a significant business enabler, so invest in your personal ability to communicate. It is essential that you convert colleagues across all business functions into advocates of the organisation’s resilience agenda so that they can influence on your behalf – everyone has a part to play in safeguarding the future. Also, look at any new working relationships that were developed during your pandemic response – inter-departmental, cross-functional and with external parties. Assess the reason for these relationships and whether there is value in maintaining and developing them from here on in. It has never been more important to align business continuity with other business disciplines and functions. To successfully collaborate, you need to know how best to engage other teams and use platforms and technologies to integrate the business continuity agenda with other strategies.

A global pandemic was not on the list of scenario test and exercise programmes for many companies. Question whether your current programme of tests and exercises is sufficient to prepare the organisation for the future or whether you’re stuck in a cycle of testing and proving the same old things. Are your exercises sufficiently challenging? Are you battling an ‘it’ll never happen’ culture that prevents you from stretching your teams sufficiently? If there are responder processes and strategies that are currently regarded as exceptional, unfamiliar, or rarely used, consider if any need to become second nature; embedded in muscle memory. Don’t neglect these powerful activities as they not only build competence and capabilities, but also accelerate buy-in, help to normalise change, and can increase ‘peace-time’ engagement with risk and continuity disciplines – all necessary for an agile organisation.