COVID-19 has exposed glaring deficiencies in business continuity and crisis management plans at organizations across all industries. And while executives and management today are focusing the lion’s share of their efforts on responding to the day-to-day upheaval caused by the virus, they should be preparing now for the possibility of a second wave that further disrupts business. In a recent survey, 70% of companies said their primary business continuity concern is disruption from a second wave of COVID-19 during 2020.
But the global pandemic is only one type of threat likely to test the crisis management capabilities of organizations. Moving forward, leaders will need to reimagine their crisis management and business continuity planning to prepare for simultaneous natural disasters, widespread power or technology outages, civil or political unrest, and other events that could very conceivably threaten business operations on a large scale.
Top Business Continuity Management and Planning Questions
Crisis Management Planning
Crisis management planning gives organizations the ability to plan and then respond to an event effectively and launch a ready, alternative business model with speed and flexibility. Effective planning encompasses four critical components: continuity risk assessment, incident response plan development, crisis management plan development and crisis management training.
Continuity Risk Assessment – The continuity risk assessment identifies and ranks all potential threats to the continued operations of the business. Such assessments, which should be conducted at least annually, aim to enhance resiliency to withstand the potential loss of third-party capabilities, technology, facilities and people.
Incident Response Plan Development – Incident response has become synonymous with cybersecurity breaches, but the term refers to any business disruption, including natural disasters and manmade events. Among other goals, incident response plans prescribe actions to address various crisis scenarios that may disrupt connectivity to partners or customers, raise compliance issues or pose other specific risks.
Crisis Management Plan Development – Formulating an effective crisis management plan includes leveraging an organization’s management culture and operational structure to facilitate decision-making and awareness. Crisis planning should include brand monitoring and protecting the organization’s digital footprint and reputation.
Crisis Management Training – Ongoing training is vital to successful crisis management and business continuity. Programs should include tabletop exercises, testing and annual drills. Roles and responsibilities typically dictate the level and frequency of training for various workers.
Reimagining Crisis Management
Up until the current global pandemic event of 2020, it was not unusual for crisis management teams to update plans once a year and meet once every quarter to review them. However, the most effective response to the pandemic has demanded that teams share recent data weekly – if not daily – to continuously monitor within what is an evolving and highly uncertain environment.
For all of the difficulties it has caused, however, COVID-19 is providing organizations with an opportunity to reclaim and reinvigorate crisis management planning. Organizations can reclaim the process by making the more active and continuous communication practices of today permanent. And organizations can enrich their scope of preparedness by imagining extreme scenarios, regardless of cost. This approach would represent a welcome departure from past norms, in which budgets have typically framed how teams envision future crises.
No type of black swan future event should be off the table for consideration in a robust crisis management planning exercise. Bold questions should address the “unimaginable”: What if the digital infrastructure broke down, on top of the pandemic? What redundancies are in place? Do remote workers have a way to complete their work? Crisis management planners could assess all possible alternatives under this scenario, including solutions available today and those that could be put in place over time. The crisis management planners should explore not just the likelihood of certain single events occurring but of several events happening all at once.
Here are key concepts that organizations should consider when reimagining crisis management:
- Develop a flexible and resilient culture that is capable of responding to upheaval with a business-as-usual approach.
- Conduct more frequent meetings between the incident response and crisis management teams and integrate after-action reports into a continuous improvement program.
- Update the business impact analysis (BIA) to emphasize physical locations and the colocation of resources that provide critical business services. Ensure current service levels are maintained during peak periods.
- Thoroughly evaluate the organization’s reliance on third parties that provide critical business services and ensure alternatives in case of loss of these providers.
- Clearly define and communicate the process of managing incidents through the crisis management plan so that declared disasters will catalyze an immediate ramp-up of alternative operations.
- Evaluate the digitization of work to ensure that employees can access what they need remotely. Make sure that remote procedures meet regulatory requirements that govern professionals in specific industries, such as securities traders who are buying and selling stocks from home.
- Review how crisis command centers have responded to COVID-19, identify areas that need improvement, and address and correct shortcomings highlighted in after-action reports.
- Evaluate supply chain disruptions and identify alternatives for critical supply chains.
- Assess the business model’s resilience, its ability to adapt and recover from disruptions, and its ability to manage future crises by reducing costs in the short and medium term.
Flexibility, Adaptability, Speed
The economic and business disruption wrought by COVID-19 are not going to end any time soon. Many companies have announced their intention to extend remote-working initiatives through the end of the year. Some have announced plans to allow employees to work from home permanently, to decentralize their workforce, or pursue both measures.
As companies continue to respond to the pandemic, they can utilize crisis management plans to guide and evaluate a phased return to the office. Companies also need to adapt their plans to incorporate how a permanent remote or distributed workforce will react to a different crisis or multiple crises. Additionally, organizations need to ensure that workers can access crisis management plans on their mobile devices from anywhere in the world at any time to be fully prepared.
Finally, it is imperative that crisis management plans include the critical components of speed and flexibility, which allow organizations to quickly adapt to rapid change. It’s also key that executive leadership and employees are given fact-based information and tested alternatives to enable good decision making. This comprehensive approach will help build operational resilience and prepare the organization for future disruption of any kind.
