Changing Business Continuity Perspectives in a Post COVID-19 World

Brian Zawada, FBCI Brian Zawada, FBCI | May 20, 2020

Like many, I’ve kept an informal journal that summarizes many of my thoughts and observations as our world responds to COVID-19. I’ve also collected excerpts from interesting articles, social media posts, and especially conversations with clients.

This article summarizes my thoughts on what I’ve learned from this experience and how I see organizations, and our profession, changing as a result of this event.

The article is also meant to complement an article written by Avalution’s Michael Bratton titled, COVID-19 Mid-Event After Action Review – Now’s the Time.

Before we dive in, I’d like to start by noting two items…

First, I’m not going to delve into some of the more controversial questions being debated both in the media as well as professional circles. Was this unexpected? Is this a force majeure event, or even a “Black Swan” event? Is this really a worst-case scenario given everyone is affected at some level and much of society is simply sheltering-in-place? Are government actions late, too much, or about right?

Second, as you’re reading this article, please avoid this thought for a moment: “That’s not business continuity, that’s ‘risk management’ (or ‘IRM’ or ‘GRC’).” Instead, if some of my conclusions resonate with you and your organization, simply have a discussion with your leadership team. You may be asked to take on the responsibility or be part of a team that elevates the assessment of business continuity risk.

Regardless of who owns the action to elevate business continuity, the conclusions I’m covering are necessary for the “new normal” whether it is or isn’t considered “traditional” business continuity.

So, let’s assess the COVID-19 situation “mid-event” and see what we can collectively learn and apply to minimize the ongoing impact and improve our ongoing preparedness efforts.

COVID-19 Pandemic Toolkit

 

COVID-19 OBSERVATIONS

As noted in the introduction, I wanted to summarize a few thoughts based on direct observation, conversations with clients (and others), and some really great content that’s been published by global thought leaders.

As I reflected on the last two months, six observations really stood out. Let me start with the first five, which may be good reminders about what to consider now in the ongoing response to COVID-19, as well as in future responses to other crises. Then I’ll dive into my sixth one.

1. Make Decisions in Accordance with Your Organization’s Values

I’m intentionally starting with this one because it sets the foundation for every decision that an organization and its leadership team should be making in any crisis. Revisit your organization’s values and when the situation is at its worst, continue to rely on them as your north star. If your organization isn’t clear on its values, add that topic to an issues list during a future business continuity steering committee meeting and work to make a list of what some call an organization’s “non-negotiables”.

Here’s a great example of an internal client communication that alludes to core values-driven decision-making in a crisis:

With our response, the safety of our employees and their families are our north star that guides every decision we make. The country may be reopening slowly, and although our employees are allowed to work from our offices, our teams will continue to work remotely for the foreseeable future. This decision was easy, safety is #1, we’re operating successfully now (albeit with some inefficiency), but we also owe it to our employees to create flexibility. Many of our employees are parents who have been turned into instant teachers, day care providers, entertainers, and so on, and we are committed to making sure our employees are supported in any way they need. We trust that, regardless of where our employees operate, they’ll do their jobs well and serve our customers based on our core value of “excellence in all we do”.

2. Inventory What’s in Your Control (and What’s Not)

Whenever responding to a crisis, COVID-19 or other, it’s important to reflect on what’s in your organization’s control, and what’s not. COVID-19 reminds us that we can be faced with government mandates (“guidelines”) that are out of our control. We may experience customer and societal reactions to the situation (they may be fearful of engaging with us which impacts product/service demand). It’s important to take inventory of what’s in and out of our control (and look ahead to forecast others), and then work to understand the potential implications of each. More to come on that in a few minutes.

3. Evaluate Soft Skills

I’ve heard this a lot as a lesson learned, and I’ve observed it too.

The soft (non-technical) skills that served many business continuity program participants well in planning for a disruption are far different from those necessary to lead, or successfully contribute to the response to, a crisis such as COVID-19.

Whether you’re a business continuity professional or a member of a crisis/incident management team, the top three most commonly noted soft skill gaps are:

  1. Handling ambiguity
  2. Thinking at different levels (moving between strategic and tactical actions)
  3. Facilitating/influencing

The good news is this. Each of these three “skill gaps” can be developed, and I am very interested in exploring this further once the first COVID-19 wave is fully behind us.

