Risky business: Facing adversity and riding the storm

Noah's Ark is the oldest example of a contingency plan, described in the Hebrew Scriptures as a great boat designed to save Noah, his family, and a fair few animals from the great flood. It's nothing new, therefore, to plan for the unexpected whether that is natural or man-made disasters.

And there are plenty of examples to glean lessons from, including the recent fires of southern California, Hurricane Katrina, the U.S. terror attacks of 9/11, to name only a few.

Andy Tomkinson, a former director of the Business Continuity Institute (BCI), says that IT recovery first sparked interest in the subject in the 1960's and 70's when businesses that had previously relied on paper-based and manual systems began to move over to computer filing.

Disaster recovery

"IT disaster recovery began to move along at that time and really took hold in 1999/2000 when lots of work was done in an attempt to mediate the threat of the Y2k millennium bug," he remarks. It was at this point that the area of business continuity began to open up.

IT aside, the threats most commonly faced by businesses include fire, electrical outage, and burst water mains, but, says Tomkinson, what is most likely to keep chief executives and HR directors awake at night are: "Terrorism, widespread regional flooding, and the threat of negligence."

Adding to the merry-throng of real and potential threats is avian flu, with its potential to mutate into the human virus and become a full blown pandemic. Both Dr David Cook, a medical director at International SOS, and Alison Brown, chief executive officer at UK-based Healthcare Connections (HCC), warn that it is not 'if' but when it will happen.

With disasters such as this on the horizon, it is no wonder that the world of business continuity is really taking off. Cook suggests that HR's role in all this is very real, providing a critical and pivotal part in being both manager and facilitator.

Deliberate, plan, and execute

Brown says that where avian flu is concerned, plans need to be mobilised sooner rather than later.

"The UK is relying on the NHS to provide all the medication that is required but they don't have enough of it. The plan in the UK is largely post-pandemic. The decision therefore for companies, is to decide whether to invest in it or not and if so how far to extend provisions."

The U.S. pandemic strategy involves a nation-wide alert system with state-level preparations for dealing with innoculations and response plans. There is no question that large companies can help in preparedness by developing contingency plans for maintaining and regulating workflow in such a crisis.

"Many companies would spend more on the Christmas party per head then they would on fighting this," said Brown.

Cook says that the companies that are doing well are those that have a foothold in South East Asia, parts of Africa, and Indonesia, where the pandemic is already being felt. "Many people are 'pandemic-ed out' – it's a slow burn rather than a crash; it reveals itself over time but the number of cases is increasing and stretching forever westwards."

A detailed risk assessment is the starting point, he says, followed by plenty of education and plans for ensuring the business survives when it strikes. The World Health Organization predicts that in the case of a flu pandemic, over 25 per cent of the population may fall ill, and businesses will need to be prepared for at least 50 per cent absenteeism.

The fallout via sickness, therefore, is the real threat to business survival. Cook says businesses need to make a decision whether to take on board prophylaxis to reduce the risk of key employees being affected by pandemic flu when it hits."

Don't forget we're humans

Medical and technical plans aside, Tomkinson comments that what most companies are missing is investment in the human aspect of disaster recovery. Tomkinson suggests that HR has a vital role to play in managing the psychological fallout of such events. "It's outside the normal frames of reference for most HR departments – dealing with bereavement for example."

Plans need to be in place to deal with the detailed issues that may arise, such as what will happen about workers that need to pick children up from school, collecting DNA samples, and extracting the messages of a key director who is a fatality?

"Companies should consider having hotline numbers and PR strategies in place as well as simulation exercises to evaluate how robust the plans are," he advises.

A common mistake, says Tomkinson, is HR's belief that it is their responsibility to inform family members of disaster. "This is the role of the emergency services. Even if an HR director witnesses one of their HR staff being injured, they shouldn't inform the next of kin."

The dangers of grapevine communication are far too damaging, warns Tomkinson, who advises HR to focus on offering support after notification has kicked in. "I never see anything in the plans about offering a helping hand after the event. Business continuity is not just about reviving the payroll and informing the next of kin - that is the mistake HR can make."

Like Cook, Tomkinson says that the companies that are performing well are those that have already been exposed to the real dangers.

And, of course, the larger companies tend to be the ones with the resources, in terms of both time and money, to nurture well-thought out plans, but, says Brown, it is the smaller businesses that cause greater concern.

Jonathan Senior, a member of AccountingWEB's sister site, the HR Zone, says that what SMEs often face are the disasters that happen on a smaller but no less insignificant scale: "You work in an office of 30 people and the first 25 calls in the morning are from staff suffering food poisoning from the social/presentation/prize giving buffet/whatever happened yesterday. So you have five staff to do all the usual jobs - answer the phone, deal with orders, complaints etc. How on earth do you prioritise what has got to be done?" Senior says this is when the plans really come into play.

But surviving the everyday dramas is not enough to satisfy the real threats, however, companies that are prepared can ride the storm.

According to the BCI, less than a week after the terror attacks of 9/11, the major financial institutions in Manhattan that had been severely affected by the attacks were reopened for business. This was due largely to sophisticated business continuity planning. Tomkinson says that businesses could do worse than pay attention to the three P's - 'People', 'Premises' and 'Process' - but this in itself is not enough; survival of the fittest is about not only having robust logistical plans in place but preparing for the psychological debrief and fallout from traumas that such situations inevitably bring.

By Annie Hayes, for our sister site, HRZone

You may like these other stories...

IRS audits less than 1 percent of big partnershipsAccording to an April 17 report from the Government Accountability Office (GAO), the IRS audits fewer than 1 percent of large business partnerships, Stephen Ohlemacher of the...
Is it time to consider a value added tax?Forbes contributor Joseph Thorndike wrote yesterday that he believes the tax reform proposal by House Ways and Means Committee Chairman Dave Camp (R-MI) was dead on arrival. But he...
Read more from Larry Perry here and in the Today's World of Audits archive.The planning phase of an audit engagement of an entity using US GAAP or a special purpose framework will, with minor differences, include similar...

Upcoming CPE Webinars

Apr 22
Is everyone at your organization meeting your client service expectations? Let client service expert, Kristen Rampe, CPA help you establish a reputation of top-tier service in every facet of your firm during this one hour webinar.
Apr 24
In this session Excel expert David Ringstrom, CPA introduces you to a powerful but underutilized macro feature in Excel.
Apr 25
This material focuses on the principles of accounting for non-profit organizations' revenues. It will include discussions of revenue recognition for cash and non-cash contributions as well as other revenues commonly received by non-profit organizations.
Apr 30
During the second session of a four-part series on Individual Leadership, the focus will be on time management- a critical success factor for effective leadership. Each person has 24 hours of time to spend each day; the key is making wise investments and knowing what investments yield the greatest return.