One common blind spot in business continuity plans

Company X is proud of its comprehensive Business Continuity Plan (BCP).

If a flood or some other disaster prevents Company X from using its main facility, production will shift to an alternative plant in an elevated area about 20 kilometres away. Supplies will be redirected to this new location. Data stored on the intranet and other information systems will gradually become available over the next 24 hours.

Staff will receive communication by SMS, voice, personal email and Whatsapp. A media release will explain the recovery plan and any implications for customers, investors, suppliers and staff, and provide reassurance for all stakeholders. Staff will return to work the next day, and everything will happen pretty much as it did in the rehearsals that Company X has been conducting religiously every 6-12 months.

Is this a fairytale?

Yes, it is. Let’s look at a few realistic scenarios of what might happen if a flood really were to strike and Company X had to invoke its plan.

Joe is an operations manager responsible for a key product manufactured by Company X. Much of the daily decision-making rests on Joe’s shoulders. He lives with his wife and two children in a high area that’s nice and safe from floods.

Joe’s sister Elly lives in their hometown, 10 kilometres away, and her situation is different. Her house is severely damaged and the area she lives in has been evacuated. So Elly, her husband and their three children are welcomed with open arms by Joe and his wife. Many public services are closed, including local schools, and Joe’s kids are having the time of their lives at home with their cousins.

But the fun doesn’t last for long. Four adults and five kids in Joe’s small house is creating problems: not least, there’s hardly enough food in the fridge to feed everyone and local stores are unable to re-stock. On top of this, Joe’s boss expects him back at work straight away because his house is unaffected, even though Elly and her husband need help with theirs. Joe finds himself unable to handle the stress. He secretly wishes his house had gone with the floods too.

Joanna works in the accounting department at Company X. She’s in charge of the ledgers, purchases, invoicing and payroll: complex and specific functions. Joanna’s husband is a volunteer in the flood rescue team, helping people evacuate from the flood. But he’s been missing for two days. Joanna is very emotional and hasn’t returned to work. Someone else has stepped in to cover for her, and they’re making a lot of mistakes.

These are just two examples. Company X will likely have many more staff like Joe and Joanna. Potentially the entire workforce.

The blind spot

Even though the company’s BCP has been thoroughly tested, the rehearsals involved capable people. In real-life disasters, capable people might not be around. We often talk about BCP training, staff safety and creating a ‘risk culture’, but very little is said about who activates the plan when staff aren’t coping, or how an organisation should help staff return to ‘normal’ when they’re suffering from post-traumatic stress disorder (PTSD), or even how an organisation should ensure the longer-term wellbeing of its staff to prevent burn-out.

BCPs tend to concentrate on scenarios such as damage to buildings, denial of access to offices and loss of IT, but the most important ingredient to successful disaster recovery is an organisation’s greatest asset: its people.

Hard-hitting, often sudden phenomena such as earthquakes, fires, wars and floods do not give people time to create individual or collective responses. For organisations that value corporate social responsibility highly, this creates another pressure: in addition to looking after business continuity, they will need to help staff with their domestic and personal recovery. And even organisations that haven’t formally committed to their social responsibility are likely to end up with the same challenge because, in a disaster, there are usually no ‘spare people’ who are unaffected and available to be engaged as temporary or permanent relief staff.

Types of impact that disasters could have on your staff

  1. Being directly affected by the disaster, as in the situations described above, causing inability to get to work, or to cope with work and life in general.

  2. Experiencing fatigue during recovery activities, which is particularly relevant to key staff/departments involved with the restoration of systems, facilities and services. I’m thinking back and remembering IT staff working 20-hour sessions, surrounded by cold coffee and pizza boxes, becoming less productive and more prone to errors ... and all of this during critical work, applying procedures that might have been poorly tested and poorly documented, were not validated recently or were simply never tried.

  3. Trying to stay effective in a nerve-wracking work environment, including dealing with stressed-out bosses and co-workers, and irate customers. Knock-on effects can include a breakdown in work relationships, an increase in absenteeism/sick leave, attrition, premature retirement, accidents/mistakes, low productivity, less creativity and more customer complaints. It's a vicious circle.

A few relevant ways to get better prepared

  1. Adopt proactive measures that will enable staff to cope better with unforeseen events. These could include regular rehearsals/simulations, but also initiatives that promote a physically and mentally healthy workforce. Apart from the day-to-day productivity benefits, staff will be in a better position to cope if a disaster strikes.

  2. Promote a cooperative culture and positive morale. This will enable staff to rely on each other effectively in times of need and make job rotation a realistic concept.

  3. Create multidisciplinary business recovery teams. Nominate first and second ‘additional’ team members ... and then put this practice to the test during BCP walk-throughs and disaster simulation exercises.

  4. Set up business recovery provisions and staff assistance programs that do not rely on local services, and test them. For example, recovery service providers located in the same area as your organisation are prone to the same disasters and will probably be overloaded with enquiries just when you need them. Have a plan B, C and D at the ready. In addition to business recovery services (for spare parts, continuity equipment, IT data recovery and so on), it’s advisable to be able to activate staff assistance programs with remote counsellors (on a phone basis). Proper psychological assessment of staff should be part of every organisation’s BCP.

If you want your BCP to work when you need it most, contact us at www.businessasusual.com.au

And if you’re keen on training, you can also have a look at our upcoming courses in Business Continuity, Risk, Information Security and Supply Chain Security Management (incl ISO22301, ISO31000, ISO27001& ISO28000 certification exams).