BC Management is wrapping up a study on the role of the business continuity professional in response to COVID-19. I think the conclusions we will draw from this study will add fuel to the need to intentionally develop the soft skills necessary to be successful – not just in leading a planning effort, but leading/participating in a response to a disruption.

4. Plan for the Next Wave

This is a pandemic only observation, but I think it’s important to point it out regardless. History has taught the world that pandemics arrive in waves and viruses often mutate. There will be ongoing and changing peaks and hot spots in different parts of the world, as we’ve observed thus far with COVID-19.

Not only do we need to be prepared for the next wave, but it’s also an excellent time to reflect on the sources of intelligence, or situational awareness, that your organization has found useful and reliable to date. Take inventory of what worked well with situational awareness, what didn’t, and how you might be able to close intelligence-related gaps specific to topics such as COVID-19 impacts and remediation efforts, supply chain issues, the voice of the customer, etc.

Don’t put this off! Now is the time to figure out what worked well and what didn’t – not six months from now when everyone has forgotten what was necessary to respond to the event. If you’re looking for guidance on how to conduct a mid-event after action review, download our Pandemic Toolkit for returning to normal business operations.

5. Define the New Normal

Much has been written about the onset of a new normal and the many things that may never return to the pre-2020 world we knew. Similar to inventorying what’s in – and out – of our control, it’s important to begin planning for a new normal by asking:

  • What do we think has changed permanently?
  • Will our customers’ behavior change back, or do they have a new set of expectations on how to engage with us?
  • How do we get customers, employees, partners, and government/regulators comfortable operating and/or engaging with us again?

There are clearly many other questions to ask, but the critical question you need to ask is: Is it necessary for us to change our business model and strategy going forward? That’s the topic of the next section of this article and one that, in my opinion, has the most significant implications for the business continuity profession.

COVID-19 Pandemic Toolkit

 

ASSESS THE ORGANIZATION’S BUSINESS MODEL

I think this is my #1 take away from the COVID-19 event. Based on my conversations with various senior leaders and program sponsors, it is theirs too.

With the introduction of the BS 25999 standard, as well as ISO 22301 in 2012, business continuity professionals set business continuity requirements at three levels – products/services, processes/activities, and resources (people, workplaces, equipment/resources, information technology, data/information, and third-party suppliers and business partners).

As business continuity professionals, we seldom evaluate the business continuity risk associated with our organization’s business model or strategy. Perhaps it is because we thought someone else was covering it. Maybe a team often labeled ERM, GRC, or IRM. Regardless, in many or most organizations, the business continuity risk associated with the organization’s business model wasn’t being meaningfully – or intentionally – assessed by anyone. Ownership of this very important task was often left unassigned or shared. And we all know that when many people own something, no one really owns it.

Before I continue, you might be asking, what does he mean by the words ‘business model’?

I think quite highly of a strategy tool called the Business Model Canvas (described in a book called Business Model Generation by Alexander Osterwalder and Yves Pigneur). In the book, the ‘business model’ is defined as the rationale of how an organization creates, delivers, and captures value. The Business Model Canvas is a summary of what the authors call “the nine building blocks” of a business model to create, deliver, and capture value. I won’t list and define all nine based on the authors’ perspective, but instead I’ll summarize them into six categories that we, as business continuity professionals, should begin to think about and involve ourselves in.

  1. Products/Services
    Yes, many of us think about and measure product/service continuity today, but have we thought about the value propositions for each, and will our customers’ view change during a wide-spread crisis?
  2. Channels
    I think this is a topic we often overlook. Channels are how we reach (sell) and deliver products/services to the customer. What if they are disrupted (think retail stores, salons, and restaurants)?
  3. Customers
    Who are they, what do they expect, and how do they normally behave when engaging our organization to buy and receive products/services? As business continuity professionals, we often fixate on the service level agreement aspect of the customer relationship but seldom evaluate the customer’s behavior (current and future).
  4. Capabilities
    Said another way, people, workplaces, equipment/resources, information technology, data/information, and third-party suppliers and business partners.
  5. Finances
    There’s a lot in this category, but I think one of the key topics that we, as business continuity professionals can and should help with is the impact of a loss of revenue on the organization’s cash position. Contributing here enables management to assess which expense “levers” can be pulled to ensure the organization remains viable. I admit, much of this analysis is truly owned by the Finance team, but as business continuity professionals, we maintain an incredible amount of data to help determine how and when revenue impacts will occur.
  6. Obligations
    I’ll define this as regulatory and customer service level agreements, much of which we’re aware of and can offer to leadership as an input into decision-making during a crisis.

