Risky business: Facing adversity and riding the storm
Noah's Ark is the oldest example of a contingency plan, described in the Hebrew Scriptures as a great boat designed to save Noah, his family, and a fair few animals from the great flood. It's nothing new, therefore, to plan for the unexpected whether that is natural or man-made disasters.
And there are plenty of examples to glean lessons from, including the recent fires of southern California, Hurricane Katrina, the U.S. terror attacks of 9/11, to name only a few.
Andy Tomkinson, a former director of the Business Continuity Institute (BCI), says that IT recovery first sparked interest in the subject in the 1960's and 70's when businesses that had previously relied on paper-based and manual systems began to move over to computer filing.
"IT disaster recovery began to move along at that time and really took hold in 1999/2000 when lots of work was done in an attempt to mediate the threat of the Y2k millennium bug," he remarks. It was at this point that the area of business continuity began to open up.
IT aside, the threats most commonly faced by businesses include fire, electrical outage, and burst water mains, but, says Tomkinson, what is most likely to keep chief executives and HR directors awake at night are: "Terrorism, widespread regional flooding, and the threat of negligence."
Adding to the merry-throng of real and potential threats is avian flu, with its potential to mutate into the human virus and become a full blown pandemic. Both Dr David Cook, a medical director at International SOS, and Alison Brown, chief executive officer at UK-based Healthcare Connections (HCC), warn that it is not 'if' but when it will happen.
With disasters such as this on the horizon, it is no wonder that the world of business continuity is really taking off. Cook suggests that HR's role in all this is very real, providing a critical and pivotal part in being both manager and facilitator.
Deliberate, plan, and execute
Brown says that where avian flu is concerned, plans need to be mobilised sooner rather than later.
"The UK is relying on the NHS to provide all the medication that is required but they don't have enough of it. The plan in the UK is largely post-pandemic. The decision therefore for companies, is to decide whether to invest in it or not and if so how far to extend provisions."
The U.S. pandemic strategy involves a nation-wide alert system with state-level preparations for dealing with innoculations and response plans. There is no question that large companies can help in preparedness by developing contingency plans for maintaining and regulating workflow in such a crisis.
"Many companies would spend more on the Christmas party per head then they would on fighting this," said Brown.
Cook says that the companies that are doing well are those that have a foothold in South East Asia, parts of Africa, and Indonesia, where the pandemic is already being felt. "Many people are 'pandemic-ed out' – it's a slow burn rather than a crash; it reveals itself over time but the number of cases is increasing and stretching forever westwards."
A detailed risk assessment is the starting point, he says, followed by plenty of education and plans for ensuring the business survives when it strikes. The World Health Organization predicts that in the case of a flu pandemic, over 25 per cent of the population may fall ill, and businesses will need to be prepared for at least 50 per cent absenteeism.
The fallout via sickness, therefore, is the real threat to business survival. Cook says businesses need to make a decision whether to take on board prophylaxis to reduce the risk of key employees being affected by pandemic flu when it hits."
Don't forget we're humans
Medical and technical plans aside, Tomkinson comments that what most companies are missing is investment in the human aspect of disaster recovery. Tomkinson suggests that HR has a vital role to play in managing the psychological fallout of such events. "It's outside the normal frames of reference for most HR departments – dealing with bereavement for example."
Plans need to be in place to deal with the detailed issues that may arise, such as what will happen about workers that need to pick children up from school, collecting DNA samples, and extracting the messages of a key director who is a fatality?
"Companies should consider having hotline numbers and PR strategies in place as well as simulation exercises to evaluate how robust the plans are," he advises.
A common mistake, says Tomkinson, is HR's belief that it is their responsibility to inform family members of disaster. "This is the role of the emergency services. Even if an HR director witnesses one of their HR staff being injured, they shouldn't inform the next of kin."
The dangers of grapevine communication are far too damaging, warns Tomkinson, who advises HR to focus on offering support after notification has kicked in. "I never see anything in the plans about offering a helping hand after the event. Business continuity is not just about reviving the payroll and informing the next of kin - that is the mistake HR can make."
Like Cook, Tomkinson says that the companies that are performing well are those that have already been exposed to the real dangers.
And, of course, the larger companies tend to be the ones with the resources, in terms of both time and money, to nurture well-thought out plans, but, says Brown, it is the smaller businesses that cause greater concern.
Jonathan Senior, a member of AccountingWEB's sister site, the HR Zone, says that what SMEs often face are the disasters that happen on a smaller but no less insignificant scale: "You work in an office of 30 people and the first 25 calls in the morning are from staff suffering food poisoning from the social/presentation/prize giving buffet/whatever happened yesterday. So you have five staff to do all the usual jobs - answer the phone, deal with orders, complaints etc. How on earth do you prioritise what has got to be done?" Senior says this is when the plans really come into play.
But surviving the everyday dramas is not enough to satisfy the real threats, however, companies that are prepared can ride the storm.
According to the BCI, less than a week after the terror attacks of 9/11, the major financial institutions in Manhattan that had been severely affected by the attacks were reopened for business. This was due largely to sophisticated business continuity planning. Tomkinson says that businesses could do worse than pay attention to the three P's - 'People', 'Premises' and 'Process' - but this in itself is not enough; survival of the fittest is about not only having robust logistical plans in place but preparing for the psychological debrief and fallout from traumas that such situations inevitably bring.
By Annie Hayes, for our sister site, HRZone