“It’s been forty years since the last pandemic.”
“The current strain of H5N1 is highly unstable and likely to mutate to a human-to-human strain.”
“This strain of the Avian flu has a high mortality rate.”
These are three of the many quotes that are causing considerable interest (and in some circles, panic) in both board rooms and all levels of government. Some business and government leaders began asking questions of their risk management professionals in order to gauge the potential impact. In other organizations, executive managers dismissed the threat as media sensationalism.
Putting aside management’s interest or disinterest, personnel charged with business continuity also considered the impact of a pandemic.
- In organizations where continuity programs existed, business continuity and continuity of operations planners began looking at their contingency programs to ensure a loss of critical personnel were addressed. Most were troubled to find that they made a common (inaccurate) assumption that all personnel were available to assist in the recovery effort.
- In those organizations where formal business continuity programs did not exist, some security, risk management and internal audit professionals took this as an opportunity to push management toward supporting a program.
Unlike the “normal” day-to-day risk management landscape, there is considerable focus on a single threat, that being a pandemic event eliminating a large percentage of the workforce for weeks, if not months. You might think this would create an environment where executive managers are willing to take immediate action. WRONG! There have been three outcomes to date:
- Supplies and resources were stockpiled to slow the spread of the disease.
- Plans were updated to remove the false assumption that personnel will always be available.
- There was considerable backlash directed at the business continuity planner (and the business continuity consultant) who asked for support in closing this gap, or the person charged with business continuity that asked to plan because of this threat.
We can’t quantify the number of organizations that fall into each of the three outcomes, but we are learning of more and more that fall into #3. Why? Most of us have heard of the story of Chicken Little and “the sky is falling”. In our opinion, the business continuity professional is doing a terrible job in selling management on investing in mitigating this risk.
We have found that there are two methods to best sell management on managing the risk associated with personnel availability:
- Although it sounds like we are splitting hairs, don’t focus on pandemic planning – focus on mitigating the risk associated with health threats. This perspective eliminates the nay-sayers who think the pandemic is a non-issue, and instead refocuses executives to the broader issue that any widespread illness (food-born, a common winter flu, etc.) could impact their workforce.
- Or more broadly, focus on eliminating the false assumption that personnel will always be available in the event of a disaster. Hurricane Katrina taught us this lesson, SARS could have taught us this lesson and a pandemic may teach us this lesson.
The threat of a pandemic is a very visible reminder of the need to plan for business continuity. But we, as members of the business continuity profession, need to be careful to protect our credibility regarding how we push this issue as a method of getting support. Because, if we are not careful, this situation could actually do the opposite, and eliminate the support we need to develop, implement and maintain a workable business continuity program. Lastly, we need to avoid falling into the trap of pushing the Avian flu as the singular focus, and address mitigating the risk of “people availability”. Protecting and ensuring workforce continuity – regardless of threat – is something business and governmental leaders can understand and appreciate.