In summary, I’m advocating that we engage more at a strategic level, building on our existing focus on products/services. We should work to understand and maintain information regarding the organization’s business model.

The next question is, how would the organization use this information if we, as business continuity professionals were to collect and maintain it?

First, use this information to engage your program sponsor, steering committee, and other leadership team members regarding your views and observations on vulnerabilities to disruption (single points of failure or a possible over-reliance on a key resource, channel, or customer segment).

Second, at the onset of a crisis, use this information to contribute to, or identify, situation-specific scenarios where the organization may be at significant risk should the scenario materialize.

Before transitioning to some recommended reading to help with this concept (as well as an introduction to the “Plan Ahead Team” concept), I want to end with one important topic. So many business continuity professionals strive to increase the value they offer to their organizations. By engaging more with your organization’s business model and strategy, you can do just that. Being conversant in these topics can really give you a “seat at the table” when it comes to meaningful discussions with your organization’s leadership team.

COVID-19 Pandemic Toolkit

 

RECOMMENDED READING

In the previous section of this article, I mentioned the book, Business Model Generation. I think it’s a great primer for those that might want to brush up on their skills regarding the elements of a business model, and how one may go about assessing an organization’s go-to-market strategy. Again, I think this skill is essential in the “new normal” world of assessing the risk associated with potentially catastrophic events.

Here’s something I haven’t mentioned yet, and I strongly encourage business continuity professionals to give it a read. It’s a paper written by McKinsey that describes something called the “Plan Ahead Team”. Written after the onset of COVID-19, I think it applies to any crisis with long-term implications.

In it, the authors suggest that organizations should form a “Plan Ahead Team” to define the organization’s broad direction based on the impact of an event (in this case COVID-19), develop “what if” scenarios, and define action plans and triggers should they occur at different time horizons. This team would complement existing crisis and incident management teams that handle the impacts of the situation as it is occurring.  

Overall, I think the “Plan Ahead Team” has merit and could offer value in concert with a traditional crisis or incident management team. Related to the merit, imagine feeding it the business model information – and vulnerabilities – you, as a business continuity professional, collect and maintain.

 

RETURN TO NORMAL-ISH

Organizations are in a constant struggle to align their operational models to government mandates while at the same time working to get employees and customers comfortable re-engaging, all as a precursor to returning to normal (or something as close to normal as possible).

There are so many questions, ideas, and assumptions being debated that public and private sector leaders are assessing, namely:

  • Who’s “immune”, who’s recovering, and who’s the most at risk? Can we leverage those that have already recovered and how should we accommodate those who are the most at risk?
  • How do we social distance in the workplace (even without a mandate) to keep employees and customers safe and help them get comfortable re-engaging?   
  • As the travel industry looks to recalibrate to address their customers’ safety while searching for a viable pricing model to address decreased levels of capacity, what are the implications for those that require an ability to travel to deliver services?
  • How do we continue to monitor the situation – and other sources of disruption – and what are the best sources of intelligence that we can rely on? How do we feed this information to decision-makers – and plan ahead teams – so we can be as nimble and adaptable as possible?
  • How do we assess the health of customers and employees returning to the workplace via testing and temperature taking (and is this a viable process with any merit regardless)? How do we reorganize our workplaces, especially if our people traditionally work in close proximity to one another or in shared workplaces?

It is important to seek answers, have a perspective, and make decisions for each of these questions.

At the same time, it is important to step back and look at your organization’s business model and work to assess vulnerabilities to disruption at a higher, more strategic level (not just for COVID-19, but in general) as we enter a period that many call the new normal.

And to borrow one more catchphrase being used constantly… doing so will certainly help flatten the “impact curve” should your organization, its business model, or key resources be affected in the future.

 

LOOKING FOR MORE?

This article focused on what I’ve learned from COVID-19 so far and how I see organizations, and our profession, changing as a result of this event. If you are looking for more guidance on these topics or need help navigating how to return to normal business operations, don’t hesitate to contact us.

 

COVID-19 Pandemic Toolkit