BCP For Coronavirus: Updating Your Business Continuity Plan

Steven Minsky | Feb. 5, 2020

The World Health Organization has declared the outbreak of the Wuhan Coronavirus as a Public Health Emergency of International Concern (PHEIC).

From a business perspective BCP for Coronavirus is essential when looking at the business risks and impact that it could have. It is imperative to choose a BCP Solution fit for purpose such as LogicManager’s which you can view here.

Here is an online dashboard updated daily tracking infections and outcomes around the world for the coronavirus (2019-nCoV).

Some experts fear that infections may grow into a pandemic. We may not have enough data yet to predict with certainty, however, according to the Centers for Disease Control and Prevention (CDC), every Business Continuity Plan needs to have a pandemic scenario, such as a Coronavirus Business Continuity Plan.

You may also like: Free BCP Checklist

BCP for Coronavirus: Background

This is a good time for Risk Management professionals to take action with a Coronavirus Risk Management plan. Many of you are already updating your Business Continuity Plans (BCP) to incorporate contingencies related to the rapidly unfolding Coronavirus outbreak. You can learn from other outbreaks in the past such as SARS or Swine flu and incorporate new information about the Coronavirus as it unfoldsand provide risk mitigation against a second wave. Global conditions have changed since the last virus outbreak in terms of scale of supply chains and travel. Additionally, the fundamentals of operating environments have changed. These and other factors warrant a critical review of your organization’s BCP programs to mitigate potential business interruption implications for your organization.

Timing is everything in preparing and mitigating the effects of a pandemic. New infections of influenza typically materialize in 3 waves according to the CDC. The 1st wave is currently occuring now and will hopefully subside in spring. The 2nd wave is the more dangerous from a volume of infections and mortality rate and is, if prior patterns hold true, expected to begin in the fall. The 3rd wave in the following winter is likely to be lower in impact. This provides organizations a 6 to 9 month planning window to prepare their risk management and BCP activities.

LogicManager offers our support and some practical tips for those bracing and preparing for the challenges that may arise with BCP for Covid-19 following the outbreak. LogicManager’s customers have been using our platform for BCP since 2006. We have been supporting pandemic scenario planning with comprehensive BCP best practices embedded in our platform since the 2009 flu pandemic (H1N1 influenza virus). 

We have already provided training to our Customer Advisory Team members here at LogicManager on the unique challenges presented by the Coronavirus and recommendations for pandemic related Business Continuity Planning. Customers are encouraged to reach out to your Advisory Analyst and set-up a planning meeting. 

Coronavirus BCP: Steps Needed

For those who do not have BCP plans already, most are asking themselves, or are being asked, “What would we do in this situation?” As part of your pandemic planning process we recommend you to:

• identify core services, and what is needed to maintain your supply chain
• identify staffing arrangements, such as telecommuting, succession planning and cross-skilling
• protect the health of your staff
• develop a communications strategy for employees, customers and suppliers
• consider financial implications, such as cash flow, cost increases and insurance
• identify contingency plans for the unexpected
• schedule how the plan will be tested and updated
• understand your regulatory and reporting compliance requirements

Using a tool such as our ERM software you will be able to identify, mitigate, and monitor risks and escalate issues at your organization, here are some recommended actions as you build or review your Coronavirus BCP plan as you prepare for Coronavirus.

Readiness: Also referred to as a checklist or maturity of risk management to identify where your organization may have gaps and what best practice items should be included as part of your program. The CDC readiness indicators for a pandemic are available in the LogicManager central library along with general guidelines from NFPA 1600 or FFIEC. If you are a customer, ask us to upload these into your environment if you want them.

Risk management plan: Risk management planning for a pandemic involves identifying risks, assessing them and developing strategies to manage these within your business. Review a preparedness standard or guideline like the FEMA Pandemic Influenza Continuity of Operations Template to assist your organization in developing a Pandemic Influenza Continuity of Operations Plan.

Resources: Make sure government and public resource contacts are available for each of your offices for compliance and assistance. It can always help to have printed copies of important phone numbers as well as business continuity plans and procedures.

Communications: Have a communication plan available to your employees outlining policies and specific steps of what will happen in different scenarios and how to access your information. For physical locations this can help ensure a seamless transition back to return to work or return to school.

Coordinate: Create a centralized incident repository for issues and events. If possible, create categorization and routing to make your life easier when the volume picks up. If you already use LogicManager, incidents can be reported via LogicManager web forms from any employee to communicate in emergency situations from anywhere with the internet. This can be set up before the Coronavirus becomes widespread in North America and Europe.

Refresh: Make sure contact information of critical personnel and vendors are up to date. If you are using LogicManager for any of the above, you may want to remind infrequent users how to access the system. 

Prepare: Review RTO times for critical processes and applications ahead of time so that if a staffing shortage occurs, you already know what to prioritize. 

Reflect: Use Incidents to track points of friction, confusion, or failure throughout the process so that when things calm down, you can appropriately update exercises and plans as needed.

Report to and from key stakeholders: Aggregate risks, activities and incident information to your Board of Directors, regulatory authorities and local, State and Federal representatives as appropriate. Typical BC/DR plans have a 48 to 72 hour window for operating. Pandemic BC/DR time window is likely to be at least a year presenting additional operational challenges. As new information for evolving concerns are validated, changes to policies and procedures need to be updated, reviewed and implemented. Your Pandemic BCP will require significantly more stakeholder collaboration and communication including managers, employees, boards of directors, regulators and government representatives. Information gathering and dissemination can be facilitated with automated with tasks, workflows and enterprise incident web forms which have a positive check-off that the information has been received and acted upon.

Evolving Concerns about Coronavirus

(information as of Feb. 4, 2020)

The outbreak is only roughly two months old and the uncertainty about the potential to spread into a pandemic is generating concerns. Will this be more like the H1N1 swine flu outbreak that hit in 2009 or more like the 1918 Spanish Flu pandemic? We are not in the business of the science of the flu, but rather reducing the uncertainty on its effect on our organizations through effective risk management.

Influenza (seasonal flu) mortality in the US has averaged 35,000 each year so why are people worried about coronavirus?

The estimated mortality rate for the seasonal flu is .02%, while the coronavirus is showing possibilities of being over 2%. Further, the contagion spread of the coronavirus is estimated by models to be doubling the number infected each 6 days which may be higher than the 1918 pandemic and the seasonal flu and means Covid-19 BCP is imperative.

Other viruses originating in Asia like SARS were contained, why is this different? A person with a SARS infection was only contagious 1 day prior to showing symptoms. It is a concern that a person with the coronavirus infection may be contagious up to 14 days prior to showing symptoms. If proven true, this would make quarantine and tracking contacts with those infected a very different challenge.

The world has changed significantly in the past two decades since SARS. China’s $14 trillion economy is four times as large as it was 17 years ago and far more globalized. About 150 million Chinese business executives and tourists took an international flight in 2018, more than seven times the 2003 figure, according to JPMorgan. Globally, the number of shipping containers moving among the world’s ports has almost tripled, according to the United Nations.

Isn’t there vaccines for the Coronavirus? Technology is moving faster than ever, however it will likely take months to develop the vaccine not taking into account the manufacturing and distribution of the vaccine which like the seasonal flu vaccine is preventative. It will also take time for a significant quantity of the population to take this new vaccine for it to have an impact.

Coronavirus Business Continuity Plan: How We Can